e [ 1048.662940] binder: undelivered TRANSACTION_COMPLETE [ 1048.687084] binder: send failed reply for transaction 5248, target dead 17:54:32 executing program 5: ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000080)=0x0) syz_open_dev$usbmon(&(0x7f0000000140)='/dev/usbmon#\x00', 0x400, 0x200800) r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/mls\x00', 0x0, 0x0) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x200) perf_event_open(0x0, r0, 0xffffffffffffffff, r1, 0x0) r2 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r3 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) ioctl$ASHMEM_SET_PROT_MASK(r1, 0x40087705, &(0x7f0000000380)={0xffff, 0x7ff}) syz_open_dev$mice(&(0x7f00000003c0)='/dev/input/mice\x00', 0x0, 0x4002) syz_open_dev$midi(&(0x7f00000002c0)='/dev/midi#\x00', 0x0, 0x8000) r4 = semget(0x2, 0x3, 0x420) semctl$GETALL(r4, 0x0, 0xd, &(0x7f0000000540)=""/204) keyctl$dh_compute(0x17, &(0x7f0000000180)={r2, r3, r2}, &(0x7f00000000c0)=""/83, 0x3e3, &(0x7f00000001c0)={&(0x7f0000000040)={"6372633332632d696e74656c00fffffffa003100"}, &(0x7f00000001c0)}) 17:54:32 executing program 1: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced7345", 0xbf, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00'}, &(0x7f00000002c0)="62fcf46bbca6f21825b686f280ab7ff6c932", 0x12}) 17:54:32 executing program 1: add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, 0x0, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00'}, &(0x7f00000002c0)="62fcf46bbca6f21825b686f280ab7ff6c932", 0x12}) 17:54:33 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x96000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:54:33 executing program 5: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$RTC_UIE_ON(r0, 0x7003) r1 = add_key$user(&(0x7f0000000140)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r2 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000180)={r1, r2, r1}, &(0x7f00000000c0)=""/83, 0x3e3, &(0x7f00000001c0)={&(0x7f0000000040)={"6372633332632d696e74656c00fffffffa003100"}, &(0x7f00000001c0)}) 17:54:33 executing program 1: add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, 0x0, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00'}, &(0x7f00000002c0)="62fcf46bbca6f21825b686f280ab7ff6c932", 0x12}) 17:54:33 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="00634040000000000000000000006c000000000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:54:33 executing program 2: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x90000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:54:33 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x68000}], 0x1, 0x0) 17:54:33 executing program 5: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) r2 = syz_open_dev$amidi(&(0x7f0000000040)='/dev/amidi#\x00', 0x9, 0x40) getsockopt$inet_mreqsrc(r2, 0x0, 0x26, &(0x7f00000000c0)={@local, @local, @multicast2}, &(0x7f0000000100)=0xc) keyctl$dh_compute(0x17, &(0x7f0000000180)={r0, r1, r0}, &(0x7f0000000340)=""/83, 0x53, &(0x7f00000001c0)={&(0x7f0000000080)={"6372633332632d696e74656c00fffffffa003100"}, &(0x7f00000001c0)}) [ 1049.602475] binder: 32398:32405 got transaction with invalid data ptr [ 1049.611668] binder: 32398:32405 transaction failed 29201/-14, size 255-0 line 2992 [ 1049.623312] binder_alloc: binder_alloc_mmap_handler: 32398 20001000-20004000 already mapped failed -16 [ 1049.633487] binder: BINDER_SET_CONTEXT_MGR already set [ 1049.639071] binder: 32398:32410 ioctl 40046207 0 returned -16 17:54:33 executing program 1: add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, 0x0, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00'}, &(0x7f00000002c0)="62fcf46bbca6f21825b686f280ab7ff6c932", 0x12}) [ 1049.651202] binder: 32398:32405 transaction failed 29189/-3, size 0-0 line 2973 [ 1049.700345] binder: 32398:32410 transaction failed 29189/-3, size 255-0 line 2973 [ 1049.746355] binder: send failed reply for transaction 5253 to 32398:32405 [ 1049.758437] binder: undelivered TRANSACTION_COMPLETE 17:54:33 executing program 5: r0 = perf_event_open(0x0, 0x0, 0x3, 0xffffffffffffffff, 0x0) r1 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r2 = dup2(r0, r0) getsockopt$inet_sctp_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x1, &(0x7f0000000000)={0x0, 0xcd, 0x3, 0xeef, 0x5, 0x2}, &(0x7f0000000200)=0x14) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0x6d, &(0x7f0000000480)=ANY=[@ANYRES32=r3, @ANYBLOB="33000000877419097092a707f7a12aeb9e1427c67f7433ae39887bdb31e960475e7d41de2f6cb450588f07adaf79b8ea243835f854f0a57ee6bb14d897bd4aa728fb34a24643"], &(0x7f0000000440)=0x3b) r4 = add_key$user(&(0x7f0000000140)='user\x00', &(0x7f0000000080)={'syz'}, &(0x7f0000000340)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae956924c7e59c92f1eb86a95087d0372707700c803790f74e808663977e980545835c1bc000096b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530000000000000000000000000000000", 0xc3, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000180)={r1, r4, r1}, &(0x7f00000000c0)=""/83, 0x3e3, &(0x7f00000001c0)={&(0x7f0000000040)={"6372633332632d696e74656c00fffffffa003100"}, &(0x7f00000001c0), 0xfffffffffffffed8}) 17:54:33 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000400000000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:54:33 executing program 1: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={0x0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00'}, &(0x7f00000002c0)="62fcf46bbca6f21825b686f280ab7ff6c932", 0x12}) 17:54:33 executing program 5: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000340)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000180)={r0, r1, r0}, &(0x7f00000000c0)=""/83, 0x3e3, &(0x7f00000001c0)={&(0x7f0000000040)={"6372633332632d696e74656c00fffffffa003100"}, &(0x7f00000001c0)}) [ 1049.973438] binder: 32433:32435 got transaction with invalid data ptr [ 1049.992873] binder: 32433:32435 transaction failed 29201/-14, size 255-0 line 2992 [ 1050.003629] binder_alloc: binder_alloc_mmap_handler: 32433 20001000-20004000 already mapped failed -16 [ 1050.010837] binder: BINDER_SET_CONTEXT_MGR already set [ 1050.019157] binder: 32433:32440 ioctl 40046207 0 returned -16 [ 1050.039193] binder: release 32433:32435 transaction 5258 out, still active [ 1050.051764] binder: undelivered TRANSACTION_COMPLETE [ 1050.062403] binder: send failed reply for transaction 5258, target dead 17:54:34 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x14c000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:54:34 executing program 1: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={0x0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00'}, &(0x7f00000002c0)="62fcf46bbca6f21825b686f280ab7ff6c932", 0x12}) 17:54:34 executing program 5: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snapshot\x00', 0x4000, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(r0, 0x112, 0xa, &(0x7f0000000140)=0x8001, 0x4) r1 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000200)={0x5, 0x0, 0x2, 0x5}) ioctl$DRM_IOCTL_SG_ALLOC(r0, 0xc0106438, &(0x7f0000000340)={0x8, r2}) r3 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, &(0x7f00000002c0)=0x81d5, 0x4) keyctl$dh_compute(0x17, &(0x7f0000000180)={r1, r3, r1}, &(0x7f00000000c0)=""/83, 0x3e3, &(0x7f00000001c0)={&(0x7f0000000040)={"6372633332632d696e74656c00fffffffa003100"}, &(0x7f00000001c0)}) 17:54:34 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000000000710000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:54:34 executing program 2: unshare(0x8020000) restart_syscall() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) msgctl$IPC_RMID(0x0, 0x0) openat(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) writev(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000040)={'lo\x00@\x00', 0x101}) getpgrp(0xffffffffffffffff) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00fffffff500"}) clone(0x0, 0x0, &(0x7f0000000240), &(0x7f0000000000), 0x0) 17:54:34 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x67000}], 0x1, 0x0) 17:54:34 executing program 5: ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000080)) r0 = getpgid(0x0) perf_event_open(0x0, r0, 0xffffffffffffffff, 0xffffffffffffffff, 0xfffffffffffdffff) r1 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000540)="002ecb496d2e8dfb1dc93f105ebc21f93032d694016b71e80b13558a58c55ab4d6724803e7404febf0ed64f368efbf25c1580289c157b089551161c714117b3402696bca5eeb9f12d798ef67a9c671bf7cfc2a5f535cf7d2497e3cf735b01a88ab98cbafd4ef64d049db8031868486e15301304bc9854879fc7eb2f3385b087dd5d41e1180636dd8ce24fc34c04f8fb50fe23e1595940faa7a626858412e8fd3975686a5d8f6fd18a8e47c66196cae3807d9f2aacd1efe683187d336b58baffd0900", 0xc2, 0xfffffffffffffffe) r2 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_proto_private(r3, 0x89eb, &(0x7f0000000740)="4917fe820180af6ddf10a3791df7a2a76e0b8e1908d10221e912d486f12e25ea811fc057d30c208501fd88cce4f210af52ea74053dff5a5faf1b219936b4f75d3c0604a4b162e7b31450d19a0c14ce798be16a50b1df2bea74c4396d66cee0ce22726ab1dd5d080104e5e767a52e1bbc931e87e51d1ec8956c6ac109d4b84a0b0822bf747bf42ca1c6acf4868badbe43f57a4689a9f7c67d0e6f6352856a3d702dbc20b4150d995553f84b4ee2657caad2b3a9006d144aaba36428d4d87a81") keyctl$dh_compute(0x17, &(0x7f0000000180)={r1, r1, r2}, 0xfffffffffffffffe, 0x0, &(0x7f00000002c0)={&(0x7f0000000200)={'ghash-clmulni\x00'}}) keyctl$dh_compute(0x17, &(0x7f0000000300)={r1, r1, r1}, &(0x7f0000000340)=""/60, 0x3c, &(0x7f00000003c0)={&(0x7f0000000380)={'sha1\x00'}, &(0x7f0000000640)="5367060cb5774becb94a9d7cae3399baf9abded78d5d3b8a4533c175075c887706f94c9308160f8b3ec1166e9a4b95addd8c53417da7966e24f89f52d205a82aa17ea0e608d4b210d3a4c2aad4870a315bc5596ee195f87806ed77fa2017345a8113056d7b0454f2fdc9550eb9a069e4c294e64b490b06f787267e9eb51ee587c5ae64d3e4947b4f2382121fb300692ac476de99911ab88f0829a6fbcb5b145444610a67d82da020d1b3b8435c5beafe14bc33a7b71c733077c67f5b83a35656df173a10efe9fdab714aeec2b16cd9dce26072f705f4", 0xd6}) keyctl$dh_compute(0x17, &(0x7f0000000140)={r1, r2, r1}, &(0x7f00000000c0)=""/83, 0x53, &(0x7f00000001c0)={&(0x7f0000000040)={"6372633332632d696e74656c00fffffffa003100"}, &(0x7f00000001c0)}) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000400)='/dev/hwrng\x00', 0x0, 0x0) ioctl$SG_SET_RESERVED_SIZE(r4, 0x2275, &(0x7f0000000800)=0x40000000000) ioctl$SNDRV_SEQ_IOCTL_DELETE_QUEUE(r4, 0x408c5333, &(0x7f0000000840)={0x6, 0x401, 0x2, 'queue0\x00', 0x2c3f}) [ 1050.661491] device lo entered promiscuous mode [ 1050.667211] binder: 32458:32467 got transaction with invalid data ptr [ 1050.700933] binder_alloc: binder_alloc_mmap_handler: 32458 20001000-20004000 already mapped failed -16 17:54:34 executing program 1: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={0x0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00'}, &(0x7f00000002c0)="62fcf46bbca6f21825b686f280ab7ff6c932", 0x12}) [ 1050.701213] binder: BINDER_SET_CONTEXT_MGR already set [ 1050.765041] device lo left promiscuous mode [ 1050.818819] binder: 32458:32470 ioctl 40046207 0 returned -16 [ 1050.825419] binder_alloc_new_buf_locked: 6 callbacks suppressed [ 1050.831732] binder_alloc: 32458: binder_alloc_buf, no vma [ 1050.837930] binder_alloc: 32458: binder_alloc_buf, no vma [ 1050.844036] binder_release_work: 18 callbacks suppressed [ 1050.844042] binder: undelivered TRANSACTION_ERROR: 29201 17:54:34 executing program 1: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, 0x0, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00'}, &(0x7f00000002c0)="62fcf46bbca6f21825b686f280ab7ff6c932", 0x12}) [ 1050.865220] binder: undelivered TRANSACTION_ERROR: 29189 [ 1050.874162] binder: undelivered TRANSACTION_ERROR: 29189 [ 1050.885524] binder: send failed reply for transaction 5263 to 32458:32467 [ 1050.893406] could not allocate digest TFM handle ghash-clmulni [ 1050.900471] binder: undelivered TRANSACTION_COMPLETE [ 1050.911295] binder: undelivered TRANSACTION_ERROR: 29189 [ 1050.914445] could not allocate digest TFM handle ghash-clmulni 17:54:34 executing program 5: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f00000000c0)=""/83, 0x53, &(0x7f0000000140)={&(0x7f0000000040)={"6372633332632d696e74656c00fffffffa003100"}, &(0x7f0000000340)="2296c8dae33cefb8e60f4b67bfdf61386372245e63f60783f79bc3077f9441497da25aa1b2398452cce5e0e6bf046d0bf525f854f1d30799cb273a6230524a3a000400001ba71406fdf5f2476e8668a6ee25584c83bcbde7ec6fffd2a93b00000000", 0x62}) r2 = creat(&(0x7f0000000180)='./file0\x00', 0x80) setsockopt$inet_sctp_SCTP_HMAC_IDENT(r2, 0x84, 0x16, &(0x7f00000001c0)=ANY=[@ANYBLOB="03000000ff0107e00300"], 0xa) 17:54:34 executing program 1: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, 0x0, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00'}, &(0x7f00000002c0)="62fcf46bbca6f21825b686f280ab7ff6c932", 0x12}) 17:54:34 executing program 1: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, 0x0, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00'}, &(0x7f00000002c0)="62fcf46bbca6f21825b686f280ab7ff6c932", 0x12}) 17:54:35 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0xad000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:54:35 executing program 5: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000180)={r0, r1, r0}, &(0x7f00000000c0)=""/83, 0x3e3, &(0x7f00000001c0)={&(0x7f0000000040)={"6372633332632d696e74656c00fffffffa003100"}, &(0x7f00000001c0)}) keyctl$dh_compute(0x17, &(0x7f00000002c0)={r0, r1, r0}, &(0x7f00000003c0)=""/4, 0x4, &(0x7f0000000580)={&(0x7f0000000400)={'sm4-generic\x00'}, &(0x7f0000000540)="2b1f404bd436763952d9", 0xa}) r2 = syz_open_dev$vcsn(&(0x7f0000000200)='/dev/vcs#\x00', 0x8, 0x105002) openat$zero(0xffffffffffffff9c, &(0x7f0000000640)='/dev/zero\x00', 0x2000, 0x0) ioctl$VIDIOC_S_TUNER(r2, 0x4054561e, &(0x7f0000000340)={0x1000, "b61008d03f09f951a9bb4aa3613d5d57d0211f3a51bc8ad3835234d5ca3dd2ea", 0x7, 0x4, 0x1, 0xffffffffffffff01, 0x1, 0x0, 0x6, 0x2}) r3 = syz_open_dev$amidi(&(0x7f0000000080)='/dev/amidi#\x00', 0x0, 0x3fffc) write$selinux_context(r3, &(0x7f00000006c0)='eystem_u:object_r:semanawe_exec_t:s0\x00', 0xfffffffffffffe81) perf_event_open(&(0x7f00000005c0)={0x3, 0x70, 0xa636, 0x3ff, 0x10000, 0x80, 0x0, 0x2, 0x1004a, 0x2, 0x8, 0xffffffff, 0x56, 0x17, 0x0, 0x4, 0x4, 0xf01, 0x8, 0x5c7, 0x1, 0x2, 0x8001, 0x5, 0xf2b, 0x1, 0x9, 0x66e5, 0x3, 0x80000001, 0x401, 0x1, 0x7fff, 0x7ff, 0x2, 0x9, 0x101, 0x1, 0x0, 0x80000001, 0x6, @perf_config_ext={0xffffffffffff8000, 0x92}, 0x12001, 0xfff, 0x20, 0x6, 0x0, 0x800, 0xff}, 0xffffffffffffffff, 0x1, r2, 0xa) 17:54:35 executing program 1: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00'}, &(0x7f00000002c0)="62fcf46bbca6f21825b686f280ab7ff6c932", 0x12}) 17:54:35 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000006800000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:54:35 executing program 2: unshare(0x8020000) restart_syscall() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) msgctl$IPC_RMID(0x0, 0x0) openat(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) writev(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000040)={'lo\x00@\x00', 0x101}) getpgrp(0xffffffffffffffff) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00fffffff500"}) clone(0x0, 0x0, &(0x7f0000000240), &(0x7f0000000000), 0x0) 17:54:35 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x18c000}], 0x1, 0x0) 17:54:35 executing program 1: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00'}, &(0x7f00000002c0)="62fcf46bbca6f21825b686f280ab7ff6c932", 0x12}) [ 1051.675639] binder: 32519:32527 got transaction with invalid data ptr [ 1051.698967] binder_alloc: binder_alloc_mmap_handler: 32519 20001000-20004000 already mapped failed -16 [ 1051.716698] device lo entered promiscuous mode [ 1051.753434] binder: BINDER_SET_CONTEXT_MGR already set [ 1051.773792] could not allocate digest TFM handle sm4-generic [ 1051.777824] binder: 32519:32532 ioctl 40046207 0 returned -16 [ 1051.786621] device lo left promiscuous mode [ 1051.792956] binder_alloc: 32519: binder_alloc_buf, no vma 17:54:35 executing program 1: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00'}, &(0x7f00000002c0)="62fcf46bbca6f21825b686f280ab7ff6c932", 0x12}) [ 1051.818146] binder_alloc: 32519: binder_alloc_buf, no vma [ 1051.838940] could not allocate digest TFM handle sm4-generic [ 1051.853405] binder: undelivered TRANSACTION_ERROR: 29201 [ 1051.861221] binder: undelivered TRANSACTION_ERROR: 29189 17:54:35 executing program 5: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000180)={r0, r1, r0}, &(0x7f00000000c0)=""/83, 0x3e3, &(0x7f00000001c0)={&(0x7f0000000040)={"6372633332632d696e74656c00fffffffa003100"}, &(0x7f00000001c0)}) r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/enforce\x00', 0x22001, 0x0) ioctl$SG_SET_FORCE_PACK_ID(r2, 0x227b, &(0x7f0000000140)=0x1) [ 1051.894967] binder: undelivered TRANSACTION_ERROR: 29189 [ 1051.928944] binder: send failed reply for transaction 5268 to 32519:32527 [ 1051.965162] binder: undelivered TRANSACTION_COMPLETE [ 1051.983210] binder: undelivered TRANSACTION_ERROR: 29189 17:54:35 executing program 1: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, 0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00'}, &(0x7f00000002c0)="62fcf46bbca6f21825b686f280ab7ff6c932", 0x12}) 17:54:35 executing program 5: r0 = perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r2 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) r3 = dup2(r0, r0) getsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r3, 0x84, 0x8, &(0x7f0000000080), &(0x7f0000000140)=0x4) r4 = geteuid() getresuid(&(0x7f0000000880)=0x0, &(0x7f00000008c0), &(0x7f0000000900)) syz_mount_image$hfsplus(&(0x7f0000000200)='hfsplus\x00', &(0x7f00000002c0)='./file0\x00', 0x2, 0x7, &(0x7f00000007c0)=[{&(0x7f0000000340)="d08b058daf6055e691678de79b9ee1a5c0850c99f643b3ed50e743222eb35a69c4c44fcc14aea4ad5d4fcee3f3898a9b2abf8ffd5a860a34799861fb24acc383ae651d6c09237d4253e0ae9ba36c89cfc185250a9558b19ee453f5322d789cb39ffd505cc42ce5", 0x67, 0x2}, {&(0x7f00000003c0)="45a97e1d0a2931703637e46a77b7c68ffed97fc6a5b617f5ee74b13472f1556b0cc9b931d4e0f21cc2c94984317649689b5268d59f782de84ac85a4513209ea73bc0c5105bc1e2d041cda9dac31970b3349ca7b03a21f673e06479b631d4498f76e9b689501159", 0x67, 0x7ff}, {&(0x7f0000000540)="35099d525a2ed867c4270e2e3164acb53bd3a93ac9bbbc6a6302eb93551c12de9335877c0ffee3f65b05fd733fbf5e9fce41254a38d665def08d01b1d399840cb0fbc574469d00146788da03b480c848d8e695309bf45548ab8c76dcb3dd893585c2f5a18621538b71d38a7186ce6a8a2257cd718043ddcf", 0x78, 0x200}, {&(0x7f00000005c0)="4fb908a9f08bf91d9e7ddbe9d4e46278cfef380e608fc4272075e3490267d6ee2782", 0x22, 0x8}, {&(0x7f0000000600)="ef234480190de00c27cab08de19ebefb9ffaa309b0e759a80b5a326495ee8f1ce8179d182c72972358d4a61266513ab824ccd0984c6a16682d46ad158b46b2c05bbd410982b5cf1fa499014564793e1a640adca44d559f41f1e9ff8ebc4ce41d480f1462910a411e160e1b2b6f75a2c8ee599663661aa1c37c9dafaac4", 0x7d, 0x7fffffff}, {&(0x7f0000000680)="50e74beff98bcd354eeb9703eb490fb6fc52101e8580c61f5ae5ecb8df375c0e039e435e2b767c1175af07", 0x2b, 0x8f}, {&(0x7f00000006c0)="4b26a83702f8e722cf750d7c5c1d204dd381dafaeb6eae52e8aeb4abf1f3e3d2fe2fa333b6732f34eb23841680e2d5c5a1a0343fe66d85c0fd18883fcc3d933e05220e3472846f43c63d8bf27118e61168ca46ff916915511e682cdd908e714436bab15ee012db4e95467639b71b2e3065c7bd468d736fde4aca90c8263621a8306b3e4ca234d3e07cfd00921495853870de85c27d972ad3750899808f4fe5494f193b53edf04fd6fb310f5a1f5972c5c9f1ab7f152da17a855dca2d5ca9f4b6874813ba3efc0d0179350b", 0xcb, 0x2}], 0x10, &(0x7f0000000940)={[{@nobarrier='nobarrier'}, {@type={'type', 0x3d, "e6c8f797"}}], [{@mask={'mask', 0x3d, '^MAY_APPEND'}}, {@dont_appraise='dont_appraise'}, {@pcr={'pcr', 0x3d, 0x17}}, {@euid_gt={'euid>', r4}}, {@uid_lt={'uid<', r5}}, {@context={'context', 0x3d, 'unconfined_u'}}]}) keyctl$dh_compute(0x17, &(0x7f0000000180)={r1, r2, r1}, &(0x7f00000000c0)=""/83, 0x3e3, &(0x7f00000001c0)={&(0x7f0000000040)={"6372633332632d696e74656c00fffffffa003100"}, &(0x7f00000001c0)}) 17:54:35 executing program 1: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, 0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00'}, &(0x7f00000002c0)="62fcf46bbca6f21825b686f280ab7ff6c932", 0x12}) [ 1052.202664] hfsplus: unable to parse mount options 17:54:36 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0xbb000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:54:36 executing program 1: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, 0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00'}, &(0x7f00000002c0)="62fcf46bbca6f21825b686f280ab7ff6c932", 0x12}) 17:54:36 executing program 5: r0 = syz_open_dev$dspn(&(0x7f0000000200)='/dev/dsp#\x00', 0x20, 0x98000) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000240)={0x0, 0x0}) r2 = perf_event_open(0x0, r1, 0xfffffffdffffffff, r0, 0x0) fcntl$getown(r2, 0x9) r3 = add_key$user(&(0x7f00000002c0)='user\x00', &(0x7f0000000380)={'syz'}, &(0x7f0000000300)="05", 0x1, 0xfffffffffffffffb) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f0000000280)={0x3, 0xa6}) epoll_ctl$EPOLL_CTL_DEL(r0, 0x2, r2) r4 = syz_open_dev$midi(&(0x7f0000000080)='/dev/midi#\x00', 0x3, 0x20200) getsockopt$inet_dccp_buf(r4, 0x21, 0xf, &(0x7f0000000540)=""/4096, &(0x7f0000000140)=0x1000) r5 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000180)={r3, r5, r3}, &(0x7f00000000c0)=""/83, 0x3e3, &(0x7f00000001c0)={&(0x7f0000000040)={"6372633332632d696e74656c00fffffffa003100"}, &(0x7f00000001c0)}) ioctl$UI_SET_SWBIT(r4, 0x4004556d, 0x7) ioctl$BLKRAGET(r0, 0x1263, &(0x7f00000003c0)) 17:54:36 executing program 5: openat$rtc(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rtc0\x00', 0x100, 0x0) r0 = syz_open_dev$dmmidi(&(0x7f0000000140)='/dev/dmmidi#\x00', 0x1, 0x45a000) fcntl$getownex(0xffffffffffffff9c, 0x10, &(0x7f0000000200)={0x0, 0x0}) perf_event_open(0x0, r1, 0x40000000000, r0, 0x0) r2 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r3 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) ioctl$sock_inet6_udp_SIOCINQ(r0, 0x541b, &(0x7f00000002c0)) keyctl$dh_compute(0x17, &(0x7f0000000180)={r2, r3, r2}, &(0x7f00000000c0)=""/83, 0x3e3, &(0x7f00000001c0)={&(0x7f0000000040)={"6372633332632d696e74656c00fffffffa003100"}, &(0x7f00000001c0)}) 17:54:36 executing program 2: unshare(0x8020000) restart_syscall() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) msgctl$IPC_RMID(0x0, 0x0) openat(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) writev(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000040)={'lo\x00@\x00', 0x101}) getpgrp(0xffffffffffffffff) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00fffffff500"}) clone(0x0, 0x0, &(0x7f0000000240), &(0x7f0000000000), 0x0) 17:54:36 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x6d000}], 0x1, 0x0) 17:54:36 executing program 1: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, 0x0) 17:54:36 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000007fffffff00000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) [ 1052.853572] binder: 32593:32602 got transaction with invalid data ptr 17:54:36 executing program 5: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) socketpair$inet(0x2, 0x6, 0x1, &(0x7f00000002c0)) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x200000, 0x0) write$P9_RLCREATE(r2, &(0x7f0000000200)={0x18, 0xf, 0x2, {{0x1, 0x4, 0x6}, 0x6}}, 0x18) keyctl$dh_compute(0x17, &(0x7f0000000180)={r0, r1, r0}, &(0x7f00000000c0)=""/83, 0x3e3, &(0x7f00000001c0)={&(0x7f0000000040)={"6372633332632d696e74656c00fffffffa003100"}, &(0x7f00000001c0)}) rt_sigsuspend(&(0x7f0000000080)={0x3}, 0x8) 17:54:36 executing program 1: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, 0x0) [ 1052.895957] binder_transaction: 8 callbacks suppressed [ 1052.895974] binder: 32593:32602 transaction failed 29201/-14, size 255-0 line 2992 [ 1052.949812] device lo entered promiscuous mode [ 1052.968718] binder_alloc: binder_alloc_mmap_handler: 32593 20001000-20004000 already mapped failed -16 [ 1052.972313] binder: BINDER_SET_CONTEXT_MGR already set 17:54:36 executing program 1: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, 0x0) [ 1053.025585] device lo left promiscuous mode [ 1053.026133] binder: 32593:32612 ioctl 40046207 0 returned -16 [ 1053.044972] binder_alloc: 32593: binder_alloc_buf, no vma [ 1053.051781] binder: 32593:32602 transaction failed 29189/-3, size 0-0 line 2973 [ 1053.074987] binder_alloc: 32593: binder_alloc_buf, no vma [ 1053.089100] binder: 32593:32621 transaction failed 29189/-3, size 255-0 line 2973 [ 1053.099159] binder: send failed reply for transaction 5273 to 32593:32602 [ 1053.109171] binder: undelivered TRANSACTION_ERROR: 29189 [ 1053.122200] binder: undelivered TRANSACTION_ERROR: 29189 [ 1053.133573] binder: undelivered TRANSACTION_COMPLETE 17:54:36 executing program 1: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={0x0, &(0x7f00000002c0)="62fcf46bbca6f21825b686f280ab7ff6c932", 0x12}) 17:54:37 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000006000000000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:54:37 executing program 1: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={0x0, &(0x7f00000002c0)="62fcf46bbca6f21825b686f280ab7ff6c932", 0x12}) 17:54:37 executing program 2: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0xa3000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:54:37 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x14f000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:54:37 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x16c000}], 0x1, 0x0) 17:54:37 executing program 1: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={0x0, &(0x7f00000002c0)="62fcf46bbca6f21825b686f280ab7ff6c932", 0x12}) [ 1053.729976] binder: 32639:32645 got transaction with invalid data ptr [ 1053.743733] binder: 32639:32645 transaction failed 29201/-14, size 255-0 line 2992 [ 1053.760901] binder_alloc: binder_alloc_mmap_handler: 32639 20001000-20004000 already mapped failed -16 [ 1053.771284] binder: BINDER_SET_CONTEXT_MGR already set [ 1053.776910] binder: 32639:32650 ioctl 40046207 0 returned -16 17:54:37 executing program 5: r0 = perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r2 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) fstat(r0, &(0x7f0000001a80)={0x0, 0x0, 0x0, 0x0, 0x0}) syz_mount_image$xfs(&(0x7f0000000080)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x7ff, 0x8, &(0x7f0000001880)=[{&(0x7f0000000540)="3a6df8462c54745217f4a2eadc5bdd5a6ed645079fa769bf3f64cbdf55bfd9d77f6ca608fefb50508890980c2adb7f3856e6d184315b196ce8a56eaf0bdc8f08237af798725dae05063a3c82454345db9a58b3b690401e5f72ac56c4f16764638ea89a17ecb6dfb206c9562e16d5ceb07c81aad2395765cc9b6c407e94849c9b0872b19ba4e53754dcb6b77c162856a9a786f90f8b28bd24c551ab49644d1ec47bd7d59c2083e583bac7868ec360c60112a69ffcb05f65a20a434671a288234feabb97d5c3f331857020ebae290857cc92eb9c3deb9db3c1e7e7cb5b3ee54a13edd07eb3c90501456642b82b08707f0b975722fb8035d86330bf07f62c588970b6ecf2e7d27b9a662df2f767b8a50c12d39b9459b55b88cebed1b58b4cfe7d2dcd7f8aadc20cda2615f737e6baf1df63cacfa20308f08364d91bb61f218d0f4a5aee6f42a7097d0a2dc28a78fe648ebe352c120d07a2666e356ca7549a622629af88124ab78539849ae8ecc47f60baf37907355131828d1169ff17e31809b57acae584d486de82c4add7073ec4d3174e6b6ac366193eae25ee2b281a45f4c31d49c89002bd0d15a7fdf2183f38c04246cf43dd412cb94e5becf88e846042ccec8c8b6d31998b4f52cd5c365088dfc668a3dc6bc785cfbc2dfff129118b9ea43beb3ba2ed9c7de8fe34ff332dd5ae673b2092587b865cc11a322c645019d5a8a009e12b213144d247e79939b5663092b3efeabf478c540e7919573dc641813105da4da491866eb164602c845d977d97adf99cae606250fae7de571fb8547e3bb498ae11bb330812afab18230cda2214c72bfb6ace796c81d33ad40af5434ad6c92c2d733e627bf47e63d85783b078bd9400f590b1f1214478e865c84183593839601f10334c81d216a1020c42be98410b609c69b530a04b6a6a1b86131b54dc3ac8630236c3c844b5602aad6e5e8acf5d76fd7f2142db6d885453b709a69c24d1ef695ac9f80c6b54244327a5592ef3486d365da688fe57ebbe0ddbcad5257acedb54780fadbc2399e3b76e3f3ae2484bc1e54a2e165aa2ad4fdf49987bf373e212f52e79ff6ce07be2b8ba27b0dfd7bb47a8dedc8097e6dc8b2d0adb3d8a7f7d6f87bf833abdda7f9a040667ce984ec4f0778a902e3a30984c2c88c243e290847d784f77666396602a96822729d489d20bbaaa92f00b6b426fb30f4f646393cbb41de33c4a13d3aec5323cc29a505da964c087289aeb49b3501964a4822ea58a138aa352becc475a70204c823263bc020902231924d0e5ac3258212dcfcee29bfad0de11bfadaa782df5948477aa121166db7009d82a377a22077e48d084b47fe6884737a77b5f07714018376a61909dd924ba8b4c851dd5543c263faf0ea9bd2ef10be4840bc304c2c64c9f9ded73e6389fba924e5be111c40cd1b334fd00911452e8073b2b029fa0671f8258bd3a4225f0375a324dc7cc74713c1a6a7dcb6346b4d97767d0e9b339c17e92bb03f22359da4e4452f7ebd970c316910673d339ff9365270e173864987f595d70aa1db117d6f4d6d3277ec88d8ee79bfdd27593b337dcdcd7c25253dba868757ff61782b674657091588dec0603f97e43cb5537f609510e964c4faadfd477fb2119db9f27c1eb05a3b8b326b18fd9a1006d1854b11bbd5621368090c45564fc50e4950e97649f587e4180e54d37ebd8ce4d733f3eda19d385cda89b52798b2fc08d18b475763a3858ecf4486d39829c90a29bf0bde957070c1f9bbfd8607ee5d8f01a0a5a98a73b84cf762e1f49d967f379273c493bd57e5a9311413c727a303e035b768e93732ae3a8b456f35871c51f7c8e29ac80b92f679ea2eb0f9b1696495dc63999a35a6276bebca7c1148c54b835d2ce78d2eafc007690ce90de0351744ebe951f49c17b82b0c48744e217d451e48d30a6454ff342b3a2608147b6977bd58dbc3c91135d73be9fdd81e584a5ffff74860a75f7a02e6bd727f10d6bc816919046af81998048c6e59cd66796baddb29e5817773851693a19debd34b702758a40230f5badae628d78ef43d3a4c960e3b04a2b7ba0ea6c51ef45178afa85282cf6d8ffc602b4becf80f8b4b71d0d5d66182c3f18c9f805a0466569babcb5ff4ca5a4f2e0027cd7f1cbcd17f98e4eb4bb8c14db38a967e82f48a323b4cd5011068b8e17ba44aea8920d3349bbba4ab4f28341ffd6cb1aa643b025970c8fdc26af1a674d660b06b58574f62736dbc5a5f21bf42ba488df6e39c37f6e0db32a412b1c0a6d33643958e28855da6292374e74dfd2e70751fca6845065ef636570928b26b320dea08140098017d2bd6220154638d37016087a2d5c71d99fff783fa9f222cd6159ba4a97194547eb089f713beacb8fd914a9a798812b7e1c2fc50765fb63b52e0b4d0c78e802a66da4d0b5d4eb1ef35beb378571b5e05498ab4924c0776566be91ec3142fa3ef64910083e517d63ede151d499000e7960cd2cb33f2738053fee2a1e6cb1b8c6f7f5425bbc2318a156bfb03724b2578290237cf5de324ac924787b9127a8691496da0e8c9c9e8445ca68318ec97b512d60add5ea7ad8cda7f9b8390f24069b8c1d5f1aa81f7fc2a0d751a56e182551444c57a61cb3b6bffd758cd2e00cafe468e3c84774a6a46867664543b1bfcd6924c4c75592d03baaeb6e665b3235a55bdb44bd602984ec21b5d233da0d0720e2f590b3e854ab7edb7fd277cb797e38ea0433ed2c5430757bc19ba04c55bbc028e7d626ef5913bff980ebd99a8f2b585c096f60330416ebf32b0afa7dfe90c01b4983ed233c4b8a61a75b846e48ab431193613a1d51492334fe6fdbb6311a9d19212f04b4d81fd0e1c4136f7bd21d60e6aa4fc863e790f2c5911db6277c88a7ca97832bac44d147633bb1b26d5f99b12b47c664c74556c1e294f49f1965fd7898af2b20d494b4c8955d45906be54c99fc4ae218cbe248e0f0f9e612823114c44d00f5d81bcfa86c246693b85421460af01f5c46e5f4d06e43d3d8ae353ac83cf8878b97969886ad2ff77f218af15a51db9c6e7f819f47c3bfebea443276d878558173504c3c5034078903393fe0c28c94d91dc78eaef99e9acfaa77ffabe7b8fc6a7241a056955c91862ece0486ad9e497dc239b827a8889fcc67f22b9736b0a9c1f8d3c5a397a211a64be89bff3f9a40321b4150445191c33518718de87607b5ea3261b25cfb3b46025fc89600c833e2610d37a325130a9b719d2719236a9e8b64c67f8d6a4c8c557bc0290433f471a9710428fc6219bc6657969ceaf2d04f9180e072adeb06cd274853858b4aa7f7b68ff83c2912e6322c833e966504e65b125c170fcb0a0981e62fe81131efe2cd8b45f53834d8f2c00e7a2543ef78d49e8d8042d83bc4271a37674c533f5de232508e629a2333360af2f960b0af546dac7f3c49436afc78146bb8a42353567d730572e08df86cbc12d4dedaa8a7580513d1e031c3e34165b99b0f5b7d570c5acc20df33bab547fbfec4f8cc7280c45316c20d4418cc896352730d33c325603c918bee7e59fd4a90b857e4da25f6a31f228fd1e50496fbc32c1196ace4eb0b21610ce8d75fb5e3d176fde1a2ac1e51c1f01bb988fd91b6e40d8a874a38b7447bc7a7fbc4fa84a3563fb75f753d2895f410ba2d5f286447ed7b64c1db05e59535e1e2f3bafdc3f60f3acc972409b7a6e8c119e693ac1448e2c8f63ff2b9698264cc0561257bf65bfccf1204e60f8eb996ad640f70a27d052056fcbf2c92a3882900e553e4091e928509af2c0765b83dd67ae17caf372fd8fccb67378acb96fced6af762541426b3dd680e52cb2655671aca74fa4bfc5ca0d8e07867962fcaee62f6322d2617b8b4b0a98c73be91b720485254ac76ca523bf42bf543195664db152eb3318dc6b7134d223e5e52653afdd99113ff3ecb964d7e98415a1e1a05b930b3fbad9874b38f9a5dfcbc0eac8fd3c41dcb7e2978b54a3f63fd2cb0a732ccef0a6eddf24124393f84d9f27a76cfedf52589a0cf8a9e1b4568e60348113c672f3543d66faf6db6d8b1b07d3369ed5b9deacb15546d59bf32553c2b5fbb0a7fd9cb23271e36d228537e3994670bddd421f030cce1b2e642e8524ad22dea43832a401e69376d0496c286ad935b178473d8bb80c6c592f5245fac5202b293b060358d09d9b8d84a150b284fa6ceefcf7c57ffc70f711f1f2f34c498f664fc153734a60f69337fd44f61e65b9eab86a79f8cf077750662dbdfcfe710d9c7fdef9a5299e1b6479afd8946e62555f3c9abd188956afc74f8c33028b8dbe382a5bbb871de04f48c3737526053761c03c6720bcd01942d717cb51948356d583a66b9ea9fe5fdfe38dfbfb149035bc99e316b85e2b218b2f5becb878cb3910db59fd60b7f811308faccd42fd49d4cc1283eb45b8abf0629db06ab30e2ea475d611e740fbda9d3a37409502b352f37ded87e0dcb70f484ac24afedb635dd0584cc1e50589bc9ecf5c665553c829fb2c01056803793e56e7d919cb4f2112747899840acba54baae3bc38989045f2c43770c693998214f749d86cd212dde01684160387234485d61ec8a677b1bff47c87e06f2b5ace599b5800cb085f4a55da588304e0ed19f72435c7e25f461e97e14173e7f3bc615341590ed7672f954ae1eaf208ac5993c7ff7be119aaba098360aa609d70dd683e5d94ff0e9d80f32d8ba0d4bcdb4d501ff2fbb44293065c2d5a92beaf186013df39173c88b1bb4dc3e477520020c81b496e3a679add118aaca11e372f09db09d938052d3901a52c716f76bdb2ef7e40f866c9e9d8e95458edfa65509f1f2392d8828fc1b2a54908f335be7850a4afcd6ded276ed48e92c3a0fcf80fb9b0c457e2569bc7f64809ba569a2fad14dbdaf6cd6bcde2dff528da3c2a47af2869c4aa420cf02a81d48bc599b57a33316e91263457792d358f574ab1896d04d3d0c94247929429e71aa636e491af6694975e0ec0302eded1046477a53f0019fb5c2e68c203809ee7349540d3c80c6abeedf71531e0ece69388c7d22a455ec9ff0061d98038e68de30cadf65302d6ea31f0f427c934f0ccfc43939f68d766693f36c40c57875351d1f08ff4dd2ae7029d98cd99b1eaad80ec614629b01943b3ecbd494161f92589e3cddfad186ad93892ea80e8ea1870c890be37aa63e32fa314e3ac4e5a3b3dd1a52a8de7bfb37e0bbc3db911e2a8761dcdbdb9d94ebfcfa18f1902dafee91c834b8d075dfcc1d851fd1a68cc6912d638854945438f22acb3885a9486e72ff97e4d8303577ea1f059967955af377c4440cf9497eec907a2f2240e25a07e7f19b42c10f2b52b19d62ee9e96a85d116ef0a7f4ad2d02200a2a4ce98109c65a819489a202586fc2dc88424b6f17a13b5bfb937877a98051b48d30e48601c0c7bc949c8b656a7f8ae5b52412244f7bfaef18d0594cc9272dae346158cbf4db31145bbc54b9df969c16a7b5a2c40cb209d4f35a1280f27d61eaedef649fa10eb1af984e81c06910b9b1b5c5046411130edea3f349dd7631dc2cb76b96042bf468f177f6621a1653604b7ec8e6233bc4155ef7064bb86ab4242621d242c41985b09e50ecf78fb7dcdb601cfd257244c393940b7506d17a3ff1b08f75bc81431f47e401f4a2a75b6a2f5d06f9306ab8cedb119c267a1ebe141e4029f78ba0c2e21c74df6e6089d8b14878003a6c3db838d95edee42bed4a3b213198fdfbe414cdc7cdee55288f5296a51adb770a98ede08338af93db2fa61a133dce0e", 0x1000, 0xffff}, {&(0x7f0000000340)="34d144d8f5e7a319f7e946375a90ed92001182155a33f331a649c8a43c8e897abcba134124187ed639b8f8de1f026c039c3432879db55d7789512cea13c367a4678e2efe2796dbcfd5f3c01c8019d0dbffe20d65a650a6cb21fd14a277bcd4bd2943a65e4ad0d77ad881bf4375c03c2f9c11a4cac7df723526e9b4394a7c170f4a053d63944ffb5e1c60383088ac1700592bb970169ee8d2b9886456eb32475300a201ed8539be1eca10e5a6546e0cd71c4d999d2a8e5434f4505c81b82cefce5999ba4bfffcecd31dbfec6a7d51bb49fd1dc3ae4290f1ca9aeca6ca", 0xdc}, {&(0x7f0000000200)="58a6516aa487aba6fb2b5542e97cc744c07053612152", 0x16, 0x10000}, {&(0x7f0000001540)="903a19d735a439898cfcb54afd625a2161bf0818288573ffd138d39c51fcbe52c2207849d189d9035a3795e48237a7beda1d6b7001ffdf00127a72a8a46f5c0bf60e0fdf01cc8e2b8c87e6a63bde4de8e0e38b587b62d196bb7cb11ca435457e6df31bcb62ca1a9cf704ba4715208750705593ab28a26eb4b3d39e3214f50e32adba717c823741d9f3892da58f9702c767275084b49bff2a11e8c8d72dd76a6ae56a26dca24c", 0xa6, 0x3}, {&(0x7f0000001600)="25c9327e2ea4f0d0c24abe79d61d4ad027ed6fade51cf375786fb965bb79bf77a8380dbde16dd13fb1eca36f8abb6a484b01daf823cb3fb5640f5d803ad51799692fe0bfc7e81c0debe8a6f28afc1ff8e944e7f7a2c66a83ccd921e3727c4196a58225c4d1631062d6671ca500db23ab873a0c69d9c04285653dacd8", 0x7c, 0x6}, {&(0x7f0000001680)="73f4b87544b69ea7cb2725ea0c118a3e64f5f9e37a9aedbf834b290583d315761e34dc1ebf96e0c69ccb8cff8270af92c0d6cb2f71734c18ce150c9eaea546c894c7260efc0813e341349244c2d1da9b91956d1182625a6792d2d50a35b02a40b94b6fcef40c886dc4064c9449f72631c68fbe2b548a8ec047910199b22cb977d08bbbcca7c44af76f0efece9ca5687091c9fe7b6aa9430902ee975a796c38913975c58e289b6224f2b03890cfc1ae7570523168305b1124d3f837d26ba276bb4b0fc2b3126fec73b36b6d1d6b9a0b30ce4400a63ad8fccd4c46f808f71536de8522311b9e781c36a29b9e6c10ef3e3c71c3cd50e380955487", 0xf9, 0x4}, {&(0x7f0000001780)="bbab6ab10d1f52e4767ac2af6c690c5d521a46221acc6144a2f67d67d389d9cfffd4495b04cda24d9f9e67b0c99479a5b1370b12c3f8206dc251158961dd911151c9eef3b5e5721d50a1b25d9a6cf709e80c11f898d60c6d1ad618147c6a90b5b8fd056f1062636de1047a797991bb214fc92b709b823715f5aaac887397df061452e7398e25204a3cf8ada6cff8ab266aec571e97c26142fb2a5614ee24f6d9c52475261ed95df7dca020ab4f889fe64babf148c5697555ad1f55c728d189159dc1d7e5033086230c9ccf64a9d50d5b2571eb6500f53d84b5ae4aea4234cd8a5f7334d069859775a46a90c930e485e4c3a115a6930e3182f11c5b151549", 0xfe, 0x2}, {&(0x7f00000002c0)="d024", 0x2, 0x6}], 0x20, &(0x7f00000019c0)={[{@attr2='attr2'}, {@prjquota='prjquota'}, {@lazytime='lazytime'}], [{@measure='measure'}, {@uid_lt={'uid<', r3}}]}) keyctl$dh_compute(0x17, &(0x7f0000000180)={r1, r2, r1}, &(0x7f00000000c0)=""/83, 0x3e3, &(0x7f00000001c0)={&(0x7f0000000040)={"6372633332632d696e74656c00fffffffa003100"}, &(0x7f00000001c0)}) [ 1053.828542] binder_alloc: 32639: binder_alloc_buf, no vma [ 1053.865067] binder_alloc: 32639: binder_alloc_buf, no vma [ 1053.896936] binder: 32639:32659 transaction failed 29189/-3, size 0-0 line 2973 [ 1053.917173] binder: release 32639:32645 transaction 5278 out, still active [ 1053.925111] binder: 32639:32660 transaction failed 29189/-3, size 255-0 line 2973 [ 1053.934076] binder: undelivered TRANSACTION_COMPLETE 17:54:37 executing program 1: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00'}}) 17:54:37 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000068000000000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) [ 1053.945407] binder: send failed reply for transaction 5278, target dead 17:54:37 executing program 5: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x800, 0x0) ioctl$BLKROGET(r0, 0x125e, &(0x7f0000000400)) r1 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r2 = add_key$user(&(0x7f00000002c0)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000340)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) r3 = syz_open_dev$dspn(&(0x7f0000000140)='/dev/dsp#\x00', 0x22ab, 0x200000) ioctl$KDGKBMODE(r3, 0x4b44, &(0x7f0000000200)) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/audio\x00', 0x0, 0x0) ioctl$KVM_GET_TSC_KHZ(r4, 0xaea3) keyctl$dh_compute(0x17, &(0x7f0000000180)={r1, r2, r1}, &(0x7f00000000c0)=""/83, 0x3e3, &(0x7f00000001c0)={&(0x7f0000000040)={"6372633332632d696e74656c00fffffffa003100"}, &(0x7f00000001c0)}) 17:54:37 executing program 1: unshare(0x8020000) restart_syscall() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) msgctl$IPC_RMID(0x0, 0x0) openat(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) writev(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000040)={'lo\x00@\x00', 0x101}) getpgrp(0xffffffffffffffff) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00fffffff500"}) clone(0x0, 0x0, &(0x7f0000000240), &(0x7f0000000000), 0x0) [ 1054.076249] binder: 32674:32680 got transaction with invalid data ptr [ 1054.089493] binder: 32674:32680 transaction failed 29201/-14, size 255-0 line 2992 [ 1054.122559] binder_alloc: binder_alloc_mmap_handler: 32674 20001000-20004000 already mapped failed -16 [ 1054.133922] binder: BINDER_SET_CONTEXT_MGR already set [ 1054.146455] binder: 32674:32686 ioctl 40046207 0 returned -16 [ 1054.159035] binder_alloc: 32674: binder_alloc_buf, no vma 17:54:37 executing program 5: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm-control\x00', 0x20000, 0x0) ioctl$sock_bt_bnep_BNEPGETSUPPFEAT(r0, 0x800442d4, &(0x7f0000000140)=0x800) r1 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r2 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000180)={r1, r2, r1}, &(0x7f00000000c0)=""/83, 0x3e3, &(0x7f00000001c0)={&(0x7f0000000040)={"6372633332632d696e74656c00fffffffa003100"}, &(0x7f00000001c0)}) [ 1054.167852] binder_alloc: 32674: binder_alloc_buf, no vma [ 1054.176587] binder: 32674:32680 transaction failed 29189/-3, size 0-0 line 2973 [ 1054.195077] device lo entered promiscuous mode [ 1054.209922] binder: release 32674:32680 transaction 5283 out, still active 17:54:37 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000000000400000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:54:37 executing program 5: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) r2 = syz_open_dev$dmmidi(&(0x7f0000000080)='/dev/dmmidi#\x00', 0xb, 0x10000) write$USERIO_CMD_SET_PORT_TYPE(r2, &(0x7f0000000140)={0x1, 0x5}, 0x2) keyctl$dh_compute(0x17, &(0x7f0000000180)={r0, r1, r0}, &(0x7f00000000c0)=""/83, 0x3e3, &(0x7f00000001c0)={&(0x7f0000000040)={"6372633332632d696e74656c00fffffffa003100"}, &(0x7f00000001c0)}) [ 1054.218115] binder: 32674:32688 transaction failed 29189/-3, size 255-0 line 2973 [ 1054.226986] device lo left promiscuous mode [ 1054.227291] binder: undelivered TRANSACTION_COMPLETE [ 1054.238102] binder: send failed reply for transaction 5283, target dead [ 1054.320951] binder: 32697:32699 got transaction with invalid data ptr [ 1054.336338] binder: 32697:32699 transaction failed 29201/-14, size 255-0 line 2992 [ 1054.355270] binder_alloc: binder_alloc_mmap_handler: 32697 20001000-20004000 already mapped failed -16 [ 1054.379304] binder: BINDER_SET_CONTEXT_MGR already set [ 1054.384660] binder: 32697:32703 ioctl 40046207 0 returned -16 [ 1054.391669] binder: release 32697:32699 transaction 5288 out, still active [ 1054.399501] binder: undelivered TRANSACTION_COMPLETE [ 1054.404745] binder: send failed reply for transaction 5288, target dead 17:54:38 executing program 2: unshare(0x8020000) restart_syscall() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) msgctl$IPC_RMID(0x0, 0x0) openat(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) writev(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000040)={'lo\x00@\x00', 0x101}) getpgrp(0xffffffffffffffff) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00fffffff500"}) setns(0xffffffffffffffff, 0x0) 17:54:38 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x128000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:54:38 executing program 5: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) r2 = syz_open_dev$dmmidi(&(0x7f0000000080)='/dev/dmmidi#\x00', 0x81, 0x2) ioctl$SCSI_IOCTL_DOORUNLOCK(r2, 0x5381) keyctl$dh_compute(0x17, &(0x7f0000000180)={r0, r1, r0}, &(0x7f00000000c0)=""/83, 0x3e3, &(0x7f00000001c0)={&(0x7f0000000040)={"6372633332632d696e74656c00fffffffa003100"}, &(0x7f00000001c0)}) 17:54:38 executing program 1: unshare(0x8020000) restart_syscall() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) msgctl$IPC_RMID(0x0, 0x0) openat(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) writev(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000040)={'lo\x00@\x00', 0x101}) getpgrp(0xffffffffffffffff) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00fffffff500"}) setns(0xffffffffffffffff, 0x0) 17:54:38 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000000000000001000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:54:38 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0xbc000}], 0x1, 0x0) 17:54:38 executing program 2: unshare(0x8020000) restart_syscall() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) msgctl$IPC_RMID(0x0, 0x0) openat(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) writev(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000040)={'lo\x00@\x00', 0x101}) getpgrp(0xffffffffffffffff) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00fffffff500"}) setns(0xffffffffffffffff, 0x0) [ 1054.759070] binder: 32717:32722 got transaction with invalid data ptr [ 1054.767764] binder_alloc: binder_alloc_mmap_handler: 32717 20001000-20004000 already mapped failed -16 [ 1054.789000] binder: BINDER_SET_CONTEXT_MGR already set [ 1054.814069] binder: 32717:32723 ioctl 40046207 0 returned -16 [ 1054.836993] device lo entered promiscuous mode [ 1054.856388] binder: release 32717:32722 transaction 5293 out, still active 17:54:38 executing program 5: r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000200)='/dev/audio\x00', 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r0, 0x0, 0x76, 0x20, &(0x7f0000000340)="bf5989303e42f63224322aac2bd7c3bf6e4f4e47c66813f5f8fc1615f93d5829ceade53afd8f028f313e8c69fcf723cd181025e1712b0ad0bf9ac8a80d8a87f6f5f3a2e1de46431491215e89f0ee95872a0244652cee7e7e9beac035e269b59aa5a655c31993abd708c51017c6e4a93eb98544c39c22", &(0x7f00000002c0)=""/32, 0x4de}, 0x28) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r2 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) r3 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm-control\x00', 0x200, 0x0) ioctl$SNDRV_CTL_IOCTL_PVERSION(r3, 0x80045500, &(0x7f0000000140)) keyctl$dh_compute(0x17, &(0x7f0000000180)={r1, r2, r1}, &(0x7f00000000c0)=""/83, 0x3e3, &(0x7f00000001c0)={&(0x7f0000000040)={"6372633332632d696e74656c00fffffffa003100"}, &(0x7f00000001c0)}) 17:54:38 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000000000000074000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) [ 1054.865691] binder: undelivered TRANSACTION_COMPLETE [ 1054.872300] binder: send failed reply for transaction 5293, target dead [ 1054.886566] device lo entered promiscuous mode [ 1054.998102] device lo left promiscuous mode 17:54:38 executing program 5: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) r2 = open(&(0x7f0000000140)='./file0\x00', 0x10000, 0x80) ioctl$sock_bt_bnep_BNEPGETCONNINFO(r2, 0x800442d3, &(0x7f0000000200)={0xd1036b7, 0x9, 0x8b85, @link_local, 'sit0\x00'}) keyctl$dh_compute(0x17, &(0x7f0000000180)={r0, r1, r0}, &(0x7f00000000c0)=""/83, 0x3e3, &(0x7f00000001c0)={&(0x7f0000000040)={"6372633332632d696e74656c00fffffffa003100"}, &(0x7f00000001c0)}) ioctl$SG_GET_RESERVED_SIZE(r2, 0x2272, &(0x7f0000000080)) [ 1055.033440] device lo left promiscuous mode 17:54:38 executing program 1: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0xdd000}], 0x1, 0x0) 17:54:38 executing program 5: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) socketpair$inet6_icmp_raw(0xa, 0x3, 0x3a, &(0x7f0000000080)={0xffffffffffffffff}) getsockopt$IP6T_SO_GET_REVISION_TARGET(r1, 0x29, 0x45, &(0x7f0000000140)={'IDLETIMER\x00'}, &(0x7f0000000200)=0x1e) r2 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000180)={r0, r2, r0}, &(0x7f00000000c0)=""/83, 0x3e3, &(0x7f00000001c0)={&(0x7f0000000040)={"6372633332632d696e74656c00fffffffa003100"}, &(0x7f00000001c0)}) [ 1055.115846] binder: 32746:32752 got transaction with invalid data ptr 17:54:38 executing program 2: unshare(0x8020000) restart_syscall() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) msgctl$IPC_RMID(0x0, 0x0) openat(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) writev(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000040)={'lo\x00@\x00', 0x101}) getpgrp(0xffffffffffffffff) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00fffffff500"}) setns(0xffffffffffffffff, 0x0) [ 1055.364454] binder_alloc: binder_alloc_mmap_handler: 32746 20001000-20004000 already mapped failed -16 [ 1055.375655] binder: BINDER_SET_CONTEXT_MGR already set [ 1055.381053] binder: 32746:32764 ioctl 40046207 0 returned -16 [ 1055.398313] binder: send failed reply for transaction 5298 to 32746:32748 [ 1055.422047] binder: undelivered TRANSACTION_COMPLETE [ 1055.461465] device lo entered promiscuous mode [ 1055.499580] device lo left promiscuous mode 17:54:39 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x5b000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:54:39 executing program 5: r0 = perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, r0, 0x0, 0x5, &(0x7f0000000080)='user\x00'}, 0x30) fcntl$setown(r0, 0x8, r1) r2 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000200)='/dev/vcs\x00', 0x101100, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffff9c, &(0x7f0000000380)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000340)={0xffffffffffffffff}, 0x2, 0x100d}}, 0x20) r5 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/dlm-monitor\x00', 0xc000, 0x0) write$RDMA_USER_CM_CMD_MIGRATE_ID(r3, &(0x7f0000000400)={0x12, 0x10, 0xfa00, {&(0x7f00000002c0), r4, r5}}, 0x18) r6 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000180)={r2, r6, r2}, &(0x7f00000000c0)=""/83, 0x3e3, &(0x7f00000001c0)={&(0x7f0000000040)={"6372633332632d696e74656c00fffffffa003100"}, &(0x7f00000001c0)}) 17:54:39 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000a0000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:54:39 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x73000}], 0x1, 0x0) 17:54:39 executing program 1: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x181000}], 0x1, 0x0) [ 1056.180915] binder: 315:323 got transaction with invalid data ptr 17:54:39 executing program 5: r0 = fcntl$getown(0xffffffffffffffff, 0x9) perf_event_open(0x0, r0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000180)={0x0, r1}, &(0x7f00000000c0)=""/83, 0x3e3, &(0x7f00000001c0)={&(0x7f0000000040)={"6372633332632d696e74656c00fffffffa003100"}, &(0x7f00000001c0)}) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x40, 0x0) membarrier(0x40, 0x0) write$selinux_load(r2, &(0x7f0000000200)={0xf97cff8c, 0x8, 'SE Linux', "35107ef654576d2f632f7563f4bc98d29f95634bc0e487f8ad1fd0476d09c235c33c310cde661e111e4c05abce5acf27d5f7ee57a99ab61ba7f6841f8d763f2b29d06945f6ea8e431230ae1e4bce5637caa70bad013ab5c8f22a6b2a2a66f4ac447dd39f2dff4178b3f1f2f0450b463292b160454e8e377b4a603e32f723e541558f803c755cbf001c3c7c7848c5922680fc2d03774801ae33ca0ef49db8c20d87b9c76d1de5db438e5c2f7f7ce53126447ff1a7daf827b12300b07db81b53a4dde8bceb10cb4f0c221c299c307e2c7385e07b19f95b6f0757"}, 0xe9) 17:54:39 executing program 5: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000000080)='user\x00', &(0x7f0000000140)={'syz', 0x0}, &(0x7f0000000200)='syz', 0xfffffffffffffffb) r0 = add_key$user(&(0x7f0000000600)='user\x00', &(0x7f0000000240)={'syz', 0x3}, &(0x7f0000000580)='#', 0xfffffc3a, 0x0) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000180)={r0, r1, r0}, &(0x7f00000000c0)=""/83, 0x3e3, &(0x7f00000001c0)={&(0x7f0000000040)={"6372633332632d696e74656c00fffffffa003100"}, &(0x7f00000001c0)}) 17:54:40 executing program 5: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000180)={r0, r1, r0}, &(0x7f00000000c0)=""/83, 0x10d, &(0x7f00000001c0)={&(0x7f0000000040)={"6372633332632d696e74656c00fffffffa003100"}, &(0x7f00000001c0)}) 17:54:40 executing program 5: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000080)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0x11, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000540)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000180)={r0, r1, r0}, &(0x7f00000000c0)=""/83, 0x3e3, &(0x7f00000001c0)={&(0x7f0000000040)={"6372633332632d696e74656c00fffffffa003100"}, &(0x7f00000001c0)}) r2 = request_key(&(0x7f00000002c0)='id_resolver\x00', &(0x7f0000000300)={'syz', 0x1}, &(0x7f0000000400)="f4db305482fe12c95402c10000000000", 0xfffffffffffffffe) keyctl$search(0xa, r0, &(0x7f0000000140)='cifs.spnego\x00', &(0x7f0000000200)={'syz', 0x3}, r2) r3 = syz_open_dev$vbi(&(0x7f0000000380)='/dev/vbi#\x00', 0x1, 0x2) ioctl$VIDIOC_S_INPUT(r3, 0xc0045627, &(0x7f0000000340)=0x3) 17:54:40 executing program 2: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0xbd000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) [ 1056.608557] binder: BINDER_SET_CONTEXT_MGR already set [ 1056.613915] binder: 315:319 ioctl 40046207 0 returned -16 [ 1056.635859] binder_alloc_new_buf_locked: 6 callbacks suppressed [ 1056.635867] binder_alloc: 315: binder_alloc_buf, no vma [ 1056.668894] binder_alloc: 315: binder_alloc_buf, no vma [ 1056.674828] binder_release_work: 18 callbacks suppressed [ 1056.674835] binder: undelivered TRANSACTION_ERROR: 29201 [ 1056.696389] binder: undelivered TRANSACTION_ERROR: 29189 [ 1056.710062] binder: undelivered TRANSACTION_ERROR: 29189 17:54:40 executing program 5: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) r2 = semget$private(0x0, 0x3, 0x200) semctl$GETALL(r2, 0x0, 0xd, &(0x7f0000000340)=""/122) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000080)) keyctl$dh_compute(0x17, &(0x7f0000000180)={r0, r1, r0}, &(0x7f00000000c0)=""/83, 0x3e3, &(0x7f00000001c0)={&(0x7f0000000040)={"6372633332632d696e74656c00fffffffa003100"}, &(0x7f00000001c0)}) 17:54:40 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000000002000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) [ 1056.720301] binder: send failed reply for transaction 5303 to 315:319 [ 1056.735786] binder: undelivered TRANSACTION_COMPLETE [ 1056.774305] binder: undelivered TRANSACTION_ERROR: 29189 [ 1056.789905] binder: 362:365 got transaction with invalid data ptr [ 1056.808741] binder_alloc: binder_alloc_mmap_handler: 362 20001000-20004000 already mapped failed -16 [ 1056.818841] binder: BINDER_SET_CONTEXT_MGR already set [ 1056.824455] binder: 362:368 ioctl 40046207 0 returned -16 [ 1056.837812] binder_alloc: 362: binder_alloc_buf, no vma [ 1056.844755] binder_alloc: 362: binder_alloc_buf, no vma [ 1056.857340] binder: undelivered TRANSACTION_ERROR: 29201 [ 1056.864748] binder: undelivered TRANSACTION_ERROR: 29189 [ 1056.885771] binder: undelivered TRANSACTION_ERROR: 29189 [ 1056.904911] binder: send failed reply for transaction 5308 to 362:365 [ 1056.913493] binder: undelivered TRANSACTION_COMPLETE [ 1056.928753] binder: undelivered TRANSACTION_ERROR: 29189 17:54:40 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x158000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:54:40 executing program 5: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000180)={r0, r1, r0}, &(0x7f00000000c0)=""/83, 0x3e3, &(0x7f00000001c0)={&(0x7f0000000040)={"6372633332632d696e74656c00fffffffa003100"}, &(0x7f00000001c0)}) socketpair$inet_smc(0x2b, 0x1, 0x0, &(0x7f0000000080)) 17:54:40 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000000048000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:54:40 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x158000}], 0x1, 0x0) 17:54:40 executing program 1: perf_event_open(&(0x7f00000003c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000180)={r0, r1, r0}, &(0x7f00000000c0)=""/83, 0x3e3, &(0x7f00000001c0)={&(0x7f0000000040)={'crc32c-intel\x00\x00\x00\x00\x00\x001\x00'}, &(0x7f00000001c0), 0x0, [0x4000000000000000]}) syz_open_dev$mouse(0x0, 0x0, 0x0) ioctl$DRM_IOCTL_ADD_BUFS(0xffffffffffffffff, 0xc0206416, 0x0) [ 1057.396053] binder: 385:392 got transaction with invalid data ptr [ 1057.414717] binder_alloc: binder_alloc_mmap_handler: 385 20001000-20004000 already mapped failed -16 [ 1057.424308] binder: BINDER_SET_CONTEXT_MGR already set [ 1057.430583] binder: 385:395 ioctl 40046207 0 returned -16 [ 1057.438147] binder_alloc: 385: binder_alloc_buf, no vma 17:54:40 executing program 5: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000080)='/dev/video36\x00', 0x2, 0x0) ioctl$VIDIOC_ENUMINPUT(r0, 0xc050561a, &(0x7f0000000340)={0xfffffffffffffffe, "aa9189be48a27d8398103f3ee16d107e899c1dc0ddfaf1214593795f20ab8c20", 0x1, 0x3954, 0x2, 0xc170c, 0x900, 0x8}) r1 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r2 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000180)={r1, r2, r1}, &(0x7f00000000c0)=""/83, 0x3e3, &(0x7f00000001c0)={&(0x7f0000000040)={"6372633332632d696e74656c00fffffffa003100"}, &(0x7f00000001c0)}) [ 1057.445395] binder_alloc: 385: binder_alloc_buf, no vma [ 1057.451250] binder: undelivered TRANSACTION_ERROR: 29201 [ 1057.458318] binder: undelivered TRANSACTION_ERROR: 29189 17:54:41 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000000000000a0000000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) [ 1057.495169] binder: send failed reply for transaction 5313 to 385:392 [ 1057.533128] binder: undelivered TRANSACTION_COMPLETE 17:54:41 executing program 1: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x56000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) [ 1057.620269] binder: 408:409 got transaction with invalid data ptr [ 1057.628388] binder_alloc: binder_alloc_mmap_handler: 408 20001000-20004000 already mapped failed -16 [ 1057.643635] binder: BINDER_SET_CONTEXT_MGR already set [ 1057.661785] binder: 408:410 ioctl 40046207 0 returned -16 17:54:41 executing program 2: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x6a000}], 0x1, 0x0) 17:54:41 executing program 5: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) inotify_init() r0 = request_key(&(0x7f0000000080)='.request_key_auth\x00', &(0x7f0000000140)={'syz', 0x3}, &(0x7f0000000200)='syz', 0xfffffffffffffffa) keyctl$assume_authority(0x10, r0) r1 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r2 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000180)={r1, r2, r1}, &(0x7f00000000c0)=""/83, 0x3e3, &(0x7f00000001c0)={&(0x7f0000000040)={"6372633332632d696e74656c00fffffffa003100"}, &(0x7f00000001c0)}) [ 1057.679000] binder_alloc: 408: binder_alloc_buf, no vma [ 1057.697787] binder_alloc: 408: binder_alloc_buf, no vma [ 1057.710644] binder: send failed reply for transaction 5318 to 408:409 [ 1057.719824] binder: undelivered TRANSACTION_COMPLETE 17:54:41 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000003000000000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:54:41 executing program 5: r0 = perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r2 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) readahead(r0, 0x40, 0x100) keyctl$dh_compute(0x17, &(0x7f0000000180)={r1, r2, r1}, &(0x7f00000000c0)=""/83, 0x3e3, &(0x7f00000001c0)={&(0x7f0000000040)={"6372633332632d696e74656c00fffffffa003100"}, &(0x7f00000001c0)}) [ 1057.840997] binder: 426:430 got transaction with invalid data ptr [ 1057.851513] binder_alloc: binder_alloc_mmap_handler: 426 20001000-20004000 already mapped failed -16 [ 1057.862720] binder: BINDER_SET_CONTEXT_MGR already set [ 1057.868432] binder: 426:431 ioctl 40046207 0 returned -16 [ 1057.874479] binder_alloc: 426: binder_alloc_buf, no vma [ 1057.881614] binder_alloc: 426: binder_alloc_buf, no vma [ 1057.889435] binder: release 426:430 transaction 5323 out, still active [ 1057.897177] binder: undelivered TRANSACTION_COMPLETE [ 1057.902566] binder: send failed reply for transaction 5323, target dead 17:54:41 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x18000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:54:41 executing program 5: r0 = dup(0xffffffffffffff9c) ioctl$VIDIOC_OVERLAY(r0, 0x4004560e, &(0x7f0000000140)=0x3f) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rfkill\x00', 0x0, 0x0) ioctl$UI_SET_EVBIT(r2, 0x40045564, 0xe) r3 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000180)={r1, r3, r1}, &(0x7f00000000c0)=""/83, 0x3e3, &(0x7f00000001c0)={&(0x7f0000000040)={"6372633332632d696e74656c00fffffffa003100"}, &(0x7f00000001c0)}) 17:54:41 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000068000000000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:54:41 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0xb6000}], 0x1, 0x0) 17:54:41 executing program 5: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) ioctl$SG_GET_LOW_DMA(r0, 0x227a, &(0x7f0000000200)) r2 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000080)={'syz'}, &(0x7f0000000300)='\a', 0xffffffffffffffe5, 0xfffffffffffffffe) r3 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000180)={r2, r3, r2}, &(0x7f00000000c0)=""/83, 0x3e3, &(0x7f00000001c0)={&(0x7f0000000040)={"6372633332632d696e74656c00fffffffa003100"}, &(0x7f00000001c0)}) ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f0000000240)={0x4, 0x7ff, 0x1, 0x400, 0x7fff}) [ 1058.411061] binder: 445:447 got transaction with invalid data ptr [ 1058.424234] binder_transaction: 23 callbacks suppressed [ 1058.424250] binder: 445:447 transaction failed 29201/-14, size 255-0 line 2992 17:54:42 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000080)='/dev/vcsa#\x00', 0x8, 0x800) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000140)) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r2 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000180)={r1, r2, r1}, &(0x7f00000000c0)=""/83, 0x3e3, &(0x7f00000001c0)={&(0x7f0000000040)={"6372633332632d696e74656c00fffffffa003100"}, &(0x7f00000001c0)}) [ 1058.463675] binder_alloc: binder_alloc_mmap_handler: 445 20001000-20004000 already mapped failed -16 [ 1058.467303] binder: BINDER_SET_CONTEXT_MGR already set [ 1058.480075] binder: 445:458 ioctl 40046207 0 returned -16 17:54:42 executing program 1: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0xa8000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) [ 1058.508837] binder: 445:447 transaction failed 29189/-3, size 0-0 line 2973 [ 1058.537710] binder: 445:465 transaction failed 29189/-3, size 255-0 line 2973 [ 1058.573553] binder: release 445:447 transaction 5328 out, still active [ 1058.589183] binder: undelivered TRANSACTION_COMPLETE 17:54:42 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000060000000000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) [ 1058.626239] binder: send failed reply for transaction 5328, target dead 17:54:42 executing program 2: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, 0xffffffffffffffff) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 17:54:42 executing program 5: r0 = perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) ioctl$DRM_IOCTL_RES_CTX(0xffffffffffffff9c, 0xc0106426, &(0x7f0000000340)={0x3, &(0x7f00000002c0)=[{0x0}, {}, {}]}) ioctl$DRM_IOCTL_GET_CTX(r0, 0xc0086423, &(0x7f0000000380)={r2, 0x3}) r3 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) request_key(&(0x7f0000000080)='id_legacy\x00', &(0x7f0000000140)={'syz', 0x3}, &(0x7f0000000200)='GPLwlan0@vmnet1em0-#)em1selinux\x00', 0xfffffffffffffffe) keyctl$dh_compute(0x17, &(0x7f0000000180)={r1, r3, r1}, &(0x7f00000000c0)=""/83, 0x3e3, &(0x7f00000001c0)={&(0x7f0000000040)={"6372633332632d696e74656c00fffffffa003100"}, &(0x7f00000001c0)}) [ 1058.758335] binder: 479:480 got transaction with invalid data ptr [ 1058.765052] binder: 479:480 transaction failed 29201/-14, size 255-0 line 2992 [ 1058.777774] binder_alloc: binder_alloc_mmap_handler: 479 20001000-20004000 already mapped failed -16 [ 1058.783853] binder: BINDER_SET_CONTEXT_MGR already set [ 1058.799475] binder: 479:481 ioctl 40046207 0 returned -16 17:54:42 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000060000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:54:42 executing program 5: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) socket$inet6_sctp(0xa, 0x0, 0x84) keyctl$dh_compute(0x17, &(0x7f0000000180)={r0, r1, r0}, &(0x7f00000000c0)=""/83, 0x3e3, &(0x7f00000001c0)={&(0x7f0000000040)={"6372633332632d696e74656c00fffffffa003100"}, &(0x7f00000001c0)}) [ 1058.807121] binder: 479:484 transaction failed 29189/-3, size 255-0 line 2973 [ 1058.811845] binder: 479:480 transaction failed 29189/-3, size 0-0 line 2973 [ 1058.832493] binder: release 479:480 transaction 5333 out, still active [ 1058.840440] binder: undelivered TRANSACTION_COMPLETE [ 1058.846464] binder: send failed reply for transaction 5333, target dead [ 1058.917358] binder: 490:494 got transaction with invalid data ptr [ 1058.923953] binder: 490:494 transaction failed 29201/-14, size 255-0 line 2992 [ 1058.933712] binder_alloc: binder_alloc_mmap_handler: 490 20001000-20004000 already mapped failed -16 [ 1058.943641] binder: BINDER_SET_CONTEXT_MGR already set [ 1058.954346] binder: 490:495 ioctl 40046207 0 returned -16 [ 1058.960686] binder: 490:494 transaction failed 29189/-3, size 0-0 line 2973 [ 1058.969588] binder: 490:498 transaction failed 29189/-3, size 255-0 line 2973 [ 1058.977773] binder: release 490:494 transaction 5338 out, still active [ 1058.985993] binder: undelivered TRANSACTION_COMPLETE [ 1058.999722] binder: send failed reply for transaction 5338, target dead 17:54:42 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x186000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:54:42 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000000000000060ffffffffff0000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:54:42 executing program 5: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = add_key(&(0x7f0000000d40)='keyring\x00', &(0x7f0000000d80)={'syz', 0x3}, &(0x7f0000000dc0)="ae11905d209515aa382baddceaa5e26fd425739a6af95a56dd0c1f0f07c47f7e2b9987bc51c4edbb97638d737c36befc1cbd13f795897ad2484662ab213a9b44bb735756cbdf992e68cee8347b55918d3f8e1477726272e6ccb633a91545909120b0509598e663d6c28beda9449362ecba1fcc9e303cc0398e2bf53ae6dab6447721dd330c4955cad7215b99206672a782dab848ea32a53b347d4eef702172041e844bbe544a3945a11944b88fe79a64ad8847d43b8cb0eeb006403045918f70be9c15df96e375f2cda79eee2f9557180aa3772b8bb855d01f47ef8254d24fdfd2fc13a04f067e61830035ca9f72cc94b483b9ee817e69ce9ad6af3e9ac0", 0xfe, 0xffffffffffffffff) r1 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, r0) r2 = add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000140)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) syz_mount_image$nfs(&(0x7f0000000200)='nfs\x00', &(0x7f00000002c0)='./file0\x00', 0x3, 0x9, &(0x7f0000000c00)=[{&(0x7f00000006c0)="8520266cf6378f16b6fcb2f13cf6362389f42c9709a044e48bfe86ae1943be86d5567d0e28a8260199566df51064c7b276cd27b2ec2734b72bdfc8fa8e296e08a74ebb0b82a2c8894f6d3e84343b752c707b4f5f10e82743bfa7f5f10b054fd8221b4c02f432733543cfd8610657c5375aef7e7c36e69509696de8900fee61fd4d0e3a82edf63610e897bf0c7916bd9d96890e67a9ecec2b60f65530b8b6de70be24b93def80ef875dd79b2513f33234f326eaf0c062df8c21b98c34689fb3e78c21ccc3ecedff1534fbe55ad1ee04dd98e432367be388bda1a1a8aeab2c4fc99ffb4e2ac7f73f68aa797bff948f188197bc88986a3c82209ec7af", 0xfb, 0x3}, {&(0x7f0000000380)="c106f59cdbd5b0b2896d745201f02144622ab546a1bc56bd64629de7e5b7e8859873364d751d0c57f114761ce91ed84096915a5db12d9ac2496a21ef4d63ea1fa6f9c6db60877d7186379098535c97453ccf363210055bf8c70e0cc8e8fc5dab99ac0a27661c0e7aff7bf943c1ebf80e6a67dde2dd2f3f5208d2692b2383e81d4cba7c381ae9f2563624f7537193ffea3a08cb4b3063b2685c01", 0x9a, 0xb39}, {&(0x7f0000000480)="86a50c25c959c4c9539d7eddea41f166e38615099f43ec95130e158f5747642d480816cda538582bc6a949ae9c95ae5893598b7239bb2280a79c4e9f0679c300e8a372ecdc41293ad00fc82b9f25311d072f576107a87769fd9a8681d20219b615471025e9c24e1641d99397a77ae8bf5ad0305ce82d6701a96f39ff86380d3f9d72550e6e90cd2ae577ec62aaca531ce713f401de945e6422f88bcc8132c6db8e99", 0xa2, 0x5}, {&(0x7f00000007c0)="6a4106754ece932aee3f958d46de93d87cbdb23206c549c7010de9030542ec71f08942a24d4f0bf11a942818bfb8c99642751d930f04e37685ac47193630dd9a5010cf38e1b1ef45c8ba51c54e655b19e1baf6bcaa93d57fd0f1ec913db23526d7dfc590ce9f22612e9bfd31cea89dec6eea81d11db427aab35e7710f70823f0028d92c53edc6d96b5f1a6dd94995578d5e4cc9c93cbbe402b1998ec4f79c01630abb649f366ee61dff9a3a592209af8f5c8051a2014b97adeca7c75fadbab5d2384774134e2a6d8ced4458e897536a263a6568494", 0xd5}, {&(0x7f00000008c0)="3245998da16f7a6ac1cbe13f1a04b99bdf96c9e1c51729a20abcc7608ff4966daddffbdf802336bdb4e77a5549ac0d5e68c276702b47fc112aa444dd78ad0ae048ceb51cdfe86778a882a085667087eaeafad5f689fc78f0c36c18480ca99e35a8d6a2d7d80677f0c0317e39ce1769088394c8baf609961341386db74ff2e15da2c1f35e1d892cefbb9930789700f85925af93d1708cd0b734bb30db2d17f7748f9495fbd9515fb3fae466fcbb30e03b1a8c0c0d4e470ffe58c65fedec159d30062d54630fec97e7c32e71a8881ad5f505d4507db0912d", 0xd7, 0x630}, {&(0x7f00000009c0)="733877d2b3460b86f83f90e76ac0618feeb972b3dbbea5612aaeee9c7a7ee6b43cdfec1142eb32ec0d5780c7ef455057d9e2e82da8e93d6baa6f542bf746e3d5b0a5910c653c5bbf11ec1ec2969c0dd7ab7a826053265074ca2f8a7b", 0x5c}, {&(0x7f0000000a40)="08d2c2e4d184747439", 0x9, 0x1d2e}, {&(0x7f0000000a80)="b846f4f593d5015414d071c15934c7cc0caa800d4aea3dfd99cacf2da459393ecc4ecbd31880c0f05f59fe09c06c5865a76c27ac4ddc38bff07b3eb1114f90f239829b3e629b053b4696a01c1313da1fc226d6c50446d6af3e26d60a196c60639671691344d4661119b4dd1cdd8729c0ed9e8e1a3e", 0x75, 0x800}, {&(0x7f0000000b00)="962bbc43ff63951957872b2bab30434060cd49f61b2f6a3691a60648e222f8a3d1fb3231ac9e07f861c9857ff0460579199b13f8e0a095790e183c2d11c3b8aed5b7f12d397018b33fbe116e0a8d9e779b4f2ccc8968f8d089667ecda56e97278551153aefb69b379177b834cffef9a28808f64c9803d009bbe592170c425f8c673ce1c5d929ff67370eb87b7fe05e96d0e14199850ffa4c70e1eadeb137d883d6d189d30b1001e158eadd95a95051da17ee2646a4148026df28b2d6c92951bc7d8209ec4a9f5957bd818ea5", 0xcc, 0x40}], 0x80, &(0x7f0000000d00)='syz') r3 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000540)="3894e0aa755678642797c675ec97964e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee49167df4cabb57850837bb9b1fec1d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f1866cf20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530aabb090e38f90724cbbeb1c25c3b00013353e8edc93c66438231019d2bcd485e392da280c441308f9f9df2d0f5d80f35b5997aac2f73280b12752cc0b8300402e5f4feb832041ed9a2e0da21696d56a3ca697cf4141903ef8b13c2bc8dcfd2c26a9443577754615191a2beb6bbd343471d5fe5d14b33937e0d8145282f51fb6a25c7c6ace78ba8", 0x147, r2) pipe2(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2) keyctl$dh_compute(0x17, &(0x7f0000000180)={r1, r3, r1}, &(0x7f00000000c0)=""/83, 0x3e3, &(0x7f00000001c0)={&(0x7f0000000040)={"6372633332632d696e74656c00fffffffa003100"}, &(0x7f00000001c0)}) 17:54:42 executing program 2: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x16000}], 0x1, 0x0) 17:54:42 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0xd9000}], 0x1, 0x0) [ 1059.492847] binder: 515:520 transaction failed 29201/-14, size 255-0 line 2992 17:54:43 executing program 1: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x16b000}], 0x1, 0x0) [ 1059.541696] binder_alloc: binder_alloc_mmap_handler: 515 20001000-20004000 already mapped failed -16 [ 1059.571985] binder: BINDER_SET_CONTEXT_MGR already set [ 1059.577798] binder: 515:526 ioctl 40046207 0 returned -16 17:54:43 executing program 5: r0 = gettid() pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) perf_event_open(0x0, r0, 0xa, r2, 0x2) r3 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r4 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) getsockopt$inet_sctp6_SCTP_STATUS(r2, 0x84, 0xe, &(0x7f0000000340)={0x0, 0x80000000, 0x7, 0x7, 0x8, 0x80, 0x1, 0x1, {0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x7, 0x54, 0x3f, 0x1}}, &(0x7f0000000140)=0xb0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000540)={r5, @in={{0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x1f}}}, 0x8000, 0x9, 0x200, 0xffff, 0x2}, &(0x7f0000000200)=0x98) keyctl$dh_compute(0x17, &(0x7f0000000180)={r3, r4, r3}, &(0x7f00000000c0)=""/83, 0x3e3, &(0x7f00000001c0)={&(0x7f0000000040)={"6372633332632d696e74656c00fffffffa003100"}, &(0x7f00000001c0)}) 17:54:43 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="00634040000000000000000000007a000000000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) [ 1059.618641] binder: send failed reply for transaction 5343 to 515:520 [ 1059.625975] binder: undelivered TRANSACTION_COMPLETE [ 1059.757189] binder: BINDER_SET_CONTEXT_MGR already set [ 1059.762646] binder: 545:547 ioctl 40046207 0 returned -16 [ 1059.798634] binder: release 545:546 transaction 5348 out, still active [ 1059.811651] binder: undelivered TRANSACTION_COMPLETE 17:54:43 executing program 5: r0 = getpgid(0xffffffffffffffff) perf_event_open(0x0, r0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) prctl$PR_SET_FPEXC(0xc, 0x0) r1 = request_key(&(0x7f0000000140)='keyring\x00', &(0x7f0000000200)={'syz', 0x2}, &(0x7f00000002c0)="6372633332632d696e74656c00fffffffa003100", 0xfffffffffffffffc) r2 = add_key$user(&(0x7f0000000400)='user\x00', &(0x7f0000000240)={'syz', 0x2}, &(0x7f0000000540)="07e4531de99a26967eabf2a65f7d1f38f56f137469e8981451120dce3decbe00e32f21c061fb77c66ea61a20c9084362eecedb61d908b759fdd5a100f49c3335bf952a43ad7a0a9b98c946beb7ee84f45003e781d820191f9f309f06d4de6121cec067ce9a448d22fbb5b37e3972a998413f987c2af94f60ab946c5b5043f2152362f9a0370670ded5dc73784d9472beb8ff6c5ec2ba04fe7bb02d9646c1", 0x9e, r1) r3 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) openat$mixer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/mixer\x00', 0x20000, 0x0) keyctl$dh_compute(0x17, &(0x7f0000000180)={r2, r3, r2}, &(0x7f00000000c0)=""/83, 0x3e3, &(0x7f00000001c0)={&(0x7f0000000040)={"6372633332632d696e74656c00fffffffa003100"}, &(0x7f00000001c0)}) 17:54:43 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000000000000000007fffffff0000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) [ 1059.848161] binder: send failed reply for transaction 5348, target dead [ 1059.907083] binder_transaction: 2 callbacks suppressed [ 1059.907093] binder: 553:556 got transaction with invalid data ptr [ 1059.920637] binder_alloc_mmap_handler: 1 callbacks suppressed [ 1059.920653] binder_alloc: binder_alloc_mmap_handler: 553 20001000-20004000 already mapped failed -16 [ 1059.945888] binder: BINDER_SET_CONTEXT_MGR already set [ 1059.951299] binder: 553:558 ioctl 40046207 0 returned -16 17:54:43 executing program 5: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000180)={0x0, r0}, &(0x7f00000000c0)=""/83, 0x3e3, &(0x7f00000001c0)={&(0x7f0000000040)={"6372633332632d696e74656c00fffffffa003100"}, &(0x7f00000001c0)}) 17:54:43 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000000006000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) [ 1059.958585] binder: release 553:556 transaction 5353 out, still active [ 1059.970198] binder: send failed reply for transaction 5353, target dead [ 1060.034618] binder: 565:566 got transaction with invalid data ptr [ 1060.043191] binder: BINDER_SET_CONTEXT_MGR already set [ 1060.049057] binder_alloc: binder_alloc_mmap_handler: 565 20001000-20004000 already mapped failed -16 [ 1060.055115] binder: 565:569 ioctl 40046207 0 returned -16 [ 1060.076649] binder: release 565:566 transaction 5358 out, still active [ 1060.085101] binder: send failed reply for transaction 5358, target dead 17:54:44 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x61000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:54:44 executing program 5: r0 = perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) prctl$PR_GET_KEEPCAPS(0x7) ioctl$FICLONERANGE(r0, 0x4020940d, &(0x7f0000000340)={r0, 0x0, 0x3f, 0x81a, 0x800}) utime(&(0x7f0000000200)='./file0\x00', &(0x7f00000002c0)={0x7, 0x7fffffff}) r1 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r2 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000380)='/selinux/policy\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_INITMSG(r2, 0x84, 0x2, &(0x7f00000003c0), &(0x7f0000000400)=0x8) r3 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) prctl$PR_SET_MM(0x23, 0xf, &(0x7f0000ffb000/0x4000)=nil) fsetxattr$trusted_overlay_nlink(r0, &(0x7f0000000080)='trusted.overlay.nlink\x00', &(0x7f0000000140)={'U-', 0x9}, 0x28, 0x0) getsockopt$inet_mreqn(r2, 0x0, 0x0, &(0x7f0000000540)={@dev, @broadcast, 0x0}, &(0x7f0000000580)=0xc) getsockname$packet(r2, &(0x7f0000001cc0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001d00)=0x14) ioctl$sock_inet_SIOCDELRT(r2, 0x890c, &(0x7f0000001c40)={0xfffffffffffffffa, {0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x12}}, {0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0xe}}, {0x2, 0x4e22}, 0xa0, 0x10001, 0x100000001, 0x71d, 0x3, &(0x7f0000001c00)='veth1_to_bridge\x00', 0x800, 0x1000, 0xffffffffffff8001}) openat$rtc(0xffffffffffffff9c, &(0x7f0000008480)='/dev/rtc0\x00', 0x0, 0x0) getsockopt$inet_mreqn(r2, 0x0, 0x23, &(0x7f000000aac0)={@dev, @dev, 0x0}, &(0x7f000000ab00)=0xc) sendmmsg(r2, &(0x7f000000c300)=[{{&(0x7f00000005c0)=@hci={0x1f, r4, 0x2}, 0x80, &(0x7f0000001800)=[{&(0x7f0000000640)="52b7a3f9efc70b89df248da4fee643f963ec9f6ca16ab6af93c10973816f7c8be877acd183a2d02e54185a26e583d0a0215060fb01addf9bf7b3522fae5e985dfe96d878a75bed5c163b8ed7fe5d1a402c89b4cfced9c32218c0d40cd6be1aa7c669ab7b2bb2e56a0277fca53e3f94ca12be7f6da63d6e7ad00fbdfad3d2b9e3231f50f9c50de5346355441028bd2dcb708dcd3a1e66b8d619a86dc61d4482c359d121973dfaef360fb1c69f5ab6f0179d323d9c69856525fe9e31bb912bd6aa7656cb8442a3e15bbe2e8059c632323e2ea11022e709f191f9d948312ce82c1af91f27dfe4cf665d7e1a6fca8c8369f19388d829d0eb677f38f099cbd7943665e63bb31d77255592d2d80f6971125abb05529ad21ab0280600a69233bf1fb04c3dc5da6d480244be66ecbfde15826418bf1d3641fcc6504b38f0b0236ca43bbf2416a063e38385ffb4165382cfb53376be1f6499e076f632ea3836448a7d978deac5caf4674b03bd72786b6878320e5d99db8c0e75cbeaebdae04cd918b68c293cd1777fd904ff287fce8a6d286a197a568ad51ec2a409e98c0501003f7ba33b2e6376e092649c03d5b64099b0c98b5186aea5e3d8e23fcbf286322cf609d6d631cce2873814d34fc3571a4ac7785ba19f8c099398c87ad073312407cac548be5be73bcc7c68cb9634c10465b1cb1d663a884608e9994f70750a3d28b3befd353a5f1e3001f0b0ef098f1c6f8ed4de0d0e922cfe5daae0affdbfbfaf5b51ddab491259fb63c071bfcd17e0cd6e8ec4344302a5310bbe3ace05b80664919de03a0d049b04bfe0d8a96658d49efb556b3d7dd37a514f8dbd49be0a7a969f9efc852e62195360ecffd55677dd352ace77fa7989326b5e1efa967e7cececd8f4bef7d446ad0fb046fa3e043507325de956ae799ccd792cb89ff7dcd1fe38ccc0c817102f037d7ab00120251adcff5e5abcd0c4e23345b95687b5c3aac21757cb7151ba3229d196bd4c4242ef2b716b8ad4e995b13989c5a68fa35e8052ee1c805b7fc0ef85cfa07dfcdd26b7424cc5f891b94c28215932343fe43ea28721aa338f76385c1f8402d9cf5f213ba997dfa4d69b6778fb88b66616ae8d3a4aae9b647e5463d9166ea13e059fdd7e1986e28e8f0c4d5934410554516a9815490cb59ba9bd536be28a01721bb8e9748392e7fa8f74c2e62d6bef265f109a0023ac3232bb527830f0f176a5208f21cd73eba9f95a01d8c835340389f3007ce9ab9c54da1ab4bf54f77a6da3dd61833e5a016f3d0d7e140b88a9d60191332fb45874d798a97bc41a00b0fcb2b8540d3054cdeeff37863774c9e4f371e2ec595b5e677df5e7a6958ed69a90bd13f92d2f123b4966280b2d46409f9d80a927238fc94427f8b411ba0c30128dc5cf0e72e9ee7a5935fbb20a960e4874aa6688e227b882c86833bf1dc208b3becf38149b7e3b38eb35841525dd3ff76642a5c2e55468a0a0b57b07674a00349d89b5da06a7841226f7051ee06d6cae361b0f79d10186e34c2b4cebf38825b0a9d1ea862c9d7bfad7d302e3459a73cb2351e290c3269d3751e530c9d3e1162e5ca016689fb670b2811040c9e4a52e4d9c57541e4fe17dcf3d86a5a31432c499f47548c0185cb6192b180e5eb765860338a871e21a89a3ec9e4f771b82b0104789aeaaf78c045254c943d5264e3f6c4f3eb9fb765f88c6f46bea8565e950c829d0f247396336918935f4ef6130c7fa35b98b5392751a1ceb30085dfd51da55f1e597bfad5c2ac2262e7ea62eae88855dcb2dbcace07022ba3a214c0be20e1389f876ca8ba3bf2716dc8438f8a25108c2094584fcbe5d9693035d863e474eafd6b5b384e8b111c5d42b759e10b8a0d3c6da2c2d135a5896a1928277c60e663c0d2b33f93531144e4bdcdde4981314e158e5e9b52928b4bf262d674a3a3f651e76a5f3b004cc6cbd7cdc27809742cf69cd95724ea3a2e9640c170064a3a3fb13d08ca2f7319c68675f5ecd92f2fd4873caed45dfe1d661686cb5d4d662ca9af0887554605a579d1c8ae72ec43901b01bff6ee9be44f8afb0858784954e563e30e2f55e491d44d3736feec6ec5d2e1f84ccb2c3f3c3220fd3e66450a9afb6284268d896ecd7d0d01c8b283d867209d9832bf276cbee62b59e99bfd8f96b48ae38820f8381cadc353d10ba72a88480abf207fadb6223e70226a40bc42bce8778ec997f1c3fb22bd199e0fa2c68b48488ee4c575edaa7777b56edccdf86591ce9b3608caa3b9ffd49d3efd78d35825d1caeb0b892bcdc5de99616b3109c025b1cc7a0271dfd51a864ecab5bb27c6f187f5d84b84ab59659350c5e31572ee8e1430306574a4c554b27fb8b041d1e451110aa4aec9b1bc833224cb38babb8857b22f91c9bd8cb0c7f515c403fb7b81cfc3d6513d958e42380f4d56d7017f8971a18de779f84525dfb68623295c74e7af3858ccd3a497c98fec1a2b1f6936a008ff2b87841fb830b20d929fefe73af60143c2c7a104a79076074bdbbdaa058082219210dd99d6e57f3b50a68dc95fe48aab5fe773b0bfae152a329a9fa3fd791d449d5c3f94114c65a798c5c98fb255c9681aea524d3afb4cc47bdc9e8582ab98eda79d4e4160c37d139a1856b730d34e1a2477f8e49561b101f030e102399189170a6a626821e609b8400739aec083e5363ded1e5ac1abcae3ef8f008e2f0c4bec75612383c3267a81e0937d3d067e788b409de32845ea7aee1c88e0e7be32cab4d1dd57ee5d04cdc816e29906f43cc995d7bdf065101f4c03e788aa789f2f7811ab30b078a5db1903e70b194f1ae3a6684e574eaee28f54760747932fa6bf1750755186f317b19016521017e8886674902bda5be21dc5a6d8945ded3d5d579fa04c5a1cf70a4d0a47cffa4e99ed95ab83e1990f797e26607a33a91ed71e35586db98f3d585283eb4c6131770e69c05b059158887ed0537d52d5ff0ad41aadc84d8e9873b11aa7f85e8d3e6066fcb349312066c4aaf056eec70d2615d64df56e21a255703101333504e2fbe80b8a819c48378a18189a60663c2280c37c6ba8fb73ffc5eee245e458e471ef31c7196754dac14ad7112e3a9e2fe0cd6175a2a84d13c1595886e245bf081d19f1c43fe40495afed6683ac12e36739821392d729fe961fda2fd03a2aa59adead33c24f80a77df9f6c55bd20b6e69d9da209c3d9907d6a8a3cbe3744731d43ec7896513f7c02205141b38bf9af3c4e19acac370d018a431f587d8a2d5cacc9c984968bf1d2b760189ffab49425c57aea6fbce136f47297b6b81549f5dece69d6d0593becd6da13a9d23d521e2700567709abdae72cf869d256830bf82510ff2c5e645da2bf18b053f9d1b4180af342a4ae865f78ee4db520e009b907f823f7d8aff65cad890be1926062fdf166d679f729fd574a7c62994771e3964f017fef1fc1075d22501165e521319dd92b8d4b11074b472b2550c780f8c37d4ab5e384847749248e0c2718bba3dedf89347af48fe1c3b55c8fb1ef012558879a5db237e6330e416cc602c832e24f17c051e8529df3b62de9b6d2cdf1d7a88724c9d5f0d4717370ab62448748bdc11ddff255e5d1faf47a7debca20f6d02784d8d631aa77aa1cef04a75e052225aa7f7fed9a2454710d888372ec6a6b202957652464352b7f606b1b9d78580ba1a73d3f3c3e43e208cac42d62dd302b1804b96b208d2158f6923142302eb50f9077606565ae55dd003339d69dc4de52226a7585bd87f3e78d4d60ba302c66451777eb200e9c5e89c621d9b23465a3d568e68b3ba52cea9168109a5dfbd67722ce5fe8cd252edfe0cd03b239a629faec2032dc1c5f1360311776177bbe385633cba8c9eb3626b6e5e1dc297a71274c6fbfb4f212da83a9b20f9a6bcf2013299183aeff8dfd20db431ef9c8d12306ff262007ad5d4e990745ba644da23762e67a63ea8c3107c7e1c6ebcb9df47c9e5a1cd02be578cf742685ed3ef3bbc745c9f65e0ae9b20e49c9cbb0d78f8fee085ba820294c29d89b85f890960592fb528cd7c1dd4a0d4cc101d834423afb99070395cad8ebb05c7f2bbc795909412f822f71dfa3fd69a86ea6ce042e9f33cc734e0e8c1ba4bc112f78d9738b240c8dfedd7d4cd6ff9b4a377162a36e83542cc8e31f5a606dc9ee77722ee2010db08c470e7612ba04b23bfca4f33c42f7c75564a8cea6d9570edd245b3d442aa67152577cf4bed54ae610a2b70eb777ee05c97458363c85afc20f2eff65db3e89b38652b9add2bca558e9547ad3b067e4e832ba5a9b7419fe000ded409c4b7b1b19e289eb2058bde1d8eb99aa0e91018f73f3fee3de3ee03442158b4b5910105aa91c955afefbb0b51af3c4040849a29a826db746ee4fe6a546654630fdd9f2435592b63a3ef737e99e122a3878aebe80bc65c944647f480213e23d96734ba5ed9c40204fc156e7b7de06415125b0f3d7f50c5078ff98647cd49a52e551ebf4334791d19673b80c9a92573583eae7fc0f97f8f86afda7a33c23ff7f62f0c30e8a20cd85d484c798a0aa08325a7bf9a72f708ebd73277acc26243f5d549b856e8527f50a733945073ebdbd32025c707e01443530aa9e5f335a076e0389455b18311f312fb96fae28a5bd5f6eb7c586b4f0bd182a2721935df74a85d3e5e3e44bc4e0beaadd28fa5de7232feccd0da0fdb5c242dd760b5334da40ec4ccbc284a87d4eab4931af8708cc6b68cb712d35398bcbd0680419b2eec2909d9d7613a2b572bb959648ca9d4e73a36740894ff6a2c4675b91dd5a46a49537371970f3ddfb60b71f4b44a74e0c7a0adbc403823fe89a6a3b9a3d20ec3c6087522cc73e64a3af9e3bd546d70a81178b1e641d96287a83214fed7ab69c0436722ddd2d1481ec8f0ae985cf2bdbf2b189e501579733fd0a2327d01a9f5cb249fc2a33eed3d502e95ef2be2e52cb7835ce92e62b58ca25a1519b43190054eac44fec360c75e8958a8e4212aef6755ecfa43ee0662db3df6c5ee8144f14d01bf29334d29d9ac694657d0527a03adb971032462ac72226db121a4467788302526cc4488b291237466f081abed134e19e1bebe2a45b833a73ad46c3037f6e3436cadc9967314c6bbfec111e8915d6d65747ace41871277b879da476f032bde39c4f8190a7ddd4cb12bba6f046b23518277d81d1e12801f56d6e53b5022a8288834e8f96271d13929992b6ff969839d0a257544b563410e1fe261c5582c495bdb0c87cd14f61f7896cd015d88a2c71ee86a2489d6655dcd201a9f4d32de94f74de0694c67c75a33c219a4a447792718714904f3e7b599fc7acf8f5ae6bbec7b7474ccf207837174cfd6c332331b7d10dee7d1c857021f371f72c8387ad10569ab282cf24a1d12a3c3d003ae4bc9916ac70c6fac68f4d9641f504f33a784e1a0602bc508f9ac54d90ab030825b8a0bd8b400f29f74ae79a90388ba439c45d31683ba589ef6ce9b79b6c92df767c732e97d9f32a4a512cb8015c7d053b46aba834cda2cd80cafb557340685c4e53182d1acbc07f6e5eb47ed280d5fd8367520569f26769cd9ca4acaa72bc1a9de7b1b18b54eeb65a0755534d1d65631e04b04b279332f4f2c26ad7c554babcb29d4c62e431532fbd5a9e58994dd32ca6b5e5721684bdda620e5a33d733b9c83f17d5385beee8e258c9feb48bd68bd6e581977faee89ce27b05babd43764a33cbf542c849ced26b333e0f6092cf1fbc219de854d54361abf9b384a2e00102160857d8eb484c3b67d17c3804284761270b", 0x1000}, {&(0x7f0000001640)="c9f56cf02db56222992b54f7b168cb19923cd14f37bbf3907331fd9f4c3eb9f4a84f90fc6004c0cf2f1bc7cdb7e7bbd38f38e0e469559a9d9608ca7af4c591434a896c28fce7ebf34d66d9822cdc80874045ffe8f747ec2131855aacc3c6d61b7f8690080a9870ecc54188f0bb559c33a384dd4a0e2920de2057b87f1d1d56e5e85630881d8c53c112392f83ed33db86a26f3f170d63e9e55f63f830ace55a30ff34b2e4d79b2f696a55f4c47259ebfd9993058fbc8a0f4fa046876eca6a9a5dbba97d7e0976dd904d1e8d8b6d7eba6721053ce739b0169cbb6a92a0b5908aff79114ba3ba953699cd62e5f8464d0ed6da788cff114f", 0xf6}, {&(0x7f0000001740)="89f5d644f2a74cca4fe001e3461f7526c292a59e9d70e30a5a45aa6c875429cf912103626f308261df0bf2c86fd23f8ddf6420d1040fc6e3256b166d81f732c75b9e4f7bc73e5685110705863a7fd6da9742af378ddc3eb3108333b74a7d2ce9515913fa7af68789fc958f83bd957ccd348e7f656384625c8fb08752f232012550e6c1b51987046f490ecdb6f7e0bb4ab2372efb914bedbedc807bd94a44541d903e6b", 0xa3}], 0x3, &(0x7f0000001840)=[{0x10, 0x117, 0x401}, {0x70, 0x18f, 0xff, "54f001fdd32c6037b9c15c6024567c1c26b1a960d8855eca2aaeb281ab8f1dc9e2fa54fa2ea9a388dcf07526453e01f36f30cc4109fe58edd0e6a18e8cad2bc0255b9852ee0d6b8266895d5135ee192a023bb23139cbe2faab4cb199772735"}, {0xd8, 0x13f, 0x8, "ecf8a4387951334a3f31d7cf650fad9c86beb958e50944d064c9f123d733c972a7a653b387a2c079d882be3fa81d3cbe4eae9383a6342001b1e81a6d16573e480b7cc69489c35b4bcc4a764d08aecad4dabd1e582cb1ec8c108c13c1621cec1e9da970ec163c4f2e7722519477c3152d2bf48dd495762b057d63c43e91bbf6126a474a1f1c54532d3307ce2beae28074830d5ae093fc8bc8bdb9b378df4372300ecec8f803d9ce4c0bfc4c3f57117adb7e41ac62047ce2317e64d920dc63de366fdf6aa4"}, {0xf8, 0x88, 0x7, "3fe8a6d22a9832f2a3e3b119a52ec25725da6501e598295ab860280e791dbb22ad11cb1ca08876e5acb8313bb0a87348cad93c06f6e19d3e23088e7671c6c2ff0232ba7a7d83a3b18b9cd705d467709cc7f4a5e2d3cd90335d9643e2b35848c761289fb6994da07dd683c15d1ea234656aafe15deb1e778e0079cb6d383d443ca87841aa7aad49f568cf4d143b1db6dae812eaa5dfcde53b521c02f992834588bdbb3c9965e7c771274455b4b2a2276f0e06c465b9d1cc88a6fa5fbdc7e1f027e3150a0de53dd2a919eae2b0f09c4af81f7100dae691bc3c22ac131bb0ebb59d2f2934e52755cc"}, {0xa0, 0x10d, 0x6, "0a48a8d70f8d9a21e1fd5e0bc8a92e3d6da2490008bb79f8b08ef94e114af0afafff2f29973d0e2db25704f4a5bf30ac98785292c644ed195bb533546fb1d77c7e0e352299bcaf288f0d90b79a7ad221fb4c85cb24c0c497921d373819f9a3b2752877f87c70f3d47ecda6d55ec137573e5680530e93f2ebccb084514d36bfd224b25e8dcfc350db3007"}, {0xa8, 0x129, 0x2, "083c43353d3a7b937cd5e4566d653a4fb3269a29b30e7eeb0b82c6888498a85e37b2ee7f2281ccebb55b78513062e2ed186e6a31a11cd773f14a45abcd5472f83c7700a9a7ab47d734f748652c2086d47ac7960565b62d273da5f8c3f34cbef83fbe6d29afbd9f2e714dd18a4ec7dd56146b09b77a5ebe549754cb9f37749d64e423104de67ac1cf063ae9347f0d904b27d8ce"}], 0x398, 0x8800}, 0x3f}, {{&(0x7f0000001d40)=@hci={0x1f, r5, 0x3}, 0x80, &(0x7f0000002f80)=[{&(0x7f0000001dc0)="31bb6436c82c16d1ff25c9cca3e0e29b1cfaa291ae6397b830e64b0320195c32a45866ec38eeaa4cf4bffe6e08586ce3f0cffe1646a9fd9461436d35b262185a540a1dea3146604bc3b3ab42567cd81611e7e3bef365b23700b8e3e65ca84abb2e676c75ef6a1084c3043524337dbca1f1e6fb308d9644eef3fe3b79a757b5f58d2b409170ca77797414e4841b70a0c1a6d69b331d6f30655279f24ade188d0bad982b8bdd7a108a2ca94f2273fa0b8cc6e72cc51e85934d0c2f11607b0763d2649c2d6e306dc90aaca341a2c02e1efe3e8df3ce1ed1f1b82e8eb29e6736544530fd69ce40b4f3b7cb95c5a95dbbce9d54aeae75272695ae83abc40da83913319f319d04691ca22869cc549dbef7c4d94932c320afc1dda5cb4d3713bd5290e1ca4592e09fdc15eebd258b0a33cdb1d585361eabd9514a6080482eaf4585d77b191368bac56e390a2418dde708d45d64df202fdeafc8d97e82fccda4e608f2008e096453b1c7e37fddd616a41db4e6a03b81750067db37c00915526be306a26fff7eb5bf8169c64cab803e55c7286eba1c95bf48ceb3ffb5b4f0a7615affc70d27e1254e5ab799e374d165fdcda4a111a456f7623dccfa330cf894057eec4c3beea9d4453388b7346ae3a203abc1b23127d79569e5311670b6f37b769a08934a1ec5616d95b4d6566f5cb6f0435ff94791eef6a88caedda3756ac436f72f461c643105c2e130dd100d41ff5b6274d94ba53c968128796a89a32b9b5bd8a82b44e6d97eebf87e0dbb67cd6974489082b36407c909b1aa9490037bcea9a9a7ec7a5ba690ddf3a039f221b0e9ddb82d7c320890e2647bf17afa9519a9973e3ed48f204456f80ac69ad8a44bc87085c8a40efb309b12b74880146628d937be7ae68af8a26dadee12272b7f07835bc450ea933ffd95fb697ffd288f18b5f1b7e082c2c43a80f08f2fffc3695f33fddd3216d9f40a9f18b40dee999c57b7c1a51760cf7810cce7cd4e51be37421cc8833b8d3d21eada62db7877aa33a55d495a61b63f5c686906345dab8a859a7896e73bca3a20baf97eddc51929cf61a79508d06ba6dfbc7ad4239d39094cc48d373103bc0d0390f72448747ee93f1ea27b62c6463ee8d2abc7eef184162ce4ce5c89f6a66ad1d9a79cbdea363c4a196bd0aa9cd6b3b1ced50abea5616026c8252b64774441290a1cb803884ebc9de5be9117cb5f1b63a6954b801e1ae4c6eab6688f03181dc1e46405b9e86b6625db5f85c315aa6f548d113aeecd363e39f1320d04704f6bc0174d47ff3872a773aeb7c8e19ccc03a6a7b75a6aa28921416d00bdc6144562e3f4182fb969ad82bf37031906d033a4e2595e50e0978ccc6fb2fcd4768cb89b50ee1134c2040e5bd38aad00ce25ab8cbcd7aa5ccba2c5222a71fb2472c91bd2d51bb137ba34135f7b2dfbd296ae48f11b4608533676a88efa345e743aaae20ffdd71fb8a01dd04501e1ca0c237d3eaab6d8d52badffa9e9cde1214e3c15f76e157e3b91f805623a0aa75a69641d40c52f33463c509341a5980109ae30a3e467a1a87662b89b48d6cbeaff1c5bab94a8722fcdfde8e0985bfe9d412106f0170458fa27bec5eaa7bd1062458f10bb47fef73fd05d84c7a3d2338f50a81646c90e761e97c2e5835d3ab9079bdbb4f1ebab1251f440e8392b94585d8c6ff65dced494880b334ce59c1f3aea043ffc9aa465a739ec23f6534152cd88a788e1abdf2ed47e6b159961acf3f449eaba4f5d16b13ebe9c0047e9308e6357e67251b9b8ea8951d314dbc8ca553be063b204f58ce00d560c4066b9f87cbeae2ad905ac873dfcbb5fbc60250f45e5b1f6048b9a795a20cabeed06f2dc08871ea94e47b1bb6095913ab0a424aadd8e2a2a7caff35554d67f8470eea38fe7d5823e41a42f57617f28b223016abc10073f96127f9b4ac4241b7c9afff1a4959b5921301f17b898396a53157267c9d77aa019a4e74c2effd603c116af4a01d4a2dfbece85b72519d89edc8d48ba03eeec9f5ffb45ecf97add4c28556747e48302de330053f93215b52e09f7c937f6c97916efa33b5579317a2ad48c5266c96309f153934214b8654a0c3fa60b61ba672d2d0e6b9d8c1a33bbe5b85ae2cf9fe5e52757ee2b9ec9d7c88b069b38b990a43d1a1fc70e1dbc5f9241ac3db665ea0cc23c9d29c749576fd42586c5a9143bb8b3c1c831a938506a965a0b4054edf17ff8e1866d904336ca4932fe80f2144daf93351e7873f33d773740ed05536946d54e8a4f9d46cbc52a7087b73ea402030b14d155d4f0ed2173a8887ce89aaaf9b74565b4d0bc61ab489b43d31db7d037a676666545ae5ec26f700e9500151c5097b89cee56b9dfbb447d1294ba1c12850b7cfd4823ebc67d554c1edb2d2089609ceff64e8f9f29549a2354aee0f0b01daf6d02fb8eabe7a1a544822bf2d76292f466bb38f594525ad12ba2e89a77f924d9c64e80634f8913b0a51a6ac36daf34eef67ed524b1669b905253a89ede400959ed80020ce01649db29bdcceed5644de801ca891624dcf250e89e74f822538525f7c77b9ac46baffea8c1497c19eb6609405b4aaadc886625e80270a4a200e0e5c9e29cd6caa7f47489e532466922a3b00679a870312cddc6c90b54c9ce1ebf82b5b13c5492d2abd3817cc81ef79c7ec1b93faa5a81782a1d2e0845dd0da9f0de683c6a3f6a36bccc125a31da1094d9bfc41fb4adf669bf5800aabf3925c0f9dfc2e3189d490e3491c30182835eabf95a8eba3fed534328fd7efe42dd98dd9a67dc8508cd2beaed78b69feeaed29545b9088f321ba66380da0f98979e5aa1390d947f5f1f42c25130d4edb998e479cec7b8851d061a74a2eb4e82a8b27e709d208d55791b11abe178dc7aa810e5c2c30c3820805605132bff0932b49626cb2dc7fff06ec46c9d0e6d7bbd2bc75fecb78e174a5bbdaf7dd1fa0be86755ded35294364ec7e836f6bc220ba15d527441e6c60c20d1c774937ebd008f806bfffac6e0cb2640b68ded8c700775480b2eb92a82be53db049ee94280f9074272323355328381715492d2e3c0773a489acafe29e8c0efa9fb83a00005fe11da23ee5d436cf5e39828a034e0f798eeb012a36b95486911805f690f39a4197a40278561b70e2ce38f30da74b6d085fae6dc889194e0cd9056c52fd63289bc8abda67f093cbb1f6ed5e07968d2f0e9a599adbaaa39f2a982d619fffd07ce4269a7d5aa69844ac401a808cd97caef0a2aafc93bdf0d8d16dbe51945654504cc8b5b99c00372310e33af2b3da7b8708135258cf8b8bf938237e50216c76f3a0f6357a3c184c67ddd98adaa47c22d771575abd40412c149130c73784fd1870e76b43f3b937e9ad3460f2cb1debe6ea77acc7e56cf4de3c7ab543d65937f3e740e7c6e6b5fb3df214939ed9f704ee8eb4242835b5d993c958dce2b4eddf9f7cbc2e7dfea9babe4f2ca5dc574a2781589ea30574445920e4ae59d53c9557efbaa02edb87e3063ee4bfaa665133115e2ba21e19838c40423704ed73e10a80491e5d8cbd7f486786ffd1c38cfc1fbeba245e3ed64cd3a58c901dbd41bcc4a38c0d39ba9dfbe6db38afbd6c1201f28338ecad0c5ed0581a3c4120504eefb4bf59448ed4d0747a6d547e9131fa8100332ddfca4ba3a2d2f05bc7bc0414e568fbd82c80919d37f2e32c55313e25727c568f74327c9fb3c1c8f4b7e02fa9fc81feaad7cf9bd272945a2334f9f8d278423314a64891ec425fe568ad3f4c76532c409be77da2f63a421fc15e3b81919aa02a1ecba313943ce571642f76ca5f79c1c4148f3d3a997622fb02e72e454b662459a1c036d203a532c8272f1129b243a07213515196b9c573f0c72d9702654e1b7e1ee031f4af8e7385be5ac9ed5ab04fc7495dbc26354cb6b1936a6f2bf2bd1e28cc5091f2166a2f3b06030edc6335362fcf0a157be10532b7dc4bee573fcbc002b3059c24bbb822a03fcf40c5720892e61d8a84510ed736738b2f0f69434c97002c51a42d42a8fd93bb5147969e5d7e736bc9a876161b9376cc1dce99522c8be61ae6b6da3c68e2a67246ed5e9fb5725cc373aadcf9fa5a6a0da0f80ab036c60e9d9b8a6a9876209532f4a2a84a66cea693517f0e4b8842870879906a4f2a3d97d7a3fadffbb5b5de090981a9e1c307171dcfc1d89dc04521d94208f1a4f3f5f49b95e687e7e9c74f1f9417f57cd0634cca892b7ad5bcdd2c755b8013f4d03f975c8b0e298c16ba522d31e2eae8be760f655fd7f8eb6589b177d2fe68c741b52e55fd81d45bfb164a7afc4751e0d09cada5888f1fe0c024ed7a22b8db23bd5cb7786dad2ae0256e539c8aa5b383c513afbd532467acaece5184ef69b726a529e111cfa89dd48b1778aa900c834a5ddcd01e79ee61ac8b1074838d24d492ae1c3897b9f87ec2e9b11006d9cb005616c017f3549144c613442b462fb30f608238bb49607009bd420496ab3df136fa74f61f531c705adf12e38503c426ad395a99fc866d9d12a12e88ae5ec48da55fa82615c458358807ee98d2333a37a72c6e19869b504c619c5f9949d9c971b2ee26f290dc5b21c90a8c43ea84099cea7dcf1377e3132b17bd25a245d9a4a7f6771120cb7eda3df453de268bb068c3748588e894db08737c35c0e6edd0ee9d4de29905d9bd93282b5a7ef62921a93182c8052a3e6dec5a82b523884c0c9b5c6b2ed42f6018d9f466e064162581338d0af19f43229fef57d3f610248cbc5eccb467667c634ecde5ddea9b4caae319cc0f3068869930b06c04dbdbb6168792699809c8dddb32ad25d983f5919d6be5210adc2629731d9f794d0cf8c373ea86f53517f3785635cdc18ed0e3b59fc5baa73483817512710749c2f3dca69ee65b6ac4fab7ce05b62ee3b33e44a544cc1d6ddfd1db9e410c8b3261f0fa851b292098d75c9ebadcfa363d365be6b9a6eac1d421f9b435803c56b5ca3f3b1176ef36b1d7413c65b6c9521166900facbacf6a1ee720b4b8f87f79aa29ba09ac2f853212a5378ca006549cd1014c8ae2b03fe9e03231d88da16f942b101511ce05cd49aebe632b41f4c78967204f92500da79caf514b5e7b8bfb16f3707d9ab64367642e75b977aea88267e833397fc1ac5faac794062c94d260c0a241d900d5c7a72a6bacdfcd063c11bfc05cc4f0c93049306d9d4566804638efc8160ee2593e1801a8b4dfefc5d6d6320715fbdb5a5863444e1bda41e48a15de6b9619e86c602fc23df1925061938c6f78f65e04513a2c1b2ffd7306e065bfbe9da6acef64ac1e972dc3f691f381959dd008854515db3aec3ff9698559f44d7a3fea88508d64d4dc08cea6efd398acbca194dd12b0254b15d3eb31eb38ec146674c29528ae0b7f4d1f6e8f56ca7d50a501b21852ebef69bcd93f0341133b66910e6d60d5c4cc89a19cde69247959fc915d25ac58fc521f5a241c7d76933507e2a11455e1e829a24f9326726c29ea66291b475ea41666bc2ad8a3fea20c79a0f5d41e04106da29afce8aa2d0bf6426588ebfcc0cf2a0760d8bd23a20a0b74187c3275805d3cd5cb95ab8c6174d699103d46b87a2517da71a50caa54131255b62e160d26105806b72008a58256b523580bbc462156934f79fbd17e5a18e99243f86444d2041ad8cc85b339b640e21312e598119c4e7cc0914f91f9ea101501210eeadd0158c90062301157fcd1db9fb20ef910de4df0432f8c108c401bf2549ff67f956173a1a670a5dade92ffe0ff0b0829a3173a6d6a18dd2ce14a1d97d6f8931", 0x1000}, {&(0x7f0000002dc0)="d6e0500029435ddbe2e0d6193d75a541a7cbf9e5dd38682aeb4b5b0b25b8c50cddfeb88d1317558e32d6c8729593114029ca783c136c3db2b6499540052d5510ac3aba8cec01020aea86116720710a8f6d09d8c7b3f2a82babd65d68098f11e9ed4f7410f87104ef40ec30d7f9c8217d05ad4627af6f6eadcf0d1b013bdb44330787f4e901ac611f2bba4bd9e614f8cf7ccb7b17ec40ed2272915f3fa5d9547071e3a79d598b14b60450b5204553935ab4454192a13089036971af2dafb9703f57c84d249f461e9aff6f", 0xca}, {&(0x7f0000002ec0)="4d6b85ba12c54a05bfb99e16bf16e2da512f93aae20156d7da2ecb1bf8ec408eccda9c2adddc190935de58355a0bda8aec6927be68bf1369123833daf2d74c89b9c47c278a8e13ffbfdbb27b27b87a18e5fbae18f518b971c7a76663751725257289f10e31af16cbc636081df41d30bfbee69c20e0be4a32fc61aa5a8c54e65c26", 0x81}], 0x3, &(0x7f0000002fc0)=[{0xb0, 0x109, 0x9, "f0214ef67e67db35a4f2959985f0c14b9f733b6455a1af0f451751c0486d22916b5ae93f263fffa0d240591696304c766fadb5b0c5869a724aa273419682e7c5c9a91bc656fea9a57b49a28e11ac8699eaedff72e64711e8f1326f94abb56d46d779489e58662711ff9c4b6847d76dfb758499375bc1bcffe39eee44874fc05bd1959254af71062685c5d55de425f04b40d2a63d6699c8a181be6ebc7cbd643f"}, {0x60, 0x0, 0xffffffff, "a59aec796688645ca4b050f4c87cb93307b43a84ec02c5fa5acf500c2ead90287f8df96b7747a80c25c9dab34aeddac236c9668bad757f1f7c8ac40c753c0dc3b5f635180ea49fcaf0318c73c2"}], 0x110, 0x80}}, {{&(0x7f0000003100)=@alg={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_hmac_sha384\x00'}, 0x80, &(0x7f00000042c0)=[{&(0x7f0000003180)="cb7db919f414ba2d97f4382632d41b812bfec3713b1c56c52b0170329f689c582ea74f7b44eb0300eefb7f500978dce5ac97c84c7ae2b775da0bc072c154fe37a3754b8108f92dea1a2655c308816d2e3c4ab9bc82e401f47d105cd39686f9eaa37483eba19e1ed141691c5d146e39ae0bba1517e488fcb05fde6a6249b0e8e44b4f64b3090b35b8aa8a232b3d813d7106c28057b64f8be6abfbaed87d703eda498272800d195f7dc61836a2628b494767d7a9045e2994371dcce3081942ec1cff51a2b3a9381f841366e08a63d178b24fe21da3b9825922f93bb973bcb4a1c4b5f001e45e77ed034cfa18b5a1e88f4543a20d2c8f23e82e8b3318f0f533d5", 0xff}, {&(0x7f0000003280)="7b782cfe169f3f1a031813f232a3bea7303440ac8fd31292a3501b4b8d8d49d26427e653427c38b5f27e644f7e681f64b06d6f611bc3bed497a030c8c20fe20e4122d8cec8139c8c8e8e1597dc1e14d9898822f81b7ce0998d31f9ad7402c8c13a7a0722573d58d2b10be3dc9d4babece1a57c0cf9071067a91cfee7ae92c4a1ea628d5435b260256405d593525b26e2d14b78d3b5517f0089ccd1b8cbdf00186f06f0a03d8a589142bfc06ea2ae6ef537e0c7e492a71b1e7f5eb3612795afafae17ffd3ad2e6f798ea007fce0da6087a1620e7bceb1d9c3d7e7b0e9974e1034070eeef955005f5fd582153e730f8031ad662396ea73e03916626c471fdcebdd8e8793188845d33c840cb872ec09df568bff652fc411f90e6b1047c0835b224ba09cac88549bf9dc6c569b082550c41339f0d45bd261f8c27afff3a15c411d169ac87b1400e6b3f0610b629f59db56804868eced531e9b8d15f2adb996a89bcdf37d9ddd26b27118bfbf05152fa0008c3276975ee7833ec80551738034ccf2fa672690800de70290b7b394dacd5b2a8dee644444c910bd2098265ad3caf6d17163da44a6bdcf77d5c3924e3ee6082abad4f2eaf294ba9bb565d945ba584622f2e1d97ee5b6d311377c94ccec10334fc5c6929ffc830d0cd9dcd850f0e02c2ac43aab6e4433783cfcef1569ed5a9e11908bbe5e79df01fb0d3852f25318bd92f3b2bb808313b18b16dc78edb68e87b395e2edb1284fa511b6449d4fa48eeb5b820a353884b4d877d998cfe2bf73d23e40ee591e05aa4dd7b250290b3dccda41c5f79868c25f1e5b10771be782e79fe42b4229ec64428c19cce0563e3877fc2dd2f97567028d93399fa628e5e05c554fcb02332a2cb039441469db0b93a2787365b319c9d9da1f3931466aa0f2e85431a268d787ac43cbbc9a31e87b57e9af696bafc6320d58669c4cafaebd36f1dfd05bfa86d25f229e690406bd3fc341afca6434dc14422fec8d4dc049b5e305033304985de677ecc73bba537a7b7b7fd5d53a2754e6d5afe43371deb16ba34c060efc10b37e2395b278c6c9c0cd34cd5ab680977c5e9c0438933ecdf9c0950287b2c9d379a0132b2fcf0b7490da154c3d3661ace1c15f56bf1fa0564c9a307fef73fce419b006368d9b4fc149b8790e8406464fdd5374050aadac3565677e4c4d0bef2c1b2e533540587272e462075fd27d72b3d54174aa16c89ed998c92a415753b9d15ea52b1486a2a4afede9683c7fa0ef68aebb7fc7aa15b16a04e331e3668bac5587759b3ad3e2b3303a0bfd34066acb6ae4eb8792f7bb1da59387d433402fb2d49cb4862bf3f4b13f5d6753de8dadc3d99763f91294b729c40bd26e63423bfddbcc3bfcc56eb5929e34c9eaaff7fe9a2a29def35fef57f36de85548d7aa62c39e6c98b0e56d05cb97388536991d7872d655593cf30c883c5818ffb43df7158a73826ef3569fedf81713b319db247a93a3525e56e73c664c9f417cea499b02fdf44cde456c6298fb78a73c7b5caab3ada7535de47e738a8b642a3712171f159204ad5732750118e6ff27b9803cde40beaaac9f4104c15734ea609af08e12685f6064fe911abbcc0c3c283d57169cd95dee0ae359048b603b7391ad5c3b7ac08f4987b466cc9f5d65da7642af0b242c8344be49d5ba96e35ace18bcf29d1831adf457492e13acc39c74e4ccffd1611328283c9f411a64929ad9243ec3a82d59aff603c4143256a82004d09e74e7d6a7ee16a4a5161cfe9ffbfd3e26b13fe09a6772b1d522bf1c8a89dbe93f3ff740151289d179f01682b9b579546f76166a7973f8a9b57cda5d118ef998dc4163075c4a6788c49de0e4ecae42cdf6b81d0f2812f18aca4b1d22f7bac71abcfcbf1ed62a51db218e29a0d377ade44b88826aa6c4602677f297f639544c325f046dce9fac0e624a5b6a083fe5dfbfbcbb08eea814374abfca70d3ccccc4c476e62ec574144122c35450395c2358d658bc468999be769f101ae69fdb21842b0bbbe142c10f6d9cfbb9707a4b92cb42f58efd1713589f72117e151208563e311f1cc51a8be48336cbf344db4a9c343d0e0e56241ae587cd68b3c8bc094288c28d7a43491dc15db2828cbe47071325e70182db7383fd768c40e0e9feb2d035083c5ab7a9ab054b5d3967197b3a301d63be738026f3eaae3e58a5e40a33f812e1a84e04c32d520a5ca2c7109286d699cb0740839e043716a3848a0b95768ae30bb7a5b01ba9523bd07d2a3b751564a21c6293a622e17596e98b07fb2f6b6bb0321be5a6fadd7c19b9636aff1f32926d4be69cfc8258122e7c56a0fb580157f892d998df82824c6696a1a606d7206b0d41afbf8230c26860206730b7e935d4cb9551b567fa374112d4838f8d702b3f4bbb3e23dbf6d5c5bdc5cf70bb89614bb984c3316d3dd5be043eb4153f6d47f3b7d922ae2e2d7aeb4881c8e6af11e886c5729525ab308109ef6a266c3f28f77dd4361fc9f503d9674811184f2b1bade28967970da707f7c7bbbf62fa77cd5980e8f2fbd973e957a05c948c4c13dd17af14e9628fd4934f1b264d7f720a76a50d1d50a4517c5d722356cf70d41db8b28ba63840ee172b8d1bdcbbb9a189ab9073c909bdf7854a821c0411f23d46c5fef14ee25c59d4bc346b4710daa28ab5e4e5bf20a8314f1f6dd626ce363ec710ad2c2b498d49a358ccc09af31a3685e7064324ef4bf6a7089474d630e1bec9fd91e785ca3e6fdd585a134382ae91d08b61e2b9161dd31f0dbe976789c71b85c7c47772abc0acf17ba3e32707203a79fa6e400b7640cb2015520d08c30825e90c390bb82dc05173a242bb0d0cd5191f0b34415c1d2fdbae44eff8a800850c0c1a4a7ba8dff1010bb613470444cb89ca77ad78257ff59424ba5f963acc3e780d802497b2070ec1f3fecedad72887d0285e7a4cec23f7b9b3ef78d6e88e01482f14b82ed0aacbe89b9a1fd0d6d95b2e1c25ccd772a7ba1c629a2803a71c9ba39f3b7bc67c056475a1314fce793d780cb880f51c550c56dc80c8a6e3a99fb6bfadbdadf6c6676fadf57c727832c89646d04ee747f8328910e8a790e3631f7d26cbfb72e94fdc94fb12515ad044545a1c34de623404e85de491bfcef1fdcf8aaac03bf61214d4fbc3cefd8ad851cbf3c63ab85932c25847bd2f4a8ed1607ea81b927a5167d2e40e204da261b8a3aa6a0ffc0977464c67ed4381350ba2dc753c8d0255dfffd6aed296d5e68601cd2c8f127d375a9637e703ccf7e07bd10cd3b486122bc267fde8b063d2fa7964d5efe17ee55473dc71d5b53dee6de9175b9f0e37e111e43fbe8248a3ea35f868410efb407126918d64f074c0ec740167e2ee298649c908563f0ab461235962e4c209171371f9bc63b978ded75ef8d2ab62068a8ce9cf2f0905b89b2a70cfe3cd302912c03653cbca476bb8eb0a67a0c848a29db3ff82d98d7f3921a13b75c26c9e1dc006d15c6f3bf30dd31a45956d5ee13791a1e233d0b016604132a1c52a1501d872145fa420b532bd064be33cd3b0a68709bbd7e7e5857b50a2ea16fb0b29c57bb42d0398be75561edab528e21738e98469330d8ef0fd108ad7cb9cdc494e258a060c1864379816f481f2a3947ded8a944715da42aecc41f793f5489ac4a3d92d0d2e81816ccddd3eb4d07825078228dd14cb8a1e5f2c0a312629df3129f72331b92e421653405ded5df6e7d92ea068c61b075bbba2396c56f17f77ffbc05acae77f3fef7422ed5359fd91c83ef9cb00182259395906e6ac739d2d62cd2a9d4ead6b2ea641b1c2cfd714f1ae9a6cc5c317141d4ee819c7512535386293876a2a3d1b9d9cc5a4c343955833b64786a893ac060414d22ec415882744c9563e79b5a434921d74f25bc6c3cc2fa47a8d4b4b79720d20c9be71da16afbc855b505783cceda0abe2fddb705608a92a6de6f4842a17f2975820d52eb19ed0683b25b8c44a19d126fc2f5e56e6f688a6acd461eaf35c7480e764c6d12b750f02d6ccfb97e5b81ce3374712588b4c240d66c252182489fa8d2e83fb1eb5e0173daddab2c92ed10d40265ac94f775a85eebd3056c5fbebc83221629ef308333dd6ddbfbccf8d9993eb552d9207023e960f3d1c8d96135891fc05e4016869872d495e8c58b927f67790772024420042840bf432d49e221b8c4cea3da9e75a05c841251e8db5772e367657be68cead340c887911b65cb2a1b82e2229957e99a79dc9d483b74a14d3159fdb0db642030e16c1e41c6ed26e62d1951e155de5897ad92de15d9fec778cd739dd7e352d68d7563691efda815f0cd5ce34cae16d8a69cff55137d8c094973db99b1761a25055f8273e293931de583d1e220d85526a1102db57fcf1e90c3946c69c4a90a735d9a8cc3dd1357c23a3369b3b8f0c1c773cabe4bff32a0d6b04c3867483f5d8ca086e48a13c73095c5fa9fc5ff76376bc31184a73af890736cd720bbbb2d1d702326c85a5b658f130db3dbec8293d1b4666b842597aaf6e68fb60b8b8e3b7ecb561197db1710a2a05d0a86d9337c346b49e4596ab7675f031064ce170f01c7fc6c8835b2b3baaff65fcd9e099fe83c7e6a4b3f858d3ec9ddbf2812c510f8cef6c2b6fdcc3af93cf6c6e0c7ea6c1ba39df2060e3fc815b0c3d8d091356d0e5250a8b19638aa710b70084dbcf5394df5a52a139f9bdfc0a079ceca99b73080e76b5ce10178bf9cb84d6a8bc0fe85f2ce9d9a51f4e55b7eedd667075b2108dd4592e89b58d68a3386b6b195a10750e14b756e25f041c95650259d44f2989070f5225106719dba47744255d9c1bb759b2b7679a70a96e69f0cd133d86a61bae4e5a7d34e7b52ee58a8c53ab4e59708283fd5c11354342a15e4eb95dbe74f5ea71c8576a641f04ab92c3f863889f3ca3f26ddcccaeb758743a390b1320ceb86c774a913a8cf2c6f23c71ebf9486e541fe314a3049f610ae7fb2888f9d82f1e3c0595f67ca3e114e669ffe66dee97005277e6668964ce591c68bbc5d40e839edb13ca8c533c6526c11f7d27c9d9f350f0c83f3ac2cc4e82085c97d5370b338dbc637c9e5f29b31b6458ccb9451acbc51876a82e5397f49b3343e067fc38871d9e913ff7e077035ab48a4d40481583d76e636dd3f7b796eaf88faff83243379eba2b7d8ead18e0e3e716b41f3f9283e46a7499bbe515b841a4651beb53172723190c130d5fb1aec2a79bdf15504bb8a3a0f0a86b80103fa210ce96b5aa61da940129c9d704dd6314881d81e1eff8fa0401f6e905035f14022ea8fdd8bbf9fd23328ccc764b154ff3cb7d8698a50f70b62be3337ba98500925009633f5df4f41125f6f5471f8a352763d93c03c6b8a0585b474bfcaebefd5bc444d2eb5726a77ac84f2d578007263f63466e9c6e4191bb6211c868c1e9d7db9cc1508364bb5af36d608ef7be1df77a2cf7b284af27a52211744a1142578296f80224bf4a616bdb41f7d2d38e206ba43ef2a05e746aef58c7d8605058c46384b5c0c7da595b7c64bc936de8ed5b323e0bbf9034c401a6cc6e048e1ec8a6d6ecfdfea3a0b8db158bf2e12a57dc0c91b21d393bb49762ff764002d5b82cae1766a185025f9b125c3687fa1f32210d88e2ea8c29a01fbae6d8a8b870ac3608f9f8798a7756210971f103541c097c2d2ac88972ce4b64c7a146d5e9e466e6e473b9e48890c41f5b1b1f04765068535ea3e62cdc6d1e8da76586a52343067c52dce675a29299c24bbe9aca23aeb650bdc3a8ee983d4663e6635b7d361bf9f6475faa799", 0x1000}, {&(0x7f0000004280)="d3cfa0e32aca2f2e5c4b0da080ead49dbc30f6ae6821393871f28d", 0x1b}], 0x3, &(0x7f0000004300)=[{0xd8, 0x117, 0x7, "8f0e7f892add171ce43386e6c484c79881ceab8845cf809ba6c9254c39ccdeb34a432e881a44cbc6d2cfbce30a53bdd4a9a9384c74ff78f533fea92ed487bb24b45bab7f8cb84902e029b0f7dffd0a7c4f5fd9137fd2e708e177ffac62f2008cbe0eec54a652ef9caa9e5ce16f9c7f871729a846bf34749910426472dc526fce10f3d99b6e8b4fdec65ad10011f346edf2d955e21529beaca42e8f7442895a72b45c3adf10fc7febc1fbce1e0889300c4a4b3920770684b76a06efa57e3ef776503f7947282b"}, {0x60, 0x118, 0x7, "ff241dc60e930510995d849ac570f463b1b180024f6812df325e166185c87e66710d37b4dfb4edfe43551ebc9232dcc369cb8a15957651d26811883a41975c28f30bdd3d34fb9555c4a0d609"}], 0x138}, 0x9}, {{0x0, 0x0, &(0x7f0000006540)=[{&(0x7f0000004440)="bdc24fb26ad649987f5f4b64d4cff4019ddabf38c5eaca60a424d2833eee52990d77a0be534cb02ba4d6a69f26a275fe225e56e9dae5b84d6c7a64c0592dc77485677d0539a82b4be8cb8b91ea5e183b65e17cebb622c05f43102cf486d9a13b7a582350fd4ac13eadfb2ee52820e40e0cd9004fc1db0e67c086949f59452123acd289123f23ffc58a0581349036c0e86b63eff02fe0175eb50de63a1b26740e42f211b2050ddd7f0ef7b4dc58c04bd5304adbca4df303d49751027c5b0e1a7df8fcca0933b82f01fa3a8c444419c4cf79c41ce6bab3bcc93fd4089cba2a4568958a4f24585fab2bc4f4b4b1b9313a7f0a4b74a04d7496b6dc8eb1a37361ca0d970195a8625c318f579200d2463cffcd6187f27d0eb6e4ea196933e92104c5a36abf14f8a9b777c1b5fd309951214c661484230d108b13403a2460d17d3dbf5932a9451a6da17e391c1802a98fdac96d3dabb3b7d1185b758e1754a6d6b524ea0a22c4863e74f769097c5da0f4fecfd43a2486f7d8b96e7599597aba9d7222c438bdd1df4ccb585ec799991371414d029bab7eec053fafbed3765928867fd26b86c7445e8cae682f875d54a66f90bf8451a665ed0474dcee73e8932367a89f122f024aedbd93e0f6aded3418a61ababfab88710c938e2ae35e35199c40c40586cb47e22470eabf071578f480a23ee2af6f852fcd6250d5fb6a3d3cdcdd7d2c439a3dd695f79973bbd4a29d45a983fb289232c7059cc60ee20f59e168e5266e5ee3c20dbafc7527f222cd49e7d620481bc1265246d46d21434ccb92a6eb24895dee4fc6bb6a397e1e1e77585b66d30260303ba82c51565f4b22d38b6f09791186308d5d1e8e1bb0dbd4da7b2875cbb7c2c5ca5a897109d49b8edbff9b8f4798dd4cdbe2da4489e4134c40f8a05d137145238fa6abc50518c4d92b59f34138b6d36919b1b795308b988a5f0744869ebb384c02b3fb804c0dab3fb452da8010cb3adc74f76237c5b38aeaa1cdbb434bb6aceb30510bc8ccfba07d428c8d5dc73d6691359bb02f9353b4e9df69aad301ac70e9ba38110588497515fbb310a6164d24a2803735db40cfe4f31f19959d28535d8d75072488fb6e0b0dd71ff854c401f4255c3cfabdccc8081c9b9e2681a9f6e82300a9c76db93e66c62a6903121b88dea6104baaa67f98e537007c4bd825a394a963ef142f00f05badd01bcbbd30e09962c5e40b8882e5b6dd22a6d1ac0947720e220a6cd57205c94408c39d2d3b6e2181d9c20441e8ca8998be7551bddbadad6270e8f36557ca1f37ac1176de1c6ca3ee68a9144d443f34dddcd5e8ce0ba6f47e1dd083cff0a619afde05defaab88c55a1189f26f77b616279c5547d950e5065e636cd01ba63b4de3645b6a2d6610ef69bd0f9ed7212bc23a1756fdcfabc9d9121021a0f0df52262a4307ef2aa56c32382e18c4bf6db7d1d369a122a0669b9ecb076e3caab72f42cc8642803d3c3a835fd862c4b769f11cf842efc5120e83ad7c9669cf89e8b0263d3638dfeb862fc12f052519b22dc053dfbaab0c41f4cbf863d6ddadfa7c7b032274dd5ac905683ed180f8e7aea3bcc4fd4a16c54fb85972cc29cb81d19765f510bf8a8cf71a672a351bdd07e1fd6427968def99bd75572f48d31f9671622b16542a65607547399cfc292c522ce476e89690087749e07c9cdf9694fb6aac8f6108684bde62e092d681dc3c5e9e80cb7af42b077aa9b26d4d8fb49bfafb431344f22738e58e722d32e1403db15900ba878ddb05b87e9eab337e1069d5a3f0e504ed930b9836857f33f2c4c7b6d17b77dc8532878e8de5deb935eb2a9911cd18f785264421326ba07713c26aa6025e4119e3994286ccf4e926b3b0e42b90b20a6f5e84d04c8c507515e217479962dc9c9905a6e00be098f7197b67172aa1fca3d64f92ca52238f196d789b0cb9eeca606e223b0a7a821c62f6b3d8a480e21caeca9c1d436a8950ac7ecf0824894d99a08290aee60c36ed038a2adee34ac020642a52009102b54653fd3f937ec5160a486317d1763d8619dbe3ffeb3d5b531c3f23b8b25cc6a82a7adf62c3a11d7e4f636d84af39f7e7a952a0f98c4811d0a4491083b8c834b617d4ef2651b8dce3c6cdab036878f5c03c1f90a2c933a309231ff1349f51e3d4ea42999b2824b619e324c3e0c37cd9a3dc79fe50c34797a7779527bb8b10823915ab38cabede9911c7e44094db6d1e711872fedb7f92864c3eab247e3e046fecdce352e3c34fbb4cbc754486b5829ff85629882504b83778b403c6dc0d960bb14dcb2f48932cd79759cd7640f1b46ab8be2de475e7d7b6701d0c2cf465bc47b7bca0c2ce169d5cead438a60c8be255780dfe291538d8ad71fdbfddb8c98dd29366af339050f89678817443e4fe0dd3f7803eb7d41d417941910e6ad8f42b3f43ee57ac64f7d3ebff10e13d6ece77ac7e029c46082d4473b4e344732d0f3c31124fd387bcd6932a0e35cce09e735286aa0d461cc345e82a3f0fdc22d668c8ee3cfad81bb9ce1c60887f0cb6823d169bc35187213030238e63a9442d2b2ca1dfb935b3fbda8c22e61773f18952c205ba34a7623aed66b9d9dd240bd767ccc0fc909f4a533f1930ec8606c6380083f6820e981062624d98f2ab32c062d8914db92577891c4cecbb89b3f09189f9639c23f08f06001b722d3da4b050529c8413e7d6593640a7e08dda14b237f0c636eb883ca0e25372b2412e0ff444962bddd86fa6ee22e1415cd23a890d97c58499d56e6a8a7f2a9ba77a9a921b57c3d5af50306210eeb752e0d63043a1ff30a6e26fad5ca5e40b850978b607aeda7d5bb13901fd2b806c4f2cb7920c5465d522131b721f15dafe66a021544a725f1ee1307507cdfe0b86b0420bfe358872f4f34ca64e0718ddd807f62a707cc8a3c568df03bfc53e30eae5d24da2dec616c8dd652389880cd6ad87229df38a618474421bf7bcd10897898ca5439ca0aad00e3fe0c28038af2fec1d73bd3a10a5f8fad75266cb6d5131ac8a8603b2d5d0f5a025546bf0959e75dae09484630048184c140ae6d5389bc8d1bff90b3e0589f0e42e0aa28500485811c03a66d918c0d7b52fcba6d86520f3c616c26d8dea8438ca4cae7cd0c6d07648e5f9944bef8cd473d21aa586bb36bac8bec77f11f3609297b58a1a08ee8ff5649e2a97474d50cef495632a276afc67b3212265628a4055e7093e07b20ffb5596a527da2890cb321e9fafe5afd8ce486a4e5e369ad5bfb6441def036c880cb5dfa4f2bb4c9043f34be91f8ce93d5fc541cfdae229805d061194e08b82c1628439172a450285233a43d7199736d95c9492841a4dac28564223e794a2a1c918255ace75d083ab7ccca67708cefe7a11cbe9bb39d345b91c5c7b38eeed2a1df57262dcad15675b1afe20ccc733252649994f66037a9bd7f2d26a0e19c41a7d9bd6b53778d3e962106057b1ee0732244a9c972af127ece0def8d738254eb57076825613afb419bfaae7105c9967a1484fedc335a182473b8015cdd76e3e9516c236d53aeb0523c244b32f1cc872f06224d09c442b04acf98540952b81ec66c84d50da6562517456ced780c4e1aeada032dc96f2776263362791b7b8741e503a58f9e312c9f9c9b52d838bf36d1f657d77c308c07b22ffee90749a2d58cde98f226a4a4a4890ead85bdb61c2cde288ae42ced466cfbc5157ebf95c57f38bb64bb35bfb32a56e981f887523535d9c6fa0d59fd69cda74060b1e71c0f31d56d61758e9d3e0e5a94f0d5ce1c55a3badb3684ddf58342a50f42e72e3db86f051bc31fcf7217204f604fd5b67148605d696231424635b7a147393321fa037736e40e25437b90ae72b3792d9d9d02a9ff1bc06a2220ddd17628ae9b44b0d65c78afd40bd29cd57b905829054cd29d7bd447631df93f6cf46290aadb229e13abe4d7239ba3691d7aa051d6cd13a6f61d2595287bb13669cd3ef3bf98f99232f41b2747e177ac28f86c252f00a9a63d25dfbd986f420b7ab91dbec2948c538160d760ef572db623257c2704fbd850afd578037e5f6d58b6db0ab1b2a2d42e49fc97ff18403d873fb40f74d1d8a0a980c3ca36485941eaa59693f4457d5cc921356ca247c56b543c858260449fe695adf80079435dc99b9adc20f2aad146d75a5e5be6f15ed86f782792cd51768b5bbf51d262b18c68f7b3cbfb11f5b3f7e4fa929a79faf486ff2d82cfdc0f060d996a80672e951ad3ef2f3dd2ce553ee5412bf18c90eb17904febbf27fbda5e7d518d599ecb046da0c90d1d255dc7562bfdb439cd7c1110794cb6ea32f8c1b0d0adacf41f172bcd5516083fe97e6fc65a87395af87c9c80a12271651ecafe6e09ff5bc96e3fac36bdbaf6312cefed306d872d210f2129bbdca5aa3b0b59d31dd77e10188fed833c60f208e3704bcf59053b08be9be488435d13bedbe2502ea01ae07c54d772023609acbeb5ea42e74ae41c20c2a8ddebc7e7830735333f572da61bf0032bb479c3f5e75beea571595be9897b3ac6996b69f26e4023eace88588753043886e6cb2e4c1ecc63fcb84c111c50caf81d472de73c1c220aa57d0a7d063d1ac459847754f1e0ccd4c3209de6121cdb4ffdc89423b801ed89c2d3a4235b3af4e6dcb325b90d138290be7ad3088c35c0926551ead3dfc7f95c8d65237dc7745e11933fad5356bf0458316c3bf3aad424e3e81d3c7f38f5c47ae3529c0d636d312866c8e6bea17ef3f78dcd66432ed05bd469324b7ed39336868955e52a030b02f178724f12fb399a1cdbb624f5abeb1a04efa38936957e7ca9355708d30ffb483e43b4604989c6e0eddfa1e918324dd4978c2f5379e222a52adb094380f12141f080413d2dc3623c24e3f5d3e371377cd7641b1ba77a291cd815ba7d31ac896ef33e44e8d8c2a9494ad5ad615c86c15f9c379f2708a58bc2dbe8ce80ecba9d14952e55906fd1d1b2b60efaea574637628776a149e2a92e764f3517b0748bc004dbb931166dbf52ee0e8c7da4eafab59950cdce11fe28853b256e0ff16e543b8792f516ee43cb9383e46e73291b62b216e89b9e3434528431c4344072499d15648c028d38105e6823a7494891814e8f5ebdc951d076fe9d2e2be3681bd3a4ac29eaaf7daffc47d0a05bd450ac1117b744d07d9992c86fa223cd05ad6705a358df391c1b70ee5cadae5617a52d536a395640aad035016c0b3c0fb8de0ff3179e1732c728560134d863c20ac839b1181e525121aa0d19d37d9d378ec713ab6191400cc4f7577ca9730c8d13e503726cb537fae7b69845fc71852baaf44d7c3d0326371e39d530a56431bd1ec0097508eb6fcd731a1d87e2e916e5e566189063363a9e3be0654fca051d2bc09e639a0e06fadb6524ab18dc0f76d8dd04c63c4e0efe103798ec5e1cf4e937ddaa210dbf2f3394da230e2a6fedae396168f02f588d76607d12e326251f6904e4c236945668555254a6a0f0224bf1f67afd6bfccc43662b60ef1aed9a812ddc96b660a819653e9f4c9a518fb4412d2dc107de638575d8e8002afcf977640a6539419101e9c84cc756589ab9d4112891b8b3a280c09b61cd09918ee6805ff2c9cd1f112ed36372807512a739a46b6efd27ffe23cbc1b1fcac370cd08537d9a78edb3ccbf868b963fb04e2decfb162c41e42cc8137db4e37bbf47f0221cdd6f64dd840c8fca119aa25661b3c7635a9f1cb66250fa964aebe00eb047e0ea2f0dfaebb95999c7d01daea94797ef68d6dd32d63dc010236cfa29205dfd7db2155", 0x1000}, {&(0x7f0000005440)="e615cfdad9b25bf6ea191d9efc0d1f66e86db9ac3c451fa7a92dffc12a3ad245bc03656bb04ed11c6f58c449b5e9e2ca546b2546b440e936b046043104a8e642fe866b2559433f972ed3362d5b68bec8814c4e3a10833b63aee1d1338359ba0ea1331159c5e6476346f4f8da9384ea5ab8b3e175e445f448e78e921f7c861da5a34f1101f592b1eea088d73ae7bd621e8f2c5db0d5e21fe250eff0a44b7335dc40109f3f0eb9d6466392caa773aa01644b9601865b4b24b212c7a8a996c43e70180224cc4059e4bf4595c2d48dd1832dd87241dd15461cabc72e89fd71ca9d4e0136918f89c0d9a1bca1b6e87569cc1ff64bb2b17ecd295f0c431627563f117e9a03cc55b67d1dfb893e9ef4740f540b3ba9e5013d4a95f949f57060b9cef91ffd38fb70a81376c080275c902f889134cec237c914940dd8716cf9161c71f3c804f44c94f46a9234e83d06fb9e927833a6c3665a075dbdce5d0fa385c0d84261d85c3f41745e266c4554e0ab161970491196bce9c0cdb87695a845ee6be2d10dc4fe1966ca098f5e57e9b2513fe436f36470134864aca1a29d7a31e918b129c92910c2b199c9abc4fb4b3303772884b2c37967fdcd8fbb8515fa090b4dc73e1b756a328552d0b0ad5eaf09ba33b24f7999240cdae810f2fdadad9bc1002aa27540c5a879051c97471e61743fed43499c72cdf8428b36f7e57141d88f90044408ebeeb36c1479d10c3edbf578eb7481deffd1de1a8c72729dfeab0c75eac1e895d4384bffab63b1b035c02a195284341f2fa69daa2fa9fe7a3f8fc94d70dd4426cd6b4038a3ff29875668fa66ea4ad4d0c9062b1b37866f720bc35f5ca066f65f48759d400c6353a7e87aada092df3e2bce92097b879305cf9944160ae6e95e2c4c77026d3892ea27cf5af2fad84dad2579e944cda7b44040a45c1bb7f92526347ad0966c8ca343cf76d4a78c51d779aa16774bd335d42c59a6cc7fb65d313726e6d5d32de415f202790dd59d903822f7ce57df16ca4718973cf0cf85415157f3c8aa25016c9aff938685e8837e634932a19d757e5b25ffe7370f06c0b3222089ad110d07fb617c5b783ce94c399169909eec750eb7392ce4d3e7858c3c2ae599e1249d1e737031b733c07f9a466deec00716156045c80f78dfbebd9ce3f0d33656c035266a094abb1cf6783fb63cfd3a71801dbe06cd5e35cb6c8f50a5fcc86fd3965ce2995582f9b1a9b8d36bf57232092e77db8ba15c9d9c58db676e8cff3c63ca03b18ffe5486f7f6d54593781d2dee83401601466a5b93c8710f6ccb16b21ac57e39383ae8287eab57b94a7259ccf7e02a9dc94972a1df195968659438520755b8bf315b4072ae867896d0cd7a48bca2bf93fb9c8b88aabefb407f6145e6f5e8beaa205aa57081ef420e697745bc63dbf38aad0e3c9c0db76e0134a72d7243644f0f4706eafa336a137de937d4e303140edb96b7e792558147361478addffad072c8df68e78a94dda2b83e8ca37ebeedfe862f666edf65cf8180c5e9e32f86b08f1b7ddc102ed953feaadf2d8d45044e03c15d62eebbfcf4860844fa44e82925ec3138d8d99c11c0e57ac527dac840b2b1e8540bf280a4be1fa294548b466a542d233f3c52915dc7722deba3ab2ee30074325b8e799415c0434623d89feb992fbce4152bcdc0c38e2e5b59419be0b946e0b5c0a8adf3ecdd07f82040d1a242942036001df15a1b8db9ec47a4bf07e510d14052372adab6c4915f7f2ef9c7bfbf0ff725e5c45be39db9d48d2d87bed03ab5655e619b4acc9ca73c3490acbf8cfa487f2ef1ddb270b544c0d8ae5244ea8e3784e3746090c7b22171ae205dbab8d642f3f189b9609f2a1ed86e366f7b36dae73c0ff800247b6362e30996806b29e4ef6b202ef9f4644e52ffe40f1b84ccfb2eea407cc3473edf14b1cc00b73a571256fe23dabd67f7e541c09aad8ae2d49f33a46b64bcac84964c22a4aac1bbecded0245985c32641245865108315935c80b472ec4eb431501b63551ebfda01ee1927df3ba549958a8d00f9832113116bb6edc2b17461992d53ded45721b16f761528790a42a25e9da5b173ee9273dad0b970abd85dbb8eb3f6f4287846e023d2e8c2613ea7bd21d18c0a24d89d5be84a00d5113e9041582354ac269fa4dfa2834e73eea0468a19f62456f1af8d5da49fb69712c9a092bdccca1daa5511005999a34d68df24e70e174049f13e29691a5c78693d8f7d12641f9b6a9e39b41c6563f4840897b5688213be72cc5b4f52e4471c6e9d795dcb06acd34f87a711825fe81b0a76f12a77f7b2515dfde9a1e3ba4e66ededb60a6c13e83f1c5538478d85b34768120c52ef508a264f8aaf48297fa9eb65008ac76528f5c2a51e4ff3b39b43ec9b314ffc7c8e854fc54382ab04de50f1db85422a61458a109544f4c8093d3658e7259a8a11725912cea4fc31eaf22127fd7c85fdc3471dbc4746c879d9dd2ffdddafe82bef19552524dfcb2475c424471a1defb73bd2e214d32efc7788f41707e5eb3c0c5104e652b005683b8499e8630333964e3976f7fe1d7732802fa039c0ed982fbafbae4a85b7644e1418e56a6be3a09f0aff9dd2a89fc82038f029d96c6f8f2253d8f502d870f8ccc172ec9f195ae3693200351fbafaa65c080edfde909c9c8f570f3cbcf1932835f9556ced1fa0eeeb51ba3eaad3c20b1e475b9c909059de77706b0c3d07178b8ba8c2c35f9a83780a0d766bb3ec0959212fb452639856862f84bcc97648c2892d6b787f9672d7dbae1343ba6e9a0192433ae55cf0a7f0fe5f0091582bcbd12ff27fabdedc69fc528a57379509a535724ebdedd6d1f24c57024823046b762258cadd0c355ee370c9fd9d5c3f34b87b429fa52663dd4c2756c3384cc55fe30e564f1088f4ab05c9965f9ea57e58c427082719aafaaf11dd0e7638acd71ba8720c09a55b0059a96cc6f6eb48aea53eae30ab2f38ebce2dcc21475c2cd02addcd77667b213b29af7dad2063abfb4aaeff0f9cac63f53b1307fb29f34cf65a75aca934baacae9676a2653d2214dc06d99be83a3653ef0f3b888013d260d27ef3c501358761b814facde85b89d48aa8a8a6513fa80d26b8e4a21b2d738f8a2926b965a87313fc6ed236d0e3fa8b699cc6cf699bafca609ba1e8c805250af60ccb98ea3327f433c2de94a709cb137a984721097780045e25457c09a579a7c1bb5930e4bb773d96c236f2d71e687019c71194714c7d785022f915bfc57a2be28efafcfeeea4847755b8d16981247ed7d6f528021e584dbe4d922b64207110ff9126692439120bcc22ac8e620b3a7fca9363ef3a86e2828afe365854f1e5049ed4ca1e795420f35d32e94bbcd8822e0fe5fd0bcaefef7038430e9bbaba7168924efbb4674b20454c593f479e49636a43f477edde2a645ae56e840fd21f38d05e62be3ee9fd531cbe5bf2db278b1370337b1ebbe53a26b03b248489f03c347fd66318a07213b295ad3f13c70c4d2ea8ae4423cc156db753f28c0a6ec527f336475a30ef0563f11cb7803c8fd31ac064b4c9cfd7b6318fc484c41cbc0c1775d85082b0d3adb23a4364f9a9bd87161be55baec5b351136fcaa12f19bc215bdb31e761899ac2dcc4fd0fc2f9d5c4d209359a7c908c3f38d300741e46b7316a137da9a2a7251a81c9362a2849e5b5bb58061aa5c699b8e227e9dcbe6e0391aa2f3feb40b5bcb9179218e16e6f0056f14e243956500dbd1e7a84d0a9593f0ef425488ef2f3545ada77e31b3e0ca5fb585fefc0577603dc80f61bf45e364dbdd7f63a86ec6684f6838564b48edb4a05bd68e7759d10eeea19363eeaeb28142284b7e49a10489622615b61daeba232aa54e830ca8562283d1e77a7d1c0470ef1009a240324f0cd01d01a65ea682f70ace73ccf3d20f519293bb7e12bf208bca3a67b92e3a78ed10d3e9347d87e92051895ebff80f828011356c060fc489bc4ebfaa5a60e81672b5bc5276b397365e99f1ce644ceae31f33571a72499b0abc2daeaddff4266147ac0662c06c353b3edc1fd7d8d15f1c4b19c9b85275c6fa5528b2f631ac273d5ab54301fbdab12b04622f91a4806fcd427083690e33ada832ec5d11d30b333534ffb61a3f2da897bc3c13373fc1e831af572b2273630ae6971c66c695e81e6c09a3dee8cc23ea1ed9959f857c0ceeadba10ad9061063ebe7303beac206bb40bc89420a0c9370d336e4eca5b2c7c9981b138511d193a5e9865cec1bbc7a7ec53ac9735d64c4011008e557556add197b11cff7652affd46e78028fe4b89b31fc5edf167c58753c1ece2f47b616ae0e0163730b33eece6c5d0882424c15c26298999b14c5eb6da00f10a81219a353ea324e7d99131919f844e22a1193532d9ffe9d3656278d5fa5d5407edc9b4e92c9113ecbac4f2ab1cbdf10bf0436d5ce10c5c57164d6deea20052c2c68a714bec8872727bec3fac1ecc4cfd2a1fe2b02aa90979603cc349fa534af4701cf06b8ac43c09287ce6217112140ac2dd4b01d9fc6a835773ce9525f7a941f2d1e738303487f787c64d76880ada57e438837420084a695b99df1e77ed2eb3d228a0ffb5d0c4d79a8bd8fdc3dc91345d911ed41b9bdec75edfdf4edd1b18e81b44c0b7dd2f4c9164a69795822385ec6bd4d90f1ca80ff07527dcade8eafb87dc0f7cb2e3942ea49f84dba43606432f0b4ff9ab1bf569885d46695c8ba0e8fb2d62a7ce047c5c0d6b98b6dbd2ee81d01a8ac3ea677dbff4f4db378038227b48e124e62914e9517c7720e08b952ad92e325582e313957e34b09409703305de52855f03556c738c7d8c72436db33bcca17270e4d23402fb283ede62f333452ad6fee8843f9b0db83cd08abf1cd5051f68a32dfce491ec1be80f9b4d5266bc40e01aaaa62c60e637844d0fd6445c104cd1f4f903835f7d9f3d4a89c22837b31f3c8775ed13e3fd5abafcb49802cc10201b10f3fbac32eb05b48db4bb06a65b88cd4794c0d0cc4d4b35f281533259c3b2354ee1daa8c63928e0605d62cb7fa0fd1b7be140e5edba52109e1588d2ec975dff46882fd876ef5cc2d5404e02b1697481f9566c6644adb691e96a6fa3ab2406b7ccd93a5fba6828f34341e4f6ecd36ce7557128a582188aaf7b577b24c71fb294472cae9948dad742e44ca8344d720ddda993b073c339dcbee7ef70f046138e027756bb298ee60d4dc9db391d7ea4364dc30cb6138558fad4c9607002777167dbf0241b6e2f84e11daf4960a97a290cfd3268071985a5c8c6bd02466a0057b8413377f78728cd4d5dc1bafe7854bed3136c6634e01bd1e01b297a25d0f474b0495c6a3617cced76cae7c00e92660714a038016f76706ee42e3163e63c18ba665b9a92a69add36d0a2a9b116793a0305a507361a1aed5e30a0b6bdd3fac649f8e1540f6560ee2813adba6d3400c00b4b3027e777d5b93bb6f74eae3e11df52add213083a880213651571b8b94ccec40c220c8d91077ef6f99d99eae7772a62bfc8bc3e70354d82190fd74805541fc2a78e93c3ef822d677f66d7bff0ee4a80a1191d934edc693cb23a05514c0c912f1ebb651f24bfa5daf378e680a70c0bf08450d896f72d81354defaff0e0a824f2ba58f0d65d20477101584e8fc4f5d443573f52b54b1abef3ea895ab672796fdeba4d9036dd540ab53ac9d01528a1a411505594413878f3170a1ee98c7d69161f5baf21d099c115751a4755a6dcd397757fb7ce24f5f1628c56f3c98ec64cf8599a70f640bf078104cb2da27ff572997", 0x1000}, {&(0x7f0000006440)="e0ac969988c8b7b3a78d60bbde58680674123596e48d31062426ff020e0165c341393aac0bee044bc09a4d47d682ff566d3e8f6c54d496796d4fb130070f95b03e736574097e769eb0ca66718278e3bb9fd145dffafa2a715602ae1fb7dc1fe16c3ac66717a3a44a725c2a257cf129a7f8a09937a1fceaba474f4e72097e6db94af7eef17cece46cacb8793ef78d7d9c1f13c79461be4b9472b25b7c7e7970185af6fa5fb1ec3e594f", 0xa9}, {&(0x7f0000006500)="7d220f0d313291e548bb2c278cba6b89cfdd121944b505c4a07f304a509329745ea6f23624a54b", 0x27}], 0x4, &(0x7f0000006580)=[{0xc8, 0x0, 0x1, "bd34d3eb955f692b980b650470ca472a22fc53e7b973b4303f60fe8c6a4a0aacdf8fdd7e7d4ce529cd8a0f84a217c9a3160d2fad54b7897a4f56049ca806e2ed2ea9d58e036d503cad060d4d60735805e6d939a0419b4ed21a89245cd9ee3c3ca880d7eb62da5eff318bd4e2526161600911df223a571489e17cf076ca11108e24b2f6e0286135d5d044960eaed46bde9d58ea95592287178f2d547a1f4f59135a2aa020ba6ef3540546dc1b3bb2cb9e36925a6e"}, {0x108, 0x10b, 0x5, "19408323689fb5f1bcc014c7f358a6f662ac565319d1d7a759ba595d50e9328eb4e9421ef924b16c5c813b4d837e7abb94640c90af6274d80d9855c153e97ca4b37ba5977e5f31fdd8bb46001b3e794d6ec12307d863a575ed14945bc249a53e3c5676aeffd7f81b49dba788958a55eee4b04c651d29d0f9822a20142ac6b71c22e82a94bfdec4597813162c95fe9dc1d50b3846e7e65511c6971bd447c5b76fd4e7353850c8060b8a6a06edf3e173954ca0b4714ffcae8c392631e3fe7abfb10b40b5a879aa030fc7306fddab552379160336e78cc4b6923bfaf744991cb0392e20d69397a04826d2d82a7b9c50a24eb08198"}, {0x58, 0x10b, 0x81, "7cddaaf8cf785cd6b4774c8094ac994dafb811c902629adf6312c2c3e7aa34c5d8cfe61dba31747bf1cc168382ccdb5b36ac89db569b219b26a4d18abf8cfde774df5bfa812c4f58"}], 0x228, 0x40000}, 0x7fffffff}, {{&(0x7f00000067c0)=@nfc={0x27, 0x0, 0x2, 0x6}, 0x80, &(0x7f0000006a40)=[{&(0x7f0000006840)="3f6bb54c6d89079347932442d6951311646867082965512abea90143d3bd4989886da952468d7671ddbc80916eab057a3edd517e09df24db474f81aad1fc2044110ce291d03b1df2c37c364beb6893583dec2074db7d32ee9ce1d75ac335b685154363c8197062fd30337e5e1e340b85b13710a7bfd9c4eafa15f23f420845a40d74b6", 0x83}, {&(0x7f0000006900)="76d432ee1b415bfd86558a8ddef73158841de8d48e36f896374a6e84ab518ebdcc33278de6b83167c24ba5bd277161aef1f263976fb0a7a9d072bb15136330b97b77ddb88c0b1f2091a3d126eeb5614daa96c48e75a06c80ecc5", 0x5a}, {&(0x7f0000006980)="1e0739cad8e14215da5edd7bef693e903ac4f7f70ce0d2da3da61261fa23901a96bd1cd2ee3e31a99e289ad0bfb5ce209e8e8c822c44b4efa67d2318928b1ffdcc14b915b49e96b69998941033062c2025f7dd0cd5a2db953cd86ec744f38c4c13a110b78780bc3d953f2dbe69ea4f4938087f3bf4eadec612f373fd1dad2cd0d0c1419a5cbf9564027ad8607c3d31654bf3ad2f41c18aac91754aca", 0x9c}], 0x3, &(0x7f0000006a80)=[{0xf0, 0xff, 0x9, "895a164f0a5c7d499d553faa3fdb3e79854849f168c81fd97eaca2a880cc740db568db94b1092090eb0637367736365517270e13186e1ed42aa8493bb6a8f6d369a8eb43ec22f543333ac4501bbf038a64359bbde24520d66f4e1b5b2026c9fb37f5648d0f10bad479c8ff094335b8f68d26df712888b7ee484c8efa5aa6c035ed006afa0c2ee968ea7cdad70363ba2376b5ab1c9c9a1004cc286ae21e4ddfda937708e2a58f7394dc280f3a4203f6da70e967945baa016df4b56409edf4206de0a97aeb60fcddf215ccbf7841d7648b7a1514b0fdd59f9bb7c110"}, {0x10, 0x88, 0x7}, {0xf8, 0x19e, 0x3fffc00000, "eae784acd9691f0dfe421b1a3c7bc408e774f115fc04e108fac1b6ad857a5b61163e0e1ad973316ebb128964eedca12f54e894b4fcde914462a4cfd1eb1e61a9f46de9a95c693467abb494734b3294c44f7fc694036d3435cc9a351671ee8f5061d8154b8db198830adb45e662bcf1476f231708c7d23843f4b400f4cd2daefc94bb0c6336953230d01b7028f5e92a17e5af294ff73e805ef21671dc97d0dcb521424c99a3f751b4bcefc64397464fedc288c6651ad201a7acc380471464cd54fe2b929b16f2e71b8419d1394d6456fe9a3b3b32ecad70e9bfcf5e14f30b740ff11673af329eaeb7"}, {0xe0, 0x10f, 0x4, "f53d2a43443c573777b59fbfc098118283e149b24bc609efbc5a71cdd0f769150a0d7b8ae63fc2e8937ef38904bfb89433889326b38c61c53856f5da44e445b16076179915671b4c82247cd8ecf94f5b24b855f5963b51d9c7a649a94b9b9fdb5ab8dc578baaf5f157450abd163cb7375b9ca69ac4187441a824902dc1f8ebcdaa766b8a38f073c283608e2f5324b96748a2c3ab6f5304b8016968d062deb81c24a7129a6d0c69662532973608019936b9dad19932f52854c6801ac7dabdffab6575875df41311b84654fbdf"}, {0xc0, 0x1ff, 0xffffffffffff8000, "a173dd0fd3a55a9a1f351cd47ba6f719bf8ddeb5888487c0e60716aaf4bc5e7eed17a3f85900f08909a2117196f7b85f30816d76d1c2659526628a37120b2da7a2662885165f0958ec8dca00ca2c43d9612ca26a83ffc2e093d333e25574286e7564bb96864954529ff563c650b36c0a8b41b9e44c173827ac98ef2a6e1ecc835d4e7f648f1eee6861ef4012b2ff650e0c3485865f0792467698a8370d728285821f242b297198ab7bcc1235"}, {0x60, 0x10a, 0x1000, "debba6ac864be74e6ad18279a1fcfd9ea23cb3b5a887d35587310cd32506ce037cced4b81dfb997ecacacd5119fd4ddd3ecd68c1c38adcf108572b1fd8c0b00338f5781decfd2db6b8d09b97b825a1bf"}, {0xb8, 0x10a, 0x1, "5b9d08991b36dcf0cd4f063844a39be144d7728edfd87bc64044fa2c1bd0542f5aa339e545f3a4e7dabe5e0038d98ffeaf1e44f63c37dc3796ce0f4db8591f9174f7655317b175fc3f0811e3d1037aa82f5fc6dda5b5eb6f507d920341696733e28456d20a367bf3005668e5c905c751ddf00eaf21775b7c6404cf66e00dde8d1b6fd10346d8d0392e6adffc6c23cc3605754a9093db91788539803cb601fb87443bb3"}, {0x100, 0x117, 0x100000000, "30eeefced46fa0f35d6546d7f32eaac8bf3a6420de9d5a51f335dd8e8d7c4fd17ca022d1e72edee2258f27c4c50f63055695078104adb5a4e7a25641a969e71a0ab30043f8c94e2c3b3b28693aa14c8b5c0adc8903e05be94c2f39be71e846d96d298214ba2d412ed149fd36b62c6bdcdaa4e3dd0e2c68b071aebb6999c0ac36982fed594e9e5bcc5098fbec76a55434b8e326442cdeed51b8522abe3fb7472e06c005520638f8724c94325cdc8d8ac91c3a360e154e612d76d177662887bf9fe8554a867cb0d3fabf859612c8fedd8164f8d34b67df71870c81deef3ce1710db581f444f4e7625030bdc7f96a"}, {0x68, 0x104, 0x80, "bb254bb91bd6b1de6f70eb00d13aa0090f38419ba3e2fef9f7bb30a9b22187d81b0afd3502614d774b1d89e4856dbc48ba54251ea03f7cb5df88d4a857473570289c28d0fcd381e68bd9b42bad2e1f4d4f636e6977a1"}], 0x618, 0x4800}, 0x401}, {{&(0x7f00000070c0)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x1, 0x1, 0x4, 0x4, {0xa, 0x4e24, 0x7, @loopback, 0x800}}}, 0x80, &(0x7f0000008400)=[{&(0x7f0000007140)="04461018d874d20bec897fbefd527fad37720b119ab0540fd2615e0dec226fd46219e43895213026ab6012a89df426ddf4b7167193445714cf42f9836cc1a377e29a44f41200d86c7f14171842a4164ebfa34fed3cf43b909e2a7859970b", 0x5e}, {&(0x7f00000071c0)="70c5d9dc3caca4592c8d288585837bc50ba3debc5c3f191252f442d2db701cfc108ea9806ce7c64ad5ac3e58d498e255800ecd9be26f2c04678d5ae7cc468c82e8be041b0d6349ebe5fe1e39eb", 0x4d}, {&(0x7f0000007240)="aed5a90db2d47d6dd014688261eab799864000b4048ff0801461aa7f0ec8eb0550ced4049a4e48d65a4f6bf38550d02e6a17706cb6ca383b83701d8418a321d4d264e3c5b8b81c7eae2676e1acaf61e8467fbfe6143ea7523f3452d5803b8a992db04bb925ff2f15c912829e583cccdc71317cfae18ac1385576183a2d51401e5f4f9a6500fd0aca8e3e20d505a5978baf20b0323f7af043bc9c4722c78df310dd86ba9a6734904fa65843f62ff5cfa0e9618ea584234150a37c7f92907de46c7fcda2666706c9de8f3ba377e7b2fa4d3c72cb657cfc286e5cd871f2a6d630a1922256a85dee4cbf1e21141dca5ca563336f4bae0cef24adf8ab8142491d774a49e229ad44bd60774e8dddecc941deec3467f17fbe9143ee59d0e6a3236bfaefdb22e3e2b3fd87abb1be14cb06e7e3f60386d03551129966603ed4d8afcd0b255388b8afe96baac1102cc764ba88cbbdfca260b6479f43f532d9d4a400faffc457aff761a6a6633a284fa127632046817b03a0d042c0f55ea21e3d817b52c856bf619875b57ceb606eabafd93672fce03b15a34c2ae9a4af3cc2352c4f4c94d5a12c4dd3cfdeb8e09dc9ce577126923a21f55f2e6d722119ce65569576dd2d41abfbfc3ffa93f6a3afb169a20165e0fe50b862c3978eb12af038d8989dc4a6b163ae050fbd90cb6a68e04532951eb8cbe587355780c96e60d63663b834191b48b321ac40e99d8e4e2652438ddb216ae81022be665ae8178c047713626f4406ea8f13244dbfd7a395e39ca3c1143f670a7e85a250ca7a485c58ef17e964e93c6404d021b3a57d1601f3ba25a11f3c4ff4e357a3c61332578fbf2f65b38781717993a5b0138ac40d130a9b5c368eb89486055864fbf09627789cd3cfb0ef4f26974f4f073b1f8b974fad0d12c3d24c80326e2fce4f3feeb86fd08b30c77c5746ce441eda5c04466852d6b2a4e2dbb135db55611361127630f714f09e4f92fbbfc0ea6caf842e9d87ea2c5103aed242b99f7227f5ddc9bbcc4b19c8ec97f342833f4deb1d63c0a1583f69110dde3d355056d213e0458aaed48807af030cc0892f9552a0229c8c101915b91a2c93ae03ba05a942c730632bee32cba5e4d40ac08deab6b289266c23c7a6c8a8eefa156a91435d5a79a04ae746006e548e499844e1fa2cd52dff3f1639667e6c0de245094c70d3507f2ea3c92b0fad75fd6fbf978699d60d05e88373a9a51c9c1b2ef4666da6e184256ea4ceb367e4f03e80a188a86fa8e83a18f97742d836b09fd698d345291d2085584db9f2f78e82e6c291dd71d4bb26dfb7baeab0c89b98f0ea5048144371a5d521fb483c9b2cab56a5dcdb758d8a4cc2ba0875b15947b6170270d97d3bc38b3df24524fb29096ad27f009a9878010b9dab59b41c3bf7c9a12209f022bf55f137474c655195029f3d5c2bd20bf1821fe7af23428e7251d606743352c3508bb1ce8f0ead2ae87a10b0a270db456500a681c1c35ace9de33448e539ebbedda2187620b41d4eb8dfa0408cbfbc1bf5f2626a36311652aee1b38723675010c782622dadc9ad77109ce12441fb6151ff927f9069cb32175161f002d890297f97bc94745fd09bffad1c2fff8b73fb51fcb905d2e4464863960387b252bf099327f44a39059241d49ac84d9a03bfd4374af93ed42ad664bae6b2b32305ffe0d1552c5fecf3e912796ff7014b786bc2c1a7e921b85fe5085b463689e1e55d71617ae5ef48b35030ee4d2c166706519670cc8acac65c7edc74a9361b2da5cc81cd06a8cf5add991223edc728911d7950be67de2f4e3c8eb5b72847a781190d60ad60539681f926543aa362f0259970f313aebd3b36fd2d969757397dbe82e5297bb78df6834a7d90a6e865d0cb3b27bd2b0bc8c07c37c20d5db7c9ec7f7dc10f12ee09d2a8f4e4069e595ee4c047ad96e66267a4feb9bee2c2312ac975d345b566fb425ab0f394b964e3f746c40d981d14354945bbe0839742c7560b2a14f5053fae5632a61ccb8d48d2eb91d14a97a003c0fc224a781bcca75206d62fdf0c0c450b9a796d77f30174675baf22e29d867aa7633147706692b7960c133040ded868a32b0e905d2d986f40377409836e06e109632007412a930925fecbedffda97bf8ded0f22141570d4022b1cdebe823d56892d888615c74adbbe85b712e1658d94300cb3504984cb50e4d39d4c5ef483ee38ad15508a6fd8ad825a79f29572ed2ed639fb2e7c2128c0a0c10bfdbf1c7ea27cc32aa1ddfe99cb9db106f2d52b4a7d80fd0008c89c13a25f560649aa50cc01950ef082cc377378f02f6559f39a70e7721436330d67e9ca3c41da6ce5ae8a1b67a1c31b744e635748173f2bfef856fbb74ebf666ffdd14f21689697e9d011fa3110c169d8321e3b2a8672b5399ba767852229cf132593dc44342b182b415e0cd88b2ae238a90b53d5585d87b20c1c1d363cd791170b6640d4c60b9ea33c2fd521a9fef2d6a6912f72c7e9c7c88c012dd6549d259982ff2dd17298ceacd412e1b9ccc13af978d05686b64f22dd9f549382e81a7b6f2740b9d2c0d1307ea327357d52c5133652e012876db483aacf56fed327f5c9a1ba5d26da98c180442be2bab8a00058ac5995d2f7bcefb0c941ea854b4b1d083bef218692c542246b26eab15baf4b3d967e533be906d820570bfd2d542b90eaa9207117dae055ffc9e7ad1ea5ae4b3360a4fe4003ba005c510f2a42a85e240d9904f44bbc18e37b53bc2362c477caf6287d5a89190de71458f9e2000304b9b54eded1779a0e46ba62d08209cf2920e38ef6e8c5060daafe5de0a8594e323b1e76f20eee4b1b1c6a1fd02152677bf7b714af4d2e96dff02093a87bdd2c54501abe63ef641a0499345e698fc129f89e1541662a5234a8a278dbb8191d7b3239392efbec38b235d832bf6419fbf7b42f8ae101dfd6c6e5f0120e570ccb618be32341cfc12049fc7638f1b0b06062f32e36f434c38224a686c15bdbeb70a8c8c2146e1d2d98fd149bad33079773b3d4d133cf85cae00c4ad8248af9ba1bbd0fff95c262cf380f87533615daf935da6a7b1a5981cef47154d3eb71b7158358a1dcc75589649f010fb7c079d0b2a605d300020c32d092fdc30ab9a79d39a35fc47f93933c1fbae02057926425fa780ef48785ecc257c1a700673a55d3b8f51e055d2e4a77c02506e17990ade8fc0ffa114daf6cd94956068b471b6375cbd8a126e167b5e5ff6f962c76daf0a5a3adeeedbe284ddc9f19ea8cb9d2cf05d115e353c8b23bd5426e875fc0cdb939c4f1a8a51472e3394ec2900fbc8b3fdc815038ce4547964842b39dd284944e3e2c2d745f7dbac9d3fe34e833c33fc4f2de87b4ff19c8b9f36295f5bd7432956dbca43d6a02bc8c3e74b34e4d36794d879a1a5bcd4f415b0f3f9da1de7a57c8b22e376e832235e7a27456a5c40afd066bd9cc5dd0331dd4b7a7a88c33d518165472cd2458f98921eb5b5b5cf1c081016356fef223db3cf12eb9635840e776df924e9453ab021612e77809c1b840ae9d62534fa39edf30a55ed932a2fdff312102f25ea36939bed249b7c4e0063dcba0d72aa46e1f1ee6b36125056fe9079bd786d88f4f6c1d0ae4106f197c7e40cfd3d3a5a7b2a7a20c071f543a2731471ca3520fa03f043656a8239a497c315e1dae61921224e4c48b64f1289adead7adc5c602fe8cb30865af6e476d8938df2173dca1c5882c57a3c1eb8371838816721a954b4087f53145a2ee345963d983550ebaf8b38d677a430b7797626e8277ff6dd678391cf8b5831433ae6068391f089aed47d90c251a66404a8c3bd521cfcfcaeb7cb3bc08b062751983acb4e12f431f301c51b96e76c68a74e83596ff79ff38899d709d2c456aac2bc0ec5ad3164726f99ad0ca35240c478e11f879014ef558996972eb91fb939b174524b8676e871e937864aff80318e4836e8b9d397c7b79c527e30786e212b1984f322c97aa2ae38102a3754cf00b04604ca5039d410a5f5ce4bb39b392c8ece5fe1fc3b8f6c9cef5b472da69d3381cd6949a02af6c10b05aa718d2372933065ad482e2526c8dd522738d10fad973c3ff6530c050967e3bce0770b4640eec818bed121a5f25437267a6a975b4706502f7152ccf6fd66ef89afa133ddebe9876a063c0636a5b3bfd35eb7bb6015d2ef7985ee83d807263fc7db02f2ef400c6f3703ddabf1165cc0ee8c3e7f3bd954c01ab32e3088c3458a9eb0a6028599a3f9a61b01d2a7a671ec7b22b432d72205b1ba0159afa428882d249dd01c8fc6882766ec38c44b9b12f6c06363f5feed3c8ef0581cdf7f5c8effc55b05aaa2f90a537aa49245aa9319c91af250705354aa1359d3e74c62b0f0824187a57de356e51398be0d8b097982ae07481def527a69d2eda79183f93ac08e9fe1b9eb97df5b05ca852d29a768c161e3304fdfad425847928ab3b7182dc19f642ab7883e2cb77b4caf0fd08b46d93bb662872ab2e84cf5e76df8f953ec0ef789351ba99c929eaf74c9bacefd541b14501cc2c517a1764d7992a01ab4b0810f1f024683ebe66fc8d4ef5e8111cb1f630ae43485b76a7c2a286f1c162d58370515a295bed3503482a3604a6bc8be13303929e87d7929ca5a731d42eaf9279c4e53feb484bd2f5348eca108dd4195b13702a12e936e352b8dd02aaa8ae14797c0ad8c9f248005148e272b246bf2748d81018b769b910f61b1a1fdfd013d4a87a162f2fc2334aaff6cd06798957dc7235f1bef9449d0231b5ef4b7459ea0f8cf0c449f77d70f0cb31a463ff318fae2acaac5252cb86bc96ea33cb23f01c16e1f5eb46261c84ecf6d72cb85ac7c31bbdcfab08e620c573eddfe7f17ff48a49bebce0902152363df771b54c8693489bf89fe53d163c146cf136b18bd6ae5c4bf6021bfc2a9e637abd2dbfbc1c1c6407c8dd43758d456308222afbf27fc638b79aedc4481ef7ac5a53294e8fa91c108828f5d807f3af105d9a063f3f52d40692ead9de0db5dc66863b13461af247890ace66fac0aba1499901fcdcddb25e0e468d4791305931dd37aa56290add59ba03d08864deb0cdafed4c52f42555bad2f37fe2c32a78dfc34350908cda3cfa4a7ae3602c41724d3453a5cb96e2a173dbd06f447fdec0b230f594b814b2c7c9139b2ee906fa89475c44b9aa473631e727488e17205cad0cfb1751ce848cef8ea94da373a5105d2b41cf9e2c645b2d20f2d223d1d81550c45633d5175bc8da308c22749f31727f1689eccb264c3e64c636f494d28e00cbcfaa1a2d5def145e7114d862143520fa2562990f26466ae79daf4011cf1feeee11282e8fe6f5ecef887aa65b4653eccaca263129b1902e1f4e4ae177919939b28d783a488152daec42b948543feb9a3a07568dfb12ac702c9d82912bb0572f38da5fb0858f3bd2b5d36ac04ccde5d478a4b884fa5ced1adc303f4d8431d29e3a9df2a3257698f8cc1246b436838561a240726fe8f7c25108ec9cc44fc8a01789be2029982485b760759d26f3df7e92b7f7a593ae61bacf5b75dd8d1739c1c0ecc157bd8dac1d098cf11e6020ae3fd7c6562de1327bee645cf35341c7b9a2c4d28075f1c66b22ede474fd65081580c169fdc697e9b462d022b430192338e928efe007552e7f9a4b6fe46451bf3124e0cc528c40f4611903047a8806ce5d5a5b3d7f0259702beea122bab95d0fccc8060fb385160e77e875e179c239633be6754ef0f82da2df0e26b157da33815cdebf65d6fa7970fa1d2989388eaf5a603c0638ad721", 0x1000}, {&(0x7f0000008240)="ec88c80a55b6e6f25e4649be281eb7181aba8fe8af5ae010604dc24ff0bae48ec8626fcc858436c39c64d4afb9cb964b5ebdcc2a5319e04913b4e08d6ad733f12b4a881e75b2b3a995bb8d3472226650238057ecc2a7e851fc7d4952f4ff9d77c98191589be157c18828e8cbe940071c172b45ff48e52f3c8a8b799a97e71bf461b6ea77e46a1f3fb251206e42bbd6d4dd461c0556cb987e44183aae35b400e672a99365f6f022a3372604c2", 0xac}, {&(0x7f0000008300)="5b5cc32972cf278df9dd1edb779de0f88edf891adb83b8a736db7868f4e9085e4871bc2158cdd3ed7e228ca65f76a2d6a30c2a67dac46d894be559bd8ddb343ff1d62fcf85c6f160f6d9a7f1fe127c7501e7baaae00f0b38f81362b9b367139f215b6563bc0c71a8e5e13f59cca7278d16e613423a4e64bf1fdd0cf025628cd4e66fbc471de4ff9dc95fc53b585442e0c4f923e861af97179aedb32a496d1b02faf3f522b13030b8269c2361883dcb15247b81b704f08e86469986c8d1a199cd6f248d858630deff81a4320813fd41aa97a9d850b142b11e8656af929f9927644104f07fb6bbe1f521b84e332307c403314be4a0ee74", 0xf6}], 0x5, &(0x7f000000c500)=ANY=[@ANYBLOB="f0000000000000000b010000050000002a076c376a8c3fb1043c7f9a27d1c6f32cd40f75d90a8a764381ba8ac59fded4afbf4ef8fe53d3830480c7104fbb8c27b80cf8a94f2cf994c1690fde12e903a5376e686cf8fb1cdae35a32dfc32ee3a7d47615a0ba03ae029fd0b60e598e06312e622a4df4e1deacea52df4a6ad28a348711f88d083e2946dd78aa2d8ea61474feaf65d082232773cc1c7200907cb7528539eb56f9cc88c0bd35e3ef64e4b35c8cacd256569ad7fd778b4b8428c8ee83bcff77681723166de6e28aa7f5e42fde0b6a675ed09fe7945bd6b98c862896d2935a0a0a66a29be578010000800000000000000000000000ff010000001000003dfd77cc18908b8d0ef4696f8a8add4583a6456e1427b2a3d062965de5befef31686938794992e6e82a24d8f2b14689acf26c0a243e8f200d000000000000000170100000600000026a3b9183e0624a372c282e62498d343be62c341cd7111ce709fc4def95cad399d64588f9b3243dfa6a642d61e8ba7d047453d2db4e0cdde166e9706e76e904b0ae5e3f52abd5714df3ce8a8b3434656dfdfcb7a8660b5ec3cee4d0332b23fdbd874d25acd0880305af8a7408153e6220a00dcb6f0a630b2bb47606565cb6d066dbbde8f4fad3ab72bf35f234a2454e6790be911fc0555c6b289b2350bcb422045b8cb1eef7cf484813945606d975219b13e0aa830026121d03605bf58852c00900000000000000001000000feffffffaa1979c70b85ae3f3f25219527ad3ecec0725a9290a869a7c0f11da37e44c6c4b82061f6b827b3f4b3814c10d04671aecc676b3aedc042ea6ece132b6c45a88f774006e6bdf11476e284ae39f65458c779878618707c743132f685c27735a3625abb948bd686b4a5d4cfe5ce4c367f5e40cd139d11b77be0bd1e47b72b244e99aa8806c1921e1e133dfcf3bc9b5d0cac70553d4d6e86c79418fc8c"], 0x298, 0x80}, 0x3f}, {{&(0x7f0000008740)=@nfc={0x27, 0x1, 0x2, 0x7}, 0x80, &(0x7f000000a940)=[{&(0x7f00000087c0)="ad44446cce76a8ecda633abbd52429275c37abbbe065f2450168caa0ee6c96f9d031bbb0c06dfb988d96755e31ad7eab66df0614273a42e2ce70e018584a80c9f286163aee45634910f682c9c218c01d8c040738d630f1bf9604c09ae973b412d8102e09d5baba6071b004d3e1684bc78526a7564937020d90c975b5568a719c12d00691900537da1b80503e48f7c94c81befe1924e8f64928338d61f3748f63c3e6b591ca4565a382a506445896724bff09df510f39163cd7ff0ce79badca144dd7c890dc44c16a4b2af6e14f2eba440857f363fbf936e705a51fe311fc8f4be398d66233ddcd1a0167", 0xea}, {&(0x7f00000088c0)="377a7c44f3531b233ded52339a5dd7b13c091dbab612cafb6886e992bec0f9fa92b51187129dd30701b9879281a511da60cbfa6fa174d86fc132d15b6fffd0885cfce204b515b0db7ec41078c97e1e1174f4d48b45ab809a87f02e1fbdbde44a0b895ca167587007f7c694a4099dc24b15ffe2288ce0be287c61a37bde6426ffb4e0bb8094efbe5882f4728b640f281d06bd3240910fb9534e8dc9c0197baac121cd92e2cb9c24810cf9bc5b54c5b1ace04ae2febfc8a74a264917195e384db979a0cc3a7621984fb22aca242cbe800c641c208a3f2f01e636e7550a9772677a2b5633bb0dc8e5335a89882f044b58d808556e39bcd83f73cb40a795d20c8a1efebdd2355167e98d9f2275aa79a7422daa288ef2267801541a914519ad21e3ef21b87e4fedad988d739e2a4cec795485d01969b65ce182a2543838e5d34fb8aeec1846da2cc0bc909ae5806afca236b5457a4c7c079a4c79893f9ceb68562254eb7048231473a3f4b4aa0f2b39bef4eb22f537a1e6d327e7afe4a1f7dec473e7743c5b19d347c1231ac2620c457f539296aeb1ec3b44af2b541b810801c240d69bb1231146a536f395315b39a032d3f442ebc018f8058b6ae4560ab2de1d87c96cfed6e706f89fd83be5e01cdaf821c06e8c78dc697ff6520a129b7a29ffa0e9572ca14732967839e944771e7f4dc9f2ecc86903c29f59ea6b35a4088043944fa155d72d38d5fc28691468db223400fead6180b9ebe2312ff343a41ab1bd00d99ff52898d278873b6a5669442695bc91b9360655177d89dc4edee95442cec9833f1521c0a9bfdc7cd93b3edd05b761b53e37fbdfb08ef3995db5e6e7a5428f6d30c1bf3fcf22bd8a66db7336493f075e5e092afe35df6e0c7b9e3ccdeb33b886a0347d493ebadb28a03677239cf09ed3b26eacfd8eacb78256ec1dd20c1607af8f78b26701ec202df064934b871fd3b4ca703c68bdc73fbee3c45018f7857dde7d9f8c2771690d823178fa1350a1699cc94e2763c8c5201c39df61be8100f8d6a12a0c0dcc27d879467c9e008a521ca6a6896d3256ebeac7c6b20591992a0febbf7eaa349fe72066e42791f8cd32ef759a845497f5df202372812ec71470ed799f7a9cf7da8331e459be68d1d932c964f5c07f68c7d45ebe22c06001b78e0fe8e8edf1141efdb1e466d70deea09aa6d2d8ae4edd99e933a8bc80d010ea90d55f72116c4c469a1b93bcd360608fe8703995beb4e6b7d177d71cabf520582c2f2917dc5818abce6ce2aaa5ea294740b9899f0aead92bc05c2f60d91c4b72559f8aecf949d8bd4b3c5267d756197542cc4d2adbf5ba014e65aa6d8d50fba1a974bf25139350db60bcf468f2ef8ad7eb70a0d4b54073fb9850bd67d370d9d8c388ded92468faab89e83bde9ceca63ed4928e84531748527b532d94c8849fc2ca28b858c99bb4d78ddf7ff922eca6c36c1e52d68097a23a2a5105bcefda6f1655fc5b74716b5b8f95b75c08539e08c035315c0618570677d0d63bf6f53891d07a1b21919707b2fe400d480399dee04e8080fbb051f1b4b377e81c190adf8e3135ea4828b0db87b396129dbc245cf344ea8f83c1f3ca582f77c90fd660ed111e8fc10f2fbe57875e3e0ce22e85f01bb515bee85f1d32709535aabbc094fa2cf811c3f89ec1cb9499083c356a9eb62203d30adec1e7d8fa66b1e49a084ebffb5c04b0fc0eea1ac5dcbfd8cc86e0c4993ba908d2c85011c92f496c3792a5c0dbbe8f7211d452ff7f2dd6c1f1f4dff60cc977973b4c8522f6a7630b3f27fc6ff9bd4584220737ba183472a9449228130cbe967ff3289431587b174cc3444a3be32b404b9cf263a8080c47ad837eb6022b1080f2c5a99bd43420b0b2f13b69121f08b80bd3861225232d50491cb795f5c2e3ed21c1abfec95d9de808d4fb082a770a5e6b407a5b86919bd4ddcd44aa03adc020aa85cc7c47d166d4b9841feaec706332642ffe5eeaa4db605b23cd3e32c743e7f4b7d0af261e5bbdfd2ea28e86a8aac5fea6d65131506e46191192ce829ac79ee39ba7ed9f647eccb1f8b63aafa0b3d9337cef2e331e948244a16d68ae4ee3cc3e45bbc3d0d1975496f4787b011cc66ad31fae2068bc989c2c17dc7ccf071b7719111cbe2b2b408a0522ca112b696168028335965ee042e3b572167d15e43b8993affdfcf1bb679a1d17d2e224b5b63355a406bce40cb9380bb5b634d512cf9ce0205133d6a3a15c041556ee8fdbee995ecce912967fbd09eb918e281050f49b4790269d5a789f817ddee43c34b88d0ca5798a46b3a1eb7c6801f6e7aeede329b041c011fdc0bbedd999bc1f1a1a02bc7c1ef638d7d7661d30c2d8bdf3aca6958f6a4755646275b29c521806d002425e09854ed761245f680500c8806fd5282ac1aff7c705e5c85663331b725cb4cfb2e70c4c827453fb906a6d1d122ef48b435cf570ba8762965e911b025b79ccdea5dc6e03124a2f10a336c4796897b6328453333de091fdf24358ecacd6a9c718de70b7d3e753c4337dbf70c080332e3d6c46c46a0d90c491277dbdc1d57972e8eb85a19917c2ce7a3f66a3f7967c5f5ebe051ef51786145626709d5b760f93a241aeb47250b2047a624df8f44dfa585286d5ab520c093de3c948128dfd21cd9578bd4ec7e0b68eea49c51006f749f34e0dffce0dbc9f2eb8373fad4c32cbd92e2fc5a3a5681909076970574fbf4a2a9bf48126baca6cf887190f6b2beadcfb64b168157c6d7992b2bfce54e70ec8b4f06320b4841835ff0d683d0008f2f77a33936a3b0a7e58a1b9a524a8dd1f1f1cd57a37b3899353da27b415895809839227ef725b535a5f63c3f1815e593422bcb4d25dac1d2a31a6ec0ed2d8530011417b302a29856f31ff440b54ebbb2e717166fc7a17a5734cd191e57676ab7021e70770e936f29e2c2547d6c8ea256f245d3f273140656ae959221134de1ef8b342ca32deb43f5dd41eb0823d4d192a7d2a0abb53ca739d7bf28e808517091fb65cc1540a0a41b0ec4b20983c5e90a3e15d562827ba4bb99b1e29086097f32aadff26a4b2058bf2c85867c3edf5e121459a760e4f17d67b0cbb660b7fc745df9a39c4f9c06b38504a2a0172aa9d933c3ad097ab428eb3d7e51913309db3901bc756c096dcaafb37ba207b766934e8b7e0dba3e4d52b4c073e148e923fe0c7f73a21d951992eec606abaf85776ed464cb52927b65ab9b1b8bdd4155f449a642a36651bbd58ab837f4e900ff20e9b58c3d5396c3cdf22f18b55f956a73e6f5d17e341234d08c69919c74762fc529389d964ad2a646659f07901c383d8f1ca459f3c02021b953553b099fafd58d6ae47b6afe5c61d651c95d05bc661086fe924c2f296087b7327b2c762af6f4df046983d4ef3c908187518d2747e729e56fd340915ca48dccac1d20d88165d8fab582e6f8a0bbe2bc3a71d12061f7ed761486cf1b4e8dc24c3c2678880871eb40474144038ecbf99a41277418d2df44985379ab50ad04954fa0a6e6a65d062d941a4abda0f1663bf65ea679a667358bb23b666b4910e0a68877b936611467efeea8fa01122d5165a7753f95959f1d307c3a2d723471adb8fccd6272a4a6f93e3b42ba92dde27c83b72ddc4b97e5cf84cf3178e503d09cdd678e9a04a2c0e9e7a4f1c8f7c34b8bc5b01915aecf4eefc7785ab9d0c6c8c9c9cbfb9b450ddc5b405374bfe685bf0d45fc7b25f84568608d0312aae58f82b15f147eb8bc6cf9fd2b5f32a18953359938392189afe98f494e5c49bb6ba245564b23f0b1344f7bb543a897b6d586754f17a1d302bbb66aa28926dca51e2b2543e9ce00204f231b7a2bc257a73ea1bbfa42fee3760e37b0e08a3cc0d94ca9dfa41c9a4e6c2648daec631a816db7c1260f8710f45c30a888ed8c37134cf58d935bb16c5f0dc30f2ce3745b105d7ac4f071d5a7f5ef7a0227752fdc52f6e3a4ae7ced7c5b0a343845a647da457df12f4dfc61d1e7fad0c445da03197454770849ebda5e66d157fdafad36280dccf6e2be0eda301c5f1df5fbaa1de5b1614c99e0d09558aedf2c4a7ec467265ccf753359342f65670717124f224f99f9c7535cd77ae2d0b4b31ae156678176b8aed84916468f5133976e1bf264711255142fbd757a79b492c326146fbf0e7794d751b674fbaca0b308515077a944605cf1ba95a697086b070e0c5b66403fe41b58001c77872a4b875d260b993c011a6493d6580243a1757a0fec393eb5cf8e9654be2be6603593ebcb837e2ff4d1c2edd1ff0465b3dc332e1534b21e61e831c9fa4596497617ebde303e34f71a6988e1df68b942b2be11de7e67728402b5672da70a6270a8173e93df2317178a4eab53f0ce9e23e34c0278dea13dca637e1d6421f5787e85e228f4d087bf232b5f618e790607d3649751e952c0225ddb98b6dfb28369fb46881a983474bb67af40a153df03f6d11230ecd7d9bbce0b8d6d92549ca535c96b2210ad004b00b0eb26b2ef9da2b8d5f3ae0deb383a3ef5ea0962db5cd77b493b3a82da4192650427376931759e1a704ec7984bf8062dabc7fcc910337769a2fc937390ff4364bbe343428f00d782cdd69b98f443ba2ff8c48b43cbede71be13a7cd30f19f97b727d12094a01f6f38221842645201aff3373ad6989b36864538d55af35e9dbaf649788c4d6e8256aea2334180c2d6349bf12dcb130107124b385b19187dcb628630e4f86406a50da168d42559aca17fe038a94c0090bb1f4adbaf4305eb9772a2b56aa815a59bf88c42fe24136c7dfa4a297867fcef93df679b91c9d315364e7a77db7fbbdc35721e6e8c2d314dc6cba61bf89962f44fe51f342e418e7b8adf1a81ea6d1e6db94ef21a3b988e1f4fdeaade713347fd68050c7b023ca6cf92e25e913cfbad417f6c84bee93d962069c01297b5d8438b6a8f75eafb42eaf631a554ffb61f68073905ee485dd5836bbe0a9dc3d59fbe16749fdc95d37df20625fbc8479d6e067ebab6c965aff1f96253e592a80f4a6d0abb87bef2ed2472e968092a887d3fa6b34591f0b5bf86cad323531efa48ba41ce704acf2047ecb753228fc75c03d314506688368550b2ba17405e4de229cd5dafe86373a4c213e212e4837e2d54d82a2081027a879ee2255937b958c0388747baffff8feec0bb071750cd6cf0c10685f27b280b937daeb1ba8c5e8fa6cd4d592b825d7d9fe1766a237e38434a05aed86fdd312353f456cf788e67865162c1b03dc44036513dcbe6969b42115fd5891ad85ee63b55f020d1d2d2b8c0171caaf7d6781e21ed3f92c0dd6c1f3a07a2cb1633cbd8a099f8c8c085b2125e2ad8db68325b969ba06967a6881bc9184f2f0499994101fe1775b13176a9155969ddcb24d3f66f4a7c0edd951288a428061ea262c7ec638caa6b71e4f34b43c6aa540f43de2adfc0baedf896bf0a6e12522f71aa4e469c2739dad731f2f6221b10103f92f3c2259cde5380a459aff7861f03bd6d7c1e21868ce62666e3c1d8bbb904ed7460a6c73a4fe19240c3132e03d14c86f6ca10aea2c330417dde4bebbe99bbd5088c04c66067ad952b7c1c128f739e3153fe3824c551c53b230ca35e70ed97053e948e280cd296fa4266eb311cf1f978674b355182347551376491e56b8ac7d179aeb8c681cc1fc43608214d2f9b96d7862c49968cad1a71e087a8123b33a004c06518ea0ccfdb87444a65cc934897f64822814db0d739f887f667c6a889837702019e4d7d00531c81c35807a696658b0da3407a2d33baa5fdfe", 0x1000}, {&(0x7f00000098c0)="dede612ecc56614d87ed56681598a0427ccabd167ce318271e90716454c9a832e7f2ee871eed2332fbb6cddd57edbf69b87f16be4da98b8b4bd04de3", 0x3c}, {&(0x7f0000009900)="a0956a71c82904dd1373b15910ceedec6038f8aaa1b9f1977cf9d6ac66641731284b8b8e546614dfcfe9b0e795a06d1347c26dd0256f153b4cb01967ad6bda6af5b841fbe03c62acc88864a74d0790218bc5c6c126c09608afabb4bc537a2044f255784132664bc53f43f07d688731fdd62d914cc4f5d6c359fe7bd07ec367b0f3fde9f002098ac6366e2385955ec0ec5c41e179739e973b3d0126aa00d3b1eb1df50a47340c63b79feea21f8e233878267d139d4f60e7daa36d2125ee547c181fc3405c6185c261676cc67b82691e0da3deaaf594f9a5f7fa4650addb1b27f7ca1b5732ef71127fb9918637f9801ee2f762ec8b87c920ec3aa7ace743876d47294784a3eab4bcf4079a29665f6c9d6847be38cc39b48c90887fe5954d5c11b397b5473c88cb99b2526af26c6c71d2298457bc36dc9b033b18a9c1e2da8cc389235802ffc3e794b11aa031bec05c636089f976af78ff5de838aeaeca8b0fe04bdb90b33a21cc87d058913ef57f66a823153fdc6f0b4215ed8970856e5bb472f097910299d9c9bc362b0694a64c9bd5f624922f3def3a2d5017fbaa469138bd30daf347200d01c6a40ed4fb6911eb04cedd166e7193695de6ec143fd9832009a402ed4e8d4c072669a6c231572d10a1abb4b69bc689aa1c4f0f82dea6022b7c5a4143e26a5aade3b2c7d5cd94f841e7bb406212a05570bfc356f2890d2d6046c66b7bd9ee8d25169ded8ec42eab9c8f13dd8ed391462b2fe927c23f26653208d946262066999015d91876d54eabe6fc543061725eb86ce4c1d0e2db57c03519051176454455cabe3537cf779e39c84b2c41a26fc04d6d7320fdebed15b6009e03f6f36b3ed87cdd705ce908bf9978fc4183d43a54f4136404ca2e3ea4599698d06ea1cd30d51f22e4d73a571a0ec8c7bab204612808ee0409e7456e41122706cbae658d107951e7f5d87ca2f74e215a49f6a0b56de0a409764fc3904fe3312ff7235558a0d8de2f9d29dc91a861b51edfd29339138222cb80672193b01a94c094a89da69dcf137152bd33087305c217d89b22bc5608f2e820b3ee80cd68aa2c05b04aa946acb8285eb1f812183166d96c437f18294e74ffba0b0eb4b38227b4aed71eea3516098d9756ee3dc1908440abb7f01bb55f3e87101f6824b169d3ddc66f879462cfcaeb9d525619d5d7de171167fd02cc0d75b7f9dde3b6ba26a70f7574c546597509617bbb26514d815468e6c22ec0a4f2650d66f0427f551caa2c93f6cb10c2208dc5b66ebc9aaa162cc01c272bd8aaccd95b3a8e981c31a7d151ea12b40425109d9f1fa919032f9e768790c52514050fd73a1fa487472e072f6d35d9a9dad63a687562078db810b58b544536ffc563e3edccb80daf4aed5cd4a5b571d52d12dc3f59f687fcc8df4bf08ae526d7da96d8fc63894d677a99acc2f3f2cce242ca57ce96f7f4af5791b96c78091c1fbb3cb00a9e1473f0d296393b0bdb5a920c653175dea67c3d66e1c323d3696472e474df32589c1a359540ed0cde81ee9a5b766242f14fe6edfd1cf2518e1d298128e9d28f8d4190dc6447361ea5838c41eb8ff22313a488a1126156b5bbed0347568d85a5f3893dfa4db6808a2daf0ce2945934083f25dcc5912a3c18fe5df56929c82e044e96994a145bdf2f32d1926d6f2d758b0e9209053756faf3fe938d8175519283be9d0a972eba2f3c7a7d843063ed82ed489709ac46e0a70470f00913fdceea9e6c3f90453212a74d5bc3e703309a8205d2a3f365c959b6238e57bad3fd3501e148403cf53dda0651bc394ab4e754e8bff23b05f05fc9bb060be9928150236e6144e5ba85fe3ac2e9639c5f74bf931bdfa7c8f10598334b571add6f93a58f87fdf645c80fed817684b87b070b10b487518515cf22a89a0205e57aa4abf163684b63a43d66bb65c61f563f67d2c7d4a2fbee3f3aa2f496ad0f8be802a56b3a04f1de1fb33c5494890b64920bee7c6d96123c49777abcdd3ac035e59f2897f397bc185f8e0076fafe19df6de589cbf9931aa2a0ecb320eb39f7419ace953a7ca22c84ec76c0c05dfd09687359d4dbea5bf3fe79c35ce4af0e97223cac44d45553905338da8902628ad39767bc1ad61d5cb055dbfc2bef483f676a83eebfaefd74de40603c0f97712b080ea10cbff80ed2a100f25a3f24db518ee2825e5fbaf72c23df96c24c1e67f8283ce4936d588a8be3c34c737395b4c5172f9a9c25d8a380e798b5773cf2f408f10d8cb29ca681cee1f47d4291ef39720169de53e2a1e8b1ebdad27d4abc545df6f7b25ce7764832fe42585495f774d23f29735e230f77df4010612f0d392ed1b8ebe67a0f0a9cb0e2985b5c1a1d18b85c74c904f0625ca0eeae567e0cbaa9ea19422480fb9ff936890bff4c8c1d694b8c3708ef0d739e89215c327d51fa560ade7bcddbba242ca0b6d00c8d88221713b8f66bbab061608f4e7d3b74101364393c462f1e409d095e92b630fe6bb43e7b89318dd1e6e30522aa46ee261086cf777139fdf15eed238882704a66736691642a9c9c2381108b91913e0b8988fa5318cb0c66b2c24d3de574bae843092cc56b691946f8903c4328f8235491a5853d0221db179ecdc05ba9528a8b1a4095a9189749c75fb0d2a86217223073806cf68b2f3ab4933b368aa8a327dfc2dd13785b68e08a34ac0ae4aa77e4fcdd53cfba5e36db89e71eb62a5786080166c8418585eb965a7a1f9e9299a628616a4a9c949c70d87bd415a5eaad25047e7927a7bdaed093e6cf715e0744992e496507f2e488a2cb9fdbb7e11599776097d571e7a76596c77d7246f4291e7ed58449e21dab22774b025a371ef772cc98f4b630ee4e256f21e658b63435c576f144317465b2585bf616169ce0771fc44b33a246fcc0c6b90b08922bda90500c6fe60b26d1649acc9df670fe6c6c7f900a02676d3809eb3a07b8aa8717a0cd38ac9471466cb79903d1d660ceae98f37ed4207f81edc5a46ca5c9d74cca3439e9b3c79bb1b2c1b12638558757bfa54963097c70975cbd846db199144d3362ad883aea2ce0440ca0974d73f78d3796c86ec35770730795d18dd077aebfc13712ef3c7f3d59bd4976937748f720a16d738d246af25a830e95064f2b5d76fe56d687f882c8357c04b4a683f0cd46ba900687f182de5d7cc523b11529c2eb2fc055a9d890a40ea0b860517c428d7de3a40bb7d9319e66fad607974050f2bd93bee62123170171dad9676893a2e1f7b06bbed0763dd14edeb13e8f63e6238a3b69997cf7c8849c9d079f4286e7c2b6577b462019fd6f2d3de41c913757a6d15ffcbafccc7e137ad27245326a26f9479076338369aa002584e740ca90a2bc44d4d042396cfa3005506536de699628c47052b7a934193a024216eb4dc35bd798e35136876e92046aeb748891d3645b628a18d667717df358a6b075badd450433d0608fecc255fdf5b009b7aca46e446e1a6a8a9c7b56c0d302d6e0bf5bd7f9cac8048496bd97ea5e500e3ed0bae2679400a6fafd67bb5fdcadd86d9430b89dd82a6408eb84cfd5ad17dafbff3afc48781686475eab3f59e59325a4f6acf6622b107c4b3418447c3afb9746df13156597a841e4eba09c3fa92e89aafa4f631340fff504ec19db45c4336653092e3f9d059fd4e0fa13cc3a6c44039d66c0f92eb7e076fa1ca462df8dd9605b6893928fc5c9d1c852f083af01c8f8e16718c2dc2e7c55ec24c89a1f65d8dd4236e0a63e9dbbf3958d6d0f412dc5171f42e6fbc10354c05f26903f400b66dce28843335a430462e1408ad6ff3c73d7af90497deb7303585183fce2c35f0f3fb346903e14b2ccc4de630c42d6ebbb55765c767bbb0fa254543d6417077294b3fc1914e22fb86f12678d122d2f461bd57cf06acf309af7ae2f34e8939ca4e84e6fbb082845d46ff3d2cb42f442dc43e967cc76e9bc09b0287683dee898172f09b91c3fa3170398840a6f9e0a9fff49909d950b718c63ee7ec9dd6d68d2bbaee22f2deb1da9cdd1057cf66ef839c18956186833f12accc6f57eb98ab7dbda25a4541aa84d77115ceb2dd44e43c9da63e1f79bb8864f2384b0f3ec6af2f489db30607509fab98d993b2663629ae9fe17166ca61d03307a0654708c56f2abdf346459a529a9b2197e9ae17923006d7eef836e1ae0ea05b93fbf5eaebf9d50d1aeb90919b643c57ce936dbba2efc0848474f0943e84d82e8830ffe4b5e3d472751f133dff29e402b6159fd89579e1949888001c074eb7a120aa59ad61f17981bbba4674f54c531bbb3ce15a0b1dbec42545d094d000c5c1634fee0952140e9f2e6fa950c3bbb57d7743ac5f1da9ebc9aed0fc914f3396de0071d1ac7078968f00e8761587873058d0ae87c3098cd4580931b7760e588f5d432d9f100c544a6509c855553657b6940520e532af8e49d6e00c99b00100b79878ea71f4518ca7dc472a9c00bb11d1ef764699b9389a99c2312852aafd81d3ab8829e27403fa85e1c646a209be5ba09d04fe74e8359905eefe2d2cb199f5860928f78b785dc028d46df4beb02ac70b0ce8b08114f316e9f19c9902121db937141d2d65ba4554e62e0258986eaea27ea3edc199d6b5aa06b0d3f70331adbb4a194ebc17f8ec898aa7f266b0945f3ce2f7e74ebe624ac1f540cf26a34b0cd4039341304521283753bfc8107a4998c14bf28da1261edd7f82ba4485c560c88f6caf92bc9772909e111504eea28ddf623f2ddf26faa2df536d084c58a77cb27a80efd3b391d64c434712dce03d67f882b5c64c805a433f40821e9390351cc3c21851a68c992311291fbcc78b9e5daa4270e120b9816be50b7c9c6550f3fcc7c3d810d762d4609fc5b644a0642b316cc82eb0bbefe9596387869e7737dd2538c1087cfc5cda0d93a346a839437ec74671669bc7ebc4c05c8a5ddf127d7e7a389fb93347f7ef57c4125f77a492a052b1c94200a7df839bd3e3e4c79f79230a4ee1ba1f1924ca5f35d057fa07299165dc38ecd202fcc3aa28f35179a029585ea30f8876f3dd299a5c1fcf002c5fb83eaf492bc226aefbf800f8cbe824c8b4b8de70efd4337d85dbf2a1f207d967b3c49abc8212c532952cfc7222b9ad04faa9dc97035fc828c45c9448d528b282cdacb905864c1cb50d9cf40b176c68bd751d78be4419162a99bc674defb07e4cf108c8894f9fa542dbb6cd0ce2ce9db41cdd9131207162f25601e47b8a8d74db667b83f82ca8bf6f25eded741dbf8667da2999ec2571de4afff5adadfc8056cc9d138cff651dadd19f799bed8a26b4c3037fd7fe09df7639e0265cf466a4f9be8e298c1a8f3f79d1a117e25dd490a0074dade48564da2a8a43978659c5bb1e4172e165ef7ecf0d8e1cffe83bbf561723eb3b5b523215d99e65216a51d7cf6e6ee97315ae0c712784f21cb136116ba92e71d5e7e65d48ef9c59315cf716de30bd37636b4d24cd95cd443b85f962d5fedca9517fd4d5d0dedd3b81b6772a25205da959d6bf9efa9e768b0f1e8989a44f65cdda70cca8d77c61d635c447badf8cd2f71ddec4b0d1ca4c49673bea08343643bdc9982538e25c4cb57c44ee11f7ad3041fc3fc05effa85d9525555183d6d62c5818f614d7f05c413572312496faafc3cfd2bc4fb26202389e3f363fbc80209be960e5a5510b9a36f4b0a2ab9a41b24320adc258df2a8907a5c521d990cbf5fdbb55ed542b56925e3240dd98a284f4cb48aa66033620ca13d3a72f0cf84ce2fb76bbb26e6c7b1be79ba0a32ee3f8a995fb21acb1f", 0x1000}, {&(0x7f000000a900)="e6eb1bbc830ea3cdcd91212ded1546916dcb63f10bdc5fe59812", 0x1a}], 0x5, 0x0, 0x0, 0x8000}, 0x2}, {{&(0x7f000000ab40)=@hci={0x1f, r6, 0x1}, 0x80, &(0x7f000000c040)=[{&(0x7f000000abc0)="9b5f407947d139c8edf866859e72e802fdfa8419bc59ece98e45f50284c192de1d1abea0848762a47fe14e179b1ee77a7bf0ca7ea1e93432027286caa397e3a7a4669a3c9112e8c50f4b569ee297d4890ffa824e148910068d89c9be4f58d25e03add11a4a1ea2534f65e75edb1cd957a3805df20c1eee2da421cef098a40bc5705a76c793f4e1a0cdab5c83c2fb4fb5828ecdef4d2968b85146bba0981551b9d5f19800ef3ab277c0a4cbb61278e2d55a8bbad05d31fb6817433e1c4cba6126d3a98baf6553c920e4b261a2ebf1413a15dcd3bf765a904041", 0xd9}, {&(0x7f000000acc0)="abe96fafcdd07ba552d65c3d479cc0f5014c5cb341a9deabb8de7cc72907732c3e1b64cd75f39380bc1ea65d06e17d9e4c21d304942e475ed8c5370d57e6befa9a6de455e609cdfa4f712c39c3eb1a38bae457c03d0be454b882d4bfb16db50732029189cc80ca601c0de224dbe9da36bc8b307eec9ac378e39ddc753dd568b9fa27138281dd2af42b01d41d22314d5f310ef856a167e8aeb3cd72307814303e222afdf9d176857db50924dd2729fb2146edbd4833d31ff757f54260a592beb3a7", 0xc1}, {&(0x7f000000adc0)="5f7fcbca1a11248fd974d09f94fb101abbdfaf2e0e4990c331631417c13d3287f17ebec5ac82bfed11a7bd9b6f69536ee63384400e3b957e8a0a9685b0c57b698a62905e66d78ef24de35630339cb9f37efc87e76078bc23ef05167bff343a9b3dda0890c684fd5c6743ed5e47fa9f727142c025a1ea0bbba3974e49023d2caf6479c65998cb64a75fdf1941cdee89d0ba5d45455fa1c7f019e8ede2da77c38d60360e0dad5e4e424c8b952b4e84819f2fb40b8e25b2014b52586be8a9aa", 0xbe}, {&(0x7f000000ae80)="2c140a4a1d66c96da45b062ce329107c05f6e74d18ea63621733d121c3ec157060076c351571f212c72bcb5d0aa479e99cf52666ea3b264fadf49eb82a9561afce0fb10a3fba52abfc30a04b7b5d54b9e2cddf532a18b118a23220f7675a13c78df9fa4cb19ddf2819c1ef339a94d6074e70cbe39baf630fdf9856407a2fc4c95cfa1835f0db6329e68e5881007afef85751dd87cf8fdf390884ef4584558ee416fd762113f07cc7bbbc29f4e20a9427f8ab65c2c1ec159fa6603919a921721cfcf226786a0af06d04393a3a4478428c37393cb4290ca6c054a0c52b3c9d56a03502971bbbdf0e8ddaddef2e362b04363ee2c7eb29267749bfb7d347b352f692c335c7accb0f072dcff6b80a7caffaf9248becd0822abdaf2c9ef574113810194aff46597a52ae4e7c50edb678842a2055b4bfef0ad5235fc7ce5dceef9370fab3fc1134490f17102ae4b02ae8a881fb7247f34ee6b4f72714b62bc75efdde31e4d6f9e028483be36602632eefbdfb7baf3badc7bee216f35958e41a3193664d8ccc26d40879d78d0a00de44fdc36398e954510d785181f5e89a352dc6beda7dc3226befab5e685409a819eb569e116e94440cc0b1d621e0dbd27d672769fb13e6bd57e881affdbc5d41cfa36d1707a5a13d01610ee994fa048aeaffb6ae02a41c959f13421b59891785d461e4301c53271d630fd8dece14a355dd2369d269df3fcea94be9858dbb371dfecee626c33953e8d6b1b886b39e7b18f9f6372b1374bf7e23b83429899dc96e6ce4fde1f26d5e8f5fe7216a6b963c5f2a657906e4612f62621d3d4d21aef5f31de14f8ec325064222c33595616f7c138d5b90b486ae0f7c9110b4b0229c821be20ef16f7ae428cc2412cb8bab52163823271b052d5b821c71c239b0f5dd1e25b5eebeab7d0342b332110f2ec88581a9b909da5e7231a79a5e91c7cafd7e2589e5b08a1a78bc4ba37696075d770b862aa080456a669f678e91bd5d91ff3ba2cb0617fcfd704a84b1a1f397e5bfdd55b3814ad232e064a0b973f13d71137a885c0cea7ab4a65af5fa1d6ea32255620e06cb58b7731532509e3f770055a68ad0cc49bf2dfefa618aa5916a38fe25341c7137a7ef5942c02c796141bca8f4b8d7b6533d6e7ab74badfb324cc4dbe9de3e8e99a88253812870f5ab1ac630f845742b8d61907e3d2243f74d8c43b597e065c93ad0334620865bceefedd33cc23066341e0a0b8aadab39fb4c143b72604f3b788ff3470289c4e46e259e647ad928a304ee9cab45268210410b7c985d10bdac7cf3a5822fa531ff53e77c20273ff36a32d4a2b15b5ae4789ae84446bff21134515144ae694c5c9344849edf4240de0dea588f3e40e515db145650a07485589386e637ab624afd16aa85a96c6f73cade33f87f0d35cac9b8f2c6ec42bf67fb14bd8ad2a95432697c61eac8cd0b765f0b27f221f7c9e1a9765c5ff14d2135825d4d3371292911e01ee28d121a36bb8275ec14a4bff6ffe3fd2ddb702a51a2f942c2b509eb711ed4e14c0f74681e65016412f07ed89ea6a945d40583f995449b9b524ef734f95d7cf1ed433612d171cefd639720f6f77f736f3180a77486da3e495f2b55361ffe6d295cb4813dc51029bda75d8dd53a6fe85343564609d0111587ce6968a290a756e4725f48c9b90b06b0ca5e43334555ab7321161d118197bb06f88e6456380a69610aab9df4685c752d165f42b4284d7429b756502a8a955716311173956c9c67314dd78f019551a47d4975a4e228658cb049bc95d835f4f573973dd2dd8067726416838eb7403d8c84fa6e14ed21117d0cf3f8f2264417fc89aba8388b5e694938081abc824c5dd74e63652f6e9a749691c0d525f8d9131036f736e6d79f5b9f9c711f18e13dcc2b554fac2fbd91cb14cffebbb297bd8073082f6ba7f2edd0f748854b05d9a01f1568e5127cf52e5be82282577b3437058d3f350b877939b7abedd0733c4f693fb2f49d9d99cfed6bab695ba9785d27a34eb7564fdfe05762e0defe5d1c76011685401530fae6e0b3eb4d32fea3fe609970cfea9a928a54ccb079620fea5ad4b2feef250299ef04e34365ae1ee61054b897eebc0aa6443dec32e34e56bbca03b2395b05cdbdb9bcefaca93cc96fec1153fe2170eef8d3885965df98c5dcbd17285e284739ee2e3765e00d4c5bc94ea95171ded53f1c7e3a7ea4c29191d735662225e7e13be7797173445e8e58ba3008a5f05e349b1192b8978a41176941946ba3f1442f77441ca1691392635d62d84839e1e8e0215584f0fb4775b9c788be0d1d8b9bfa506371d3964753a77698270f237c639c563ba5070e79caaf9572b1f0ba7b7953d9ca7e791cb5d9c8419d8ef2628275a9a7880aeec24cf878d01297c2280860a7d5287d8700a8b4e38257b2bb9db1d88f0c64f4445ca4d8906811756f2e97d4670b91890ac83be1f90a83703512fc5e1a7b38b9ed710da019305cab217e753e4b49dfe0b42540753995608bdb193a08c46d704d6012d41e09859229f81703c87fb4223d2834cd87f6b5d75e54d22f56b6ac8f2738a1c7eab8ea5032aa1f7e883d18f345ccafa75c18e1bc61cabe3956f855d05315d8a592351e595082ad223ad4d97d3af84547d4fdad427788611789810254c58313cd2a15f114a215d5bedc56f40f77956d073b6eaceecdd50aa6374432dcc1da1dce506e64f8e584e772e0c9ccc4d5199da03aa0d48e4bc500f073b03ab06ad919b926f8e123db5a1db8d121d96419d602914bb32a67cf17363037cc4fc7154e7f492dffe95cf7d1d00596ea0b01934f2c7f272f0c9d487bfc6ecce0ee85ca41b6b50c553659ecb0e7069afbb44a262499da6949928d834e6f36cc8e2a2a364394033fd3560c62a1615a4f39bf5350004c5f061dac84f3c269e7ee63123e770ad8ae3096e010ab1152c25458509b930a7b0775099efba5ea410d3b92e45d3132fe92f6b2d4abbf1404193e24b50f8c42c182e25ba50b6ba481ce9329ccac06945e25e09ada6a599fe6895fc270308c2a64211a86df3fbef487b3931b737249f6392f98cd45e155f0faf188722bab4d341f7b5da82995018b7545a67bda5e7d6ca4deb7a3e268faeeb74420eaf45752d4edab1c835bb96b153b0598f3775d55141d784b133ce975eda3d22b882fc09bac96d3f0a398116b1b4e33a2ed25b109a2c9f72ebda2be8e03f776c2a6ab6cfee6f68f7e4df3c44c4e325db04183bf39e87092533a5b2950ac57d0dea1b6a8b237ec49e7c22b08c7ff5339e95b9eb398ada524f06f2e22f322593e4ef9f49c483f45baa73a1a5145be0eb0dccf91098905181c20a665491c245f80588572c511577273cc8b135f86d94e0ddeac9503709f16e08b67eecf0383a74a4e474b0ad53a61e51c967239be2ccf3d3f0b5297692ef14ed905d711eadd730ff1ac0fb93ef99e95487a89a7ac132951eade427ec126dab1b17b027a18aeadb01980f91557c3b478dc64e559f15b0640c6223fbadb66a117c00d98fdcf41d3175c8c03eff3c21c59e7f70109be8093da165e64f09bb87be641549c7e95528d2ffc6eb2fbcba6420397024bed838ef46b26fc57154517a01d885f70ce1f6907037e89a69d953c7abc467da22b4187dd8e9c2d69ccf732801a48d01e22da9805ea23f55d3102c52dcd54fc0d779df090261e3c7ebfddfef5510fde9407012dc4a8ab911ab72d22e08166b334e9988b5a2b0e82b0a809a65bb14723987501e7339e469d00e603bcfe1dfe38ece1916c6a95ad6186c314aee8917bfda61d4b10ee24958fa7e6a2e535675877007cfb2beaaea2d50941eb3d8b94481c2548bcb02c68769fedcfc182a9bc0d57866d1e997d41d9e52cffa9b5e89413b6ce3ff8d7e465023653cce53f87bc9e9f4d56f157f56733d0ff4ce52cf2b5262dd856f9b9711c4d410ab225ba34d88f6aea9e090b9833aad7cc2f676f85faa7796b46dc3ad314561b54a9e932c2bca0e319dce45b6f9ff7f6e7fbb2b3b5c6d082671718e5590916cbee05788e0570bee1e1893d29cca7d748a766d3cbbc5b8af6ba9b7b956752ccc9a87ca6d38e739e02a3e056348a75e92f5054a09eb433bbc2dc8496ef5c38cdc42b63dff5ef4273722c5f7555201df9e5509894a9e0ef8c2d5bdf04ebabb98fa2fdce03596990cc964eebdc59c1cbf4279930ebba01550dbec01da05bac4334149b1b985db158205c7cac220bbe0a140ba35e6ed7633524fc2689f1c5e3cc8825ef023a0b9a042a85f08d6bc815247055cebcfad68e60c175b137336466e71342893e4684c23a30afd48569220b5bfa90c0cbd9ff6ce55491e4024db6bbb1b4a4ec24f31ce8615e8dd25ca1e27b9a3695d52f108b4a83ca39e1e91db772cc2bfae6dabdcf0c9cbdd18b2597acc06f677bbc8abdf47446c55b5f77dccb59c8168943720d16cf535ed6e33e2a6f008e4f23dfee9446f016d30ed1c2495d3709ff90cde5901a5bfab15dee1e0c747df866379122955f103813929507f87b3f44135716525dc17634ec9aa4f8d09411c9f50d61dacdf8aa796f609d5019a1026d5c0edec652cb3b670941a859a9fb87bac5e4bca4c1f40ff87cb8d27e9455a905a714f2a71a6df4616d10deb7f65c5b912d0ee804b0229d1602d1a23b9e59ecabb4173b70a12f3ee6d8c2f2ad631e1308bd1c83747bd2180b5755f89135968b81fbe85f814e82bb7a3cdaff029bcbf79597e1a496d9dbb0fb182dcccb3486477ed08962ba6f9847e823188fd340131ea69c2b47cc07b08532c9962884df09c80db1722de244f1cd04b1aff9688374ff04a0e3b9abe2921076cdca1dc079fe8356a9a3cdc820570291faedebb61db9fc2e00e68b7f9845e12b7d18750603657d94c4553c09b09ad0ce1af51cd330c423168cbabeea1e191c012aa7351f8d37e7de939e8a07ae5b6c497c1240f484a316ec9cac637e6507fef729e5c63e480533557ff1479c99b136836ba81847d3b573a3eaf8ad8650fa5d818ec8f0e2a3a215ea332addeb5d19b369ac50bd7f945f25e0d24d47272ba2854ca599df92080f61471d58371cd22d2a3967d3021a9cf4a09f8d9f46ce59b1b7e0766264f0c87f9780ba87e3dea173e0db8008bb38934aabb8d39f465c91fdf8095dd550c238a6fa32e8266a8d50caeab5e19e1b91a7eb65c39d713d06e1b1d7219596b2471f3f26b3a88d07acc7caf46f039f27bfa2f498baeb7fd3dd536bdacdcbdbd6086d90852828e6c1494ea5e29efc083e0db3c4d5e50f81dff9fd25e19629796df89e8a8d39a0d02ccb00ed6d7bd80ee5608f8ec63602728c1e4d9f7140574ed58a51bcac157c6992f399c002af551704d3b3c6fe998c1013dcfca9ea4a1501af10c312f986fa004b0a48c72f491b33c1c077b56c0bf89504aae4089222c94aa1d62097cc81efb0149af2670a8e8e4df2898e90ca262cdafcf910e126a7f23952967045f948b48046603c4e1225f0551a5b4c2410c48fa38b94013e8ae2ac2343599280f55fd00e10e78cd0e4d1cb4f82b3e14bafb74e6c9be65f68d5420ad92f5127326c60abfdf28b899d2b14fc95994d1217d4be944c23e08878c50c9dd06b5b45ea7269444e3a42769b53fee55aaf161c8c3622546fb2c9f9d4d7ab35248c1d167cd186573d6323ebcb29924623e2f16d9d8e2d1c597c0f5e10643a45f5ce5e5e12e46fdacf3bad7550306c2d4204f3444eebadfc08e92b397aeb7fc8ca1e0838305ac3eec81ac477cd78044031d4e0d5e6298641b8eb692465c85a", 0x1000}, {&(0x7f000000be80)="4ff85e94ffa9829cb30551510e350a3e25793683692e522f79a2f15e3474548c3b8ec1e54918737695ab4764914f0a81254be3e9e3406107965b99cfa0eee037befd620e44ef6d8ee9adb4a8373369a2d8b8", 0x52}, {&(0x7f000000bf00)="ad18353b8a121c896aabe28bc34293cd0f86896d1389a23d160cf3cc46c8d2fafff1cc4b3c407da276608561ccaa988f45772bc554685446145808ffa5f1a345088aabcc406fa4b0d3351de7bd17be1f48befc0393e489b84951b633087b3f6ff7954444d5c3ecbf28f86b0130945036bb230644d9537f67da6cb47153f6cdd0efaead8f18501dfb47034b7284c9761493be5138d01b19e78706d7d2cc0d166a44cec218e95863a17ead2a736a6220c9566e84eb5791e0a169d6b1e1ddbe95967236a1ea527791", 0xc7}, {&(0x7f000000c000)="9590e2264c00d2c046c9", 0xa}], 0x7, &(0x7f000000c0c0)=[{0x40, 0x100, 0x8000, "50733f96927992ff1b4437446ae3e48b6b4f5d8be3ebd3afa1ae74696d07d9f41773f140d77281d440c36f"}, {0xa8, 0x101, 0x3, "a1aad65d34701b8d69bfa70c809a4f3930947668a364123f10867b465208994e656df791bcd285dd6f2732d10b2d04de4b016957b19a7f9b5174541872379c2440700055e9fe326dce0d8ce4a45c6c6826949279a3de6675dceb6ce920cde200d7e854c1457d190552e483de048ebc9f5f1d3845c8fa5cc65f111e2af1232a6b4f0356f71a68febbeccb8346874b0ca8c74f0c1423"}, {0x70, 0x18f, 0x0, "9e9710f8903c23d37de3fcbccb269638350ff4c12e6f65aee3163b83e3bfeb61fed9dfcdd34908bbec7f432424697e6b8060705c504a3a74f0c740b79ad2ab67e0f12b61caac9cd0f590b526e5d43c26ff9a0d0869178976a71dc4424f0c7dc0"}, {0x30, 0x105, 0x9, "01c915ff6398c33201d781321da22be2b3cb809ff88dee47fb23"}, {0x40, 0x112, 0x400, "50b93494215e94c0bab9e1ac167f6b0c306a52e062fe8c8a53fc49b9aeaa1be3e1ad40c63ade941651b8e50ea53ca1"}, {0x48, 0x0, 0x4, "355d0e60a34e49da231227b194985cafa458f711e5737540446eeb000b679bc9f63192cf1c223973ded87fbddb358980491a2f956111a0c3"}], 0x210, 0x8841}, 0x8000}], 0x8, 0x2000c044) keyctl$dh_compute(0x17, &(0x7f0000000180)={r1, r3, r1}, &(0x7f00000000c0)=""/83, 0x3e3, &(0x7f00000001c0)={&(0x7f0000000040)={"6372633332632d696e74656c00fffffffa003100"}, &(0x7f00000001c0)}) 17:54:44 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000600000000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:54:44 executing program 2 (fault-call:2 fault-nth:0): r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00'}}) [ 1060.524005] FAULT_INJECTION: forcing a failure. [ 1060.524005] name failslab, interval 1, probability 0, space 0, times 0 [ 1060.562556] binder: 581:582 got transaction with invalid data ptr [ 1060.576962] CPU: 0 PID: 586 Comm: syz-executor2 Not tainted 4.20.0-rc3+ #128 [ 1060.584183] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1060.593625] Call Trace: [ 1060.596243] dump_stack+0x244/0x39d [ 1060.596267] ? dump_stack_print_info.cold.1+0x20/0x20 [ 1060.596298] should_fail.cold.4+0xa/0x17 [ 1060.596320] ? lock_downgrade+0x900/0x900 [ 1060.613358] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1060.618485] ? print_usage_bug+0xc0/0xc0 [ 1060.622561] ? print_usage_bug+0xc0/0xc0 [ 1060.626657] ? find_held_lock+0x36/0x1c0 [ 1060.630757] ? perf_trace_sched_process_exec+0x860/0x860 [ 1060.636211] ? __might_fault+0x12b/0x1e0 [ 1060.640283] ? lock_downgrade+0x900/0x900 [ 1060.644428] __should_failslab+0x124/0x180 [ 1060.648668] should_failslab+0x9/0x14 [ 1060.652459] __kmalloc_track_caller+0x2d1/0x760 [ 1060.657119] ? strncpy_from_user+0x5a0/0x5a0 [ 1060.661516] ? strndup_user+0x77/0xd0 [ 1060.665326] memdup_user+0x2c/0xa0 [ 1060.668858] strndup_user+0x77/0xd0 [ 1060.672478] __keyctl_dh_compute+0x210/0x1e40 [ 1060.676963] ? find_held_lock+0x36/0x1c0 [ 1060.681044] ? lock_downgrade+0x900/0x900 [ 1060.685206] ? dh_data_from_key+0x3c0/0x3c0 [ 1060.689558] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1060.695111] ? proc_fail_nth_write+0x9e/0x210 [ 1060.699632] ? proc_cwd_link+0x1d0/0x1d0 [ 1060.703725] ? __might_fault+0x12b/0x1e0 [ 1060.703744] ? lock_downgrade+0x900/0x900 [ 1060.703763] ? lock_release+0xa00/0xa00 [ 1060.703783] ? perf_trace_sched_process_exec+0x860/0x860 [ 1060.703797] ? __lock_is_held+0xb5/0x140 [ 1060.703825] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1060.712008] ? _copy_from_user+0xdf/0x150 [ 1060.712032] keyctl_dh_compute+0xc5/0x11f [ 1060.712048] ? __keyctl_dh_compute+0x1e40/0x1e40 [ 1060.712065] ? lockdep_hardirqs_on+0x3bb/0x5b0 [ 1060.712090] ? trace_hardirqs_off_caller+0x310/0x310 [ 1060.725618] __x64_sys_keyctl+0x17a/0x430 [ 1060.725665] do_syscall_64+0x1b9/0x820 [ 1060.725682] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 1060.735359] ? syscall_return_slowpath+0x5e0/0x5e0 [ 1060.773012] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1060.777875] ? trace_hardirqs_on_caller+0x310/0x310 [ 1060.782903] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 1060.787919] ? prepare_exit_to_usermode+0x291/0x3b0 [ 1060.792948] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1060.797824] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1060.803023] RIP: 0033:0x457569 [ 1060.806220] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 17:54:44 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x28000}], 0x1, 0x0) 17:54:44 executing program 1 (fault-call:2 fault-nth:0): perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) 17:54:44 executing program 5: r0 = perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) getpid() fcntl$getownex(r0, 0x10, &(0x7f00000002c0)) getpgrp(0x0) r2 = gettid() r3 = syz_open_procfs(r2, &(0x7f0000000200)='s_rollup\x00\x00\x00\x00\x00') ioctl$VIDIOC_QUERY_EXT_CTRL(r3, 0xc0e85667, &(0x7f0000000340)={0x40000000, 0x100, "43124fcb27dbc4093d7460800d019356d23f1d78237211454ecb67192edcb583", 0x7ff, 0x1a93, 0xfff, 0x6731463, 0x8, 0x1, 0x7, 0x20, [0x401, 0x2, 0x1, 0x3f]}) r4 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/qat_adf_ctl\x00', 0x101000, 0x0) keyctl$dh_compute(0x17, &(0x7f0000000180)={r1, r4, r1}, &(0x7f00000000c0)=""/83, 0x3e3, &(0x7f00000001c0)={&(0x7f0000000040)={"6372633332632d696e74656c00fffffffa003100"}, &(0x7f00000001c0)}) 17:54:44 executing program 5: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000140)={r0, r1, r0}, &(0x7f00000000c0)=""/83, 0x53, &(0x7f0000000080)={&(0x7f0000000040)={"6372633332632d696e74656c00fffffffa003100"}, &(0x7f00000001c0)}) [ 1060.825213] RSP: 002b:00007f2a88a57c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000fa [ 1060.832930] RAX: ffffffffffffffda RBX: 00007f2a88a57c90 RCX: 0000000000457569 [ 1060.840205] RDX: 0000000020000140 RSI: 0000000020000080 RDI: 0000000000000017 [ 1060.847476] RBP: 000000000072bf00 R08: 0000000020000340 R09: 0000000000000000 [ 1060.847487] R10: 0000000000000020 R11: 0000000000000246 R12: 00007f2a88a586d4 [ 1060.847495] R13: 00000000004c286f R14: 00000000004d4258 R15: 0000000000000003 17:54:44 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) [ 1060.862432] binder_alloc: binder_alloc_mmap_handler: 581 20001000-20004000 already mapped failed -16 [ 1060.896836] binder: BINDER_SET_CONTEXT_MGR already set [ 1060.915626] binder: 581:604 ioctl 40046207 0 returned -16 17:54:44 executing program 5: r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000080)='/dev/null\x00', 0x40000, 0x0) ioctl$KVM_SET_SREGS(r0, 0x4138ae84, &(0x7f0000000540)={{0x5002, 0x3004, 0xf, 0xda, 0xfffffffffffffffc, 0x8112, 0x0, 0xa4f6, 0x7, 0x6, 0x80000001, 0x5}, {0x1f000, 0x2004, 0x1f, 0x9, 0x80000000, 0x40, 0x7, 0x5, 0x1, 0x6, 0xffff, 0x7}, {0x0, 0xf005, 0xe, 0x3, 0x8, 0x7f, 0x400, 0x7, 0x1f, 0xbe, 0x5}, {0x100001, 0x1d004, 0xf, 0x5, 0x4, 0x100000001, 0x6, 0x343, 0x1, 0x92a0, 0x0, 0x5}, {0x2, 0x6000, 0x3, 0x4, 0xba, 0x400, 0x5, 0x9, 0x2, 0x82, 0xffff, 0x7}, {0xd004, 0x2002, 0xe, 0x5bbbf034, 0xfff, 0xff, 0x3f, 0x3, 0xfffffffffffffffd, 0xfffffffffffffffa, 0x8, 0x7}, {0xf003, 0x6001, 0x0, 0x401, 0x8364, 0x1f, 0x5, 0x7fffffff, 0x1, 0x2, 0xc8, 0xffffffffffffffa1}, {0x7000, 0x0, 0xa, 0x8c9c, 0x6, 0x3, 0x3, 0xe16, 0x81, 0x7, 0x3, 0x7}, {0x4000, 0x2000}, {0x5000}, 0x4, 0x0, 0x0, 0x122008, 0x2, 0x4800, 0xf001, [0xffff, 0x5, 0x0, 0x40]}) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r2 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000180)={r1, r2, r1}, &(0x7f00000000c0)=""/83, 0x3e3, &(0x7f00000001c0)={&(0x7f0000000040)={"6372633332632d696e74656c00fffffffa003100"}, &(0x7f00000001c0)}) [ 1060.923042] binder: release 581:582 transaction 5363 out, still active [ 1060.937360] binder: send failed reply for transaction 5363, target dead 17:54:44 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000002000000000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:54:44 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) fsync(r0) kexec_load(0x4, 0x6, &(0x7f0000000440)=[{&(0x7f0000000600)="d4ea5bfd3f13d050139b11e37dcfd38247426cdf729bc29d624ffc2bd1160a23e19cdd04f0635d349adca3cf226de01fe1a26f22c39a1987116e95e35ba329603e34c2eaecfbed8f4aa338e837b934ccc19f798af4c59527643bed031fe64eaa881fea9e0ebcd0750bf4a733ff11129a58227db54e2e106810f08fc87ce8c1df2d94ff215aec929b701535d32f1d003c4125ac38610dba454aac3f43893acf94238d161924fdddccdf268f595c80946b0aacde584ac859d88098506161c41f1c27ed2953ab0183911715dcfd16ea68bdc12f082226eb493070d313abcb49b3acc1677eebcbaaea77542e5aa7ffaf7a18dc7a7909b55502d5f31ad27bf16bd724cb168ca716782e447123e2926849fffea01c1d31a509030274b179b060e743fcbf0d82f5cb80544f8fe564700f380df50ee7a3f827ef07490eb5bdfd85964f919b493a1ec9c8b94d48caa98fb971ee55814fbd04fbae89e084b55e0118d05228de3921ac8110770833465e6ebb569a45e324a077c8c81d5e7d00b9102b7db07c139028454d16b060fe7ced84726ac30083beab801f53fbc870aaf5835ca29e9889d286c0a395d395507a4bc8f29ce335be6f2f89a2ec3153e502466c54bfc0acd87b414157bf5aa24733af6cc722373b55d4f8150b6bc6bacc74045d73666d4a66b4e2a783132f786e0fe46b0aaa35c690ad030b635523d2749ab803a5375979e7e81bfe24b9eadd69c57fc966727e3a3fb3c126168732390efebe696fe5e8a88b22a817a0fcbb3fb26e1a8ed577ebad05d4cfa32b4a02e1a0272e77d30c2c79b2b5dabb1ede76f9c9b934b4c7b89248624cc006b3e5f5641897db02a0ccb7c240dd4cfc17cbfe9d7c9599dbd0eb539a6a4a19934844aeda5730712f84c57a7be1c12890db26fcb83a21d0db7d0b9c911f83b2ebdf669ec2cf945f49289ccb013445a9977c0ce3456ba9932c3c906f6037035c7b8639bc37d03e7d6aae41476b54a90e3e4572623d478d35467e675a19cf5631907068286b92d7fb2b55890165d055f652029e0637d00247337a74a3ae6f13ed43b43d597a24ae536da5d93e5954a7c62808402202f803f314843aa26425c64066c67d916a75b926e08e868fa62868066c2799194a4feafbd453d8a2aad79445ce02ea2c2c13c619e6d88924ad1584bf9a4d15c15710facf2e264d2409f42cbf8f1121b36a149b35261f9fdc5d5feff3d67fe2296788fb2a434ca0cb57df5d0ff2051bce734ef545fac214e812a8ec40e5149c933dbfbba1806892ba886385b9507fe26f0a6df71e5672cd9c38db5aa17cb499b4e68c782319bb16f14c50f24aa44606ec67fbcaaaabfd8fb84d9959afde8cfd41f07e2ead39c149872b90f421d60663d1df3e019d60c32ee46da9f79b7ea721c826e7805b6e96188984247cd615a6fd6677e1c585a4d6190c2c80f6d490d987d2aaf47076450a880ffdc9833069143a9407043f7048d444e67be067089825211fd99e2525ee02c6c1e57a207e12d8ed54e6be53476f3bc022095eb93bc8e232639b3cf83124900e50b55a198f23f070e835f1c8fe746580c70cf20f2ae349fbfe1d2f93659b989dd91b102015095eb11c3765466499293448567a8774b0eec15b81e268841b72aec2ede7778f6b2f177e3365ee33748c950c6d3e3d40d82ef5dc38c4a2abe60e0515ff849b615561aafecd7e687ac4e572d8312a9dee627045a369fc94a57b9650292398b3edf7223ad89921ef5e32fe3bc569edb985fcfd021b0c010edc1b6c5fc003f15ce27be545e397bb47c9840a611abecacd1352218943d22174f2c2344579442fdd725ac996bfa3e872da258652f463a7d7c176dc7677dc943985eeaf2e5eb5d211f778004e8db2b09a517b77042b923a707381b0df2524e80586c2e4de6f921d4cfdf0053bac87498f66d7fecf67a45c214198631273e139e5dd82af08e4ecd33375f160da6673d65574f42228440284178d3da377fb6b22611ab772ccdf20ebbf56779a1bee6f47fc4f5ca4975bd872a712dd81f16f8e2d341d59c2b19e0099fdcd52f9e25ff0d4fac8cb85ea6274ee7772e0388b1186c8a9acc765b0cab88e3a90f47d3fb8f25e428e68907f62d110d8980194b5789855c26fc6c4b9c328eea70905df6c0d890420644fe808979b5d93d99714992c7010de61859afcae6ab014725a590ef03f9ccc20ef51ed93139ddfbcff580b873dd295ab9b6e0d7e8558c8aec7daad56b5dd319a491d939c08ad6d8f9e99c87574320c08e79301894f0e11851a7f175706ea6daa5cdcf00af089f1dcd777d8e5a1f8c0d571600dcc31278d8a55d2f71a7820aa2eb2c69584c454dbcb9b1380b40499fc4377bbe40dbe220329662bf85eb9bf69d1557894d53dda278838a9fdb72a677920df6bf44cb5f101ca034d692761572ca982da89be910fc4e0164df7ff8f843a9661695f0673950481d09155c276cc2c43d5fbae07443f03ea7fb6d9c09b5be25d0116526d4a49a044c81812e9dd878836fc5cd02602662f7f38fbbca5d22bb0067254fe081b37bfe93a411366aad88aa346f7732dd9089f76e39ffc77edd44248b73f7b112cc78bd7df3930a4a82c30c8aad733766b3eddc5abcaf5b957c4ba4d06a8dd978e658fe875e47d6030bcfc901349adbf531d2263a6a4c3e9797bdd2fdfa255343acdfb4ca66d377bce13d2e55bc355707308e90366cc4ad3aeb2a699dde0254b56d54b53cbe9a032649eea77ba7be776472e9684d945501c46bf452cb534e727f28ad8178d74558501bace501faed298a9d7329a2d16c14a614635ae588abe7591c485b641f1b46bd6e4f82fb889ad618b8a224124488dc0e4d8e7e3b5a1dacef304967b859ba4490797aa3f0198722bdff15c7dc6b987a11712a4e1f9aefbd1c0ff3381781a5bad7accf47b8b5db773f793a99f21c552992e54845108f7c12bbc139894f42258eed52f63aad836a24d21055f8c6b94b1c8f96a9cf78c639b5c651248e3a518d77fbe782809360f4079f5213e27fd0f10ed700e1d812a0ff81870688f7cbcb4950286459ccc81cd3569d2198afba4b2f4744d63bf6e536941dac83cb7b1de1423ffb0e04cefb7717d2df8c365eaed945e156571a7d20bbb05378458b4b003f09d5707b46aa208a53fd7b0e466af8f6659f77dc18f3fb12c7a03c03761886c2430396b0b74e775ee0f83ca6c9020c9c2a5b804d22870eb9c966b848eb3886c1ca747804ea93d5c497718a81a8cce248252cfb080b789aaf6e4281ce1bc60cb30e0e8f943bb26bc826c8ce084e04acf7019ea32b56255e4eb632b08fb157a317688c9665b97594db6ff066bc0fe174acee2f349b88c64c12ba3ed97c14928a57e7d8f4f81a199535d8a9dc2949281de61bdaaab6e7e9b5e34185cb0b40a79681076bbc6fbb164799e3cd22010de721bb92c82d6c88d530cfcde61305df06934d5569ca17e2b694587e0ad19a601627cd4cd7bc36a2d539894090b9288acdbcf6bf58ed26201ba1bb87b5854a7bc5a54c6da16d2e4e449455eda79a5ac300d1cc6e1270b50a6eb02069dee0caa3bc855b6f8deeb12a552c79a3a655815c05c096af50a57ef4ae3ecd212de9a1a138dcebc39ed07c57a5e7143706aa280311a437a08538a7ed1d6387d8f8eff4f7be9778c7b412f2ef114b17af8fd51653b223b83dbefcf2ae41adf914defb62b3c3ac3be376ca14d3f4cfb2885f20b013b83b2ef17ea8af4f88efc335683def33f10e12d2094a1f3639a474e2f4b9cf6150a9b390f37769fe90af815a80ff05a532c3fbba9a50f4a4dba5c3bc9f9e5b9a4d39473a702b139736689af49006690ea5bfee69e50063e76b8cde0e345bf6189a67a54538bf3ec746363d80efe2cd0afa9ebdf58669defe42cc914d1ecc0e423790fe9c9605c6fb165167ac7ad922fa7d5bf103b2f8bcabefa5444e0652ac35c19dc78b6a8bf38025cc444c73229be00adf167805a7bfec1569ff10a97374ecb167d6c1340a171688204b11b214e0930c0809c71851419be8203b2814fc560d7e80ea7c5e64da4166603c0fdc26ae18605e4e13ce0c2f89bd0b776fcd17d6ab4a8576a05b7bb4b8b9b9672412d0d97d05f0604bfc76b427da385e15b73649b540a40c21619d85d1a1f1cb3db10d07d41e57bb52441ecd9f5cdf55c41b10a05d584a3c7841000a6a49b705b4134b9e4d0efa17766f1ba3e9d35912d9ce0c1b0b88fda7c76edd1a8d7ca16587da6d951e2670838fefffa7188d2987b34bfb2374918ba619a1f624f535dca05e6f1fc9f563f323b6c9f29e9c2be61f5dcf70a8399dcaa16addcadb734048135f1f90c2c26d8edaaf37a13ed8b9af1cd5059bbd599cf18e6f652bc7db8dd0e1b495f3ef4a81fdd5882e62586baade0df2ac0cd7f174c8662c47cd6bb05c088a0a18efa01292c9e0686b1f9f2f7dd003d2556d72a3e8f6fd9eb93d00ddb87a2ca5596ec90f7826490580d7d35aafddf07dce4ae3eb213da0e5849463c19b520146f5bc2e084cb96bb044648c972cb9a14b12c760b9f7d6857a4f36cd1f4d55e424bf7dc463f9943db34265d40f39fc4f54e4d36f46783dfb861f1e6b3cd9a69e8b17bd400c19abdfa1118e135421f1845a31a9def5c7ea1186f749fe37c81e8418a241a066488d36407aa69af09b09893feccaaa173ebb2da3d1ed99d4f4c6dabf54388f4df97c24966b41b247002e5657ab15b95d2a02c4036e6678751ee73ffcc7c2a6a7f85af714c9341a1a982f1e0070a43626db809a6b8de55d6ebd128a88cbdf07555d65dc291504795b559056906cc51561a05a555af45e9fb4fbb22c8704f14d8d72ff7ef34679291637b78ad628ce4b7a775ee77d1fa7ee6b8afaefa282beedfff32b04c946d6304bf1c68a26435bb9ac893735ca251ea5e30758c97d61b0efc10845ea43767eb07a1ab4b5b14c96190ee97044993ef72e9db891205235be406546d889e80cc336356527bc55b1516290b015dd314e975fc555fd2f4557397ded5d833c5595c4d94b071de29f2942aef8a0750587408500e4b7a0cdac8b8b07b90146219ccf85c76d2e1790a8bb7f44184b9143936385cf3ee875a620c54033efddbd82a403058ef59e969a7bf7eb4748339e64a90afe295fe7387d7d104aa99a1a0f47545e1c817954dc605a096418951ffed0b9f3f077b99378ef66312f8772e07af98cfc2337595408972222b24aea8f015ed41f1e44b6e7296c20ca0818dd784cd715df7803894998ed9baf6aa052b869474c86a2868c548bc0a305e36e5c6669af90d9c44e13c31b3b2edae454c8b7f5d4a380774c78e4475a0f2005a581253285c5611241ce6ba90efead29a96192e7be0e8c7094c197766eb201ef59bf4a1bd61195cb3e8c8ef738421cb7e375b3d2fd8b9c52e42690fb42a20ceda6a89cde3847fd24844ad0f705b27fead17fe6fcdc30ab2ac29103cca2a8660b8b5db41b42551186d9f1206cdfd7daa4460bc9ff3489fdf13d470422bf4ccd98418fc569eeef4fa5eec45960786a47ca51d84547b32941e7f186303f8bb49288b2021144853bfba63787d7e9d09a8bea8cb185b48e67f36498463084055ef4c95a3335862628083928dcd60529dcc4f02ef46e02b8650b3ce6b0abd411a96ab6bffdc894826c410ffdec2cab1c3d682b551ea6cbc493ff697939d5ff9230102871d7c826f92b1ca99d84207f1d72dd7b701ce01cafa56d4f7ddcb95b5b81ad8b199c9c97b104d4bccc868821acb21dcb8bd2f67fd60b204bbe35d54864a9f2fc7", 0x1000, 0x10000, 0x2c40}, {&(0x7f0000001600)="018d167673f1bb23cdc01493b60c050185860e4d903e16037c8c0125409d89c3b73815c80fc615c3fee5fb227015881938f0644ca5ed73c4464f6b1d88f7c90f1f4daf12f64508a9665271d03f54f83532e76d472af09551f9dd0d84723d6910da354d7f8c1cad51ffd8e1aa5eabfda6a6f1858816d826a36dcdb0ffd4a3c019dd1aa2f31163189001553824a277e9a38f3a56706718ca63b9d0c3e1b1d734bcffc994e765cc8c991651c115d6cefae4599a058b0b726b2dd426d21b4e26b1300e926fb0839515084ad8c9fe78ae658e869b7328f1d70d8c76596e70afc5dddd1f5e3e437a76b49110258d4a2958c17f24c9610afcf7e6f714110774f8e47c530e19041a6eb56c5b1463555dc84eda711c29ea6d87980ea2de5eb0fe6651a31f300167f615998a307ae377214436387e6475992e24c2afddb272691ceeef4ce45767c91e12d32fddd3fb798ceb626152dd02d12ee53e89b6b9d6ad99cfec6cf6a5ffaa78fad71aa68dc30894e42af345518e5b9e98fabbc058ccd55f54a20cba459a3a246729ad97e599c17dd858bcbd707c0896ee704f5e2709dcdca047946ef70b6dea8fe6312e66b18b0c0a3df856d1481d54a2c9440a18b35a6ad47f99133fa18084c255f6cf36147cc168e4cae58870f4f0331623e2689c76964e7b9dab6fb121c4dbbf43174ab874041b1ac5ba66678402537a54765cc2e863ccdfa9acebe012a101948a83560d3409778002f8d67eacb6e4088daf62063b8234804fa873e72341417f75d9379317cad717ea6ce8ab11b442e161f3b394ae98fdfcf467e562d54c32e0a50d3239bc084cb67e089e39ce09c3dfa31c933ec36c0e4a2c62e0f4794520a1615777cd6a64a5d4edf17db34d3ab710da96338fe948316eedaa7d66566a65adbdbaa553ef4674dcbc44aaaae7e012dbeef4e650b64a74a168dc0a1f8ffedcf61ab6b099d91b30987dc655655298db25382a0b7435fd4a744dd28c1ec8a970501a44e2f95db915d1254004c52a975de9f9649de713506528fda8ff2a6406534ca72537a1c1180d371f2de6c52289dca623fce70d9a26dc4fd7c483fb4feacfdf136ac71ed7bf32c7c30246f06c1e136cc15eaa2929822f29b0108a462f304bf910d8872c04b430990ed644e70f14184e0cec33a503c690b5f409cb27ef8c2bf673721840dfd7f0bf7b1831476dd24418d7b91e39aeb5edc80a8d22a3533dbe303bb880e89b8cbae8bc488cca6101dd2e4340b527ccd0b549f31ef2e4aa62d441415479aab02d7f6aec521f17957b2c148b6f2d0e6fde35c1c113ac74c8f9b441b9c2ef60dda2acd5f445dfdc4e743c65add38d5d32a8079c8f22c600de4d6ff5ccc6ee13081a283db99e60e7bd61a32c107310b759b15b218b6bda3fea91c00b80defd5e64eca922e66d2408c15277a3abce2e137d6160a2a6173853b0b2700ed489ad7319a463d4a6a80da14ff1b313e92c1e2288ac3ecbda03a4c7752f740a3bf77327eb9167f90e38807f3663466fdb7975fec3522fce457e8866abebd45b6656a4a8aa1ee0556f5b714f2a4306806dd03501a4abb79a6b66f943e86e66ce9c2ec652422635efc1e00bce5937464cdf9dbebc6bd00c0a91302faf0ba28053077bd4ccf2a3e89fb6dcc90399ec443634f4e92743ae2a73d1d2b5f564c85bd221bda8e917bb94b3c9604c7b7d8cd9585e4c00b2ccebedd838d43958216e159ebc24a1f8c2d87df58e0cd6133b955d498cff55d85c3a8816e73705b752220f60e7b5c600fecd8e18663616c120fc6dafff672fb4a8d88d11fef08db3079d49925a5b68082eaefadd69fb7d8aeb8bd7a938dffee3706418b0a732c6d64ac041ce58cc267bdb9e7d640cdfc8ce5ed2186d6fd8df877750b964a10e63e5868aafed94131a3617d08a4efb2b43aaf08891f8574d643ece866eb71af356c039f9231aea34ee0dc1d7727a9cb2566662fcdb282d4757f0d5724fe5ff4c263afea531562467cac3709c691be1d6173fc424f18d3f3b20d8928259dda98103b98fc4e3b8a84d35c8ff346da58c021922c7a8e0338b3ff7579e04849f41eb039fb83cbc1410de359c3f87d3aa21c49f9a59ff9c59df724b6ec87721701380f080760fd79f9e06aa0606dba47468074e9a337f379ad014c436de338e502b12aadfbbd43d2671eec70c5655ae8257ddccdb284403f665e8b99ab0364b89002ffb5bd85b81a46f27f306fd99a1d24f081a8437edec514169837f2d37c009cfe61eb25f1fdd994c6d3743732073a0d2c5162437fe2e5abcc326989877733066337ff45c6096658105c07ee2325b15602794a5b1ed0d0d46095777b9ffa24d7d4079cb95d7071620a16e42813c6b5d1d80cc5d9d44150cd09a658d169f6aae99693cc22a997f57e3e3e4caf773d7c8381bd12dfc96445088de4fda74b7ced90b854602902e777d6152923a7dd4f4467f4cba5dd7fe889cb1cf9aa06c4b9265da5073ab3dda52a4d4b33e3e12b117d84ddd84896cbb450b93872eedb5304e76471dfcb2628e51585878fddbf273e757b0788d286b942c9b7372a194f7442ee6569035ee493ee3c01a07e07c722e2cd996d64337f136a40ea4c5ff4f4186af890954bf6da6464ed4070769824cbc4f2640e5a83eaecdcedd017b21e01c013271905f791ec2809089b624cb55479255dc2ce3be6b803409cf4580e831e2fbe2024727fdde65f3bb65d96c8533153763af2c460ed89eae4476efff28e5933ba10d6b816552e74d32aa20ebd07d5ea0ee66dadd142d4abb91d7a54722b251652bf2bb8edc0b261fb02f8577eb10b1e7316b8b62eca9ff6b56a4c4b94268acccb9f392a687b8020855ad037c930a3dd567743cf18f38cf2e6792dff58bd1c06b8ec0595096144e5073ee59c9502e2123d6da796040c45b43c1dd984fd09cdf77122843b418466428a83d7aa90ee01ccbee4fabf62b8feee597c2326675a9f3949f40598656ba46c8d543144ecc062ae5fb189058eff2ecdde01ee8cb3e47b5db0d7b39eac56313ecf440cbc9887836cb83894e5d3aa162c677f57170bf7c8c921c550b283e96c602d979f63887e6ca83ce320a62ab35cc5244fcce5debb26ad54033954bf96ef77c4891e427429b0606db74d382a59d5015a8ee6d478368f4d1d1549959d2718de12113dd66c505e4ad7a8b1950348ef8342cf738dceea50f5434afab052e82800682764632fcc4a5182ad7745e0325fd18152547690aa9aaa88400dd78b4b9d14f864a76c3bf82449833c6dc2a7e93aa92a0fccda8a3c4e5f0fce260bf63d1f2d2c0232f2b8a4d70d3bd9275fd12ef45edc45a0c144a7b2baf31c8a01fa16969418a6c7670a4875a0a6cec1dde10c3758cd469cb423b8136785b42368c0b52813e363897e6a631bb9d33bef3c61330f83f8767b26c5d80bd65b2da1a844c84df458691fd52ec31aab86bb22c4f5f30cc6b107d3ff687c86d7a0cd787cacf517b1a264b0438df386fbafc81193e89a73bc6594a0c06085f9d38776cd34ca1681de09f5f13389dcafb4aaefd3758c552a697b06693c697a701c7afc2b2172e9a81b3990564bd0f04dc730360f6baddcc31c57d72756e1890ff46269658dab0ea722fc2351117e6684a990e5edef2a5ff7563272b92987611e86f8aef55b835a5b25bc12573b9b954ac165b88444c69623c487785dd7293371a2ac74f38fdb615f89a9bc8d69f1f875093236dba30577098d0d36961024165f2e9cbc63db4f25e13e97b2e321b715da40d53d4a376506695431bcf88678285a8cdc676720b0d7759a07c0110c04c7a4cabb45dd046133a697708b8f872fce0c649f8c5398309a6f9a2ae25cb0bfcb1ad68929d2f76bcbb2f5c380f17437f95137c35356bdea29d9430062413957f3e2a21c2c6c90eee032e95d610d0d2b5295d17a0ba2576ef8b547f10a69e1aac622bcff9ba245d4cfaedc6af686350707ada1da799abef29d5497a56619ab80a1e96dbbbf919fe7701001b1e2f7d9480db3a1beda8b8b06333e096760491579d5bbe63faa43f8a462ed9df52f902625ec9a8e0c6078d72cee969bfbfbdb7d936395044023bad3b22b32d0dc0e231e149ca2fd59401e66fea29c01e1a4a2d218486fd26afa7f0bb489cf1b4e548d6d6e0564ea1efb3940647423856674bfb13b5f35965603c7485fb52651efb89165a3b78297d74557c71af7c7bf4e37e299df956eb323616a349467f32cd0b7968078c332a08aac8293ac83ef96695cff5bd743b32463a28fb7f0e9adc1b97b89171163ca3ddfbdd4a1692ce49b427d363bd045fe2c9cacc0985a7bcf764fd509d26e319dd38a68084f3afc7151412b4a04288df34d69ec0d73597659ba2c46368a218a8570e478e46ba6695e29f7a32681a5f7b25e91925017e0209ca90fd09ca29ff9e226e26acbb6e24c7e172e5b6b712663b3cac41bcc16a3f00aee632352ccf69368076da5a155e2694e3ef43d1fa174a93633e3472f38c6e5f8ce74aade2a4326df5881505602660fbf8b2d95801902b8c6da9293300fd68848bb0dc44bd8f4acf1e20b598392a9af3ec00e6d22936e28c0b4dea2e85d4e2474c4f5d44806b03eb3fb6f873cb96a85a68aefb3e94d96531407ddd4d3f7aa15e8115351d3678431c09f9bdad3409f7683b591da879ddeb62e7583acc245d50fc45516d1f455f9dcaa9db8e044f122ba05ea589c85b99d790826fd5d6f741afde244d2329f720d79c5c6a0b0a9e79d22b95a1c7d7f8e7e143c91ad5119d35bd952ab9b04b041d44bd93c5a33f9cf00a5789db379c24778c2b6d1c284a0a0869128d91db4806278c4058e345edaceb3f887a0448cced37ee00113b70f3598d6026b0021ec0667bf284af50e6ed2256bf4ff602ebdc0480fff1d1f02c558fa65439da4aacdbba5f59d46d34b0b6a6cee6d2444a6d931ef4c89b14205c63d35bdec700ade317b3720012629f4ed19d6ffea26667998b6605f10011ef5ee92e1333990e4ef6d214752fb3d23030715487bddab5e8603131eb6c9c82693531322f5b5c8636e33403b45615df5baeb73ed3daccf029cf96bd3fb688fddff1324d96925e6d691ff1d0e8cd02992c38ff11c07fa845b91c18e66b5b0ae396930789ad14af462d5a58490e238420c5f71f273003064a518c1308097d26865e91acc443ac01bc862cd4c207906963149dad3db9d07e26a0457b8b8f06c117f7a41d234350db2b3e67b06f06df450f58cab7aec02342c62a3487dac6f7176dc876e76b25608ae0f30cb605041f225ff79de8c3b36e36acbf0163ed219a9680aef17221e6cf94b8767f9a63882b4812ee7b72c1faf0c1b6447fde2efd0663509612415d0ccf8a8ab0147c309972e68927f4be108f0e2b4ce8a6f8623f019c5dfb64306ebd0b498a912c1ec07cbb8abd37016e5ccc23485d6c080c6ae6416162ca8a338c201b261b4e6e5001c02bf53ff653bdc8f6f0fa0c69a7b4cb35190e7f767a7879b21f01be7bd6539029886404a044c71080154f0964d5d33635710add5b911b7d782c4958b771d272a6d327011462e0bff0e30aa7464e876e9a9813d838eb94efed98f4cb49c93c9b632c632b22014296f66ee57df21660985049a85fe46a67ec6b554dfb777638a41f838add110812d8767ce9661790312d922f8d3f8841a7f02cc5fcc78708088b7a61f37ac69c9d5d616f499901436dd151883c8382e2d4ff2220a0c3d504e5592082b5b4368434981d5bc58d768d19fc308a44d7b57c836564c9e975f9c46158bc146fd00eb20aff54", 0x1000, 0xfffffffffffffe01, 0x5}, {&(0x7f0000000000)="ca3a9424f54083bb7f6af8a301b09b27a38ac3818eb5dad455f3c13de59ddf81d1fb90ff48033cbc29fae9eb3eb0e7cfff378cd4e91eac083ffcc60acd39d277f76cdd9c85ec98d9888c4a50668b13cfef57451d73284d2f12282fd107f347b076514e5174c6371f6f3b9c31401137fc546e95ddade861afa8f66d0ff9bf2a8bf0aba5b513d74b5f6ebbd46a6d57049297f0729f9f888a7e42214509e96ebdcc568577396f92ec5238befb92a2dc367f61c1abec9c0d029397913c78ea1ee3bfe0ae3c9a8700b2b274b09797954d3990942265e7cb", 0xd5, 0x0, 0x2}, {&(0x7f0000000280)="5af8a83cb99a2c931d1c53ea3b749d4037d39b75a9775db282f252941ec180d3f1cfe948c6139289d33ed029be258c5ccfbafc4b68741eb2b886cd483a13f2f93473144e32a2310a6dc8da4b64da5cef10df26dce8effb9ffc2b9746e7a2e1568c0a801666163d6c84fa878342cfa82f441bb43a088ef902bfc9eead1bf0bf9ff00a7e606be1784ff03d1e6ec75ab10fa6674c5abb1c7a035588491ba8ba89b1af736f5358843cf2d9305b71b03e863b0b06faaf19e9ab8195dfc6b2c5fe73810ac439cb56105bfd251549471e4b4f7cbc3a901e7fbe1a5aecd0d1d4cb8d70256cf9b57735654a9ef6c4f4679beb61", 0xef, 0x4, 0x5}, {&(0x7f0000000140)="58f77b00b526fce970605e413001fe2fdb1501863df765d7e10f534acb59254da992737d1c8e6dfdd063fdb17fe82de4e6cc5aba5fde35601882490a8163db5b7b54aba0f98b7ff05bbf206d5a77d33a3c817fbe488a169038a2c4bfbb2e3bf80cb100e15dc254d9c99cd5ac51535b109a685499ade1aa1c5b140e8c6150f49bc9319ddda4736ad83fa97a8c49796db76def5eb6186329b48c0c1646b6cd42b27a040ca6db820b3667955df8d8a3fd3e7488cc8f8a88e83b485972048c7b", 0xbe, 0x9, 0x8}, {&(0x7f0000000380)="809bb1c2330de0302d3dd9ce62d94fe1adf3a43f6e2654e6503b65fbc6ce0b8c04e4b7dd8996890211e50289c59302d663609715f29564d3ee27c67751255b03a791d8fecf06d728c64e7f924c166f890fe9e9c072234439c484be53947cdd1050a1409c041820e04b6fa9fc7d4f18e96d700045177a695dd0eb3e793f8d72fba083fbbcf61373f310a2e5318eaee4d727b77d4d06c80b2abaac9eaea283beccf23c", 0xa2, 0x0, 0xffffffff}], 0xa0000) [ 1061.066109] binder: 623:625 got transaction with invalid data ptr [ 1061.073920] binder_alloc: binder_alloc_mmap_handler: 623 20001000-20004000 already mapped failed -16 [ 1061.084087] binder: BINDER_SET_CONTEXT_MGR already set [ 1061.089592] binder: 623:626 ioctl 40046207 0 returned -16 [ 1061.096998] binder: release 623:625 transaction 5367 out, still active [ 1061.115636] binder: send failed reply for transaction 5367, target dead 17:54:45 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x160000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:54:45 executing program 5: r0 = perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r2 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000180)={r1, r2, r1}, &(0x7f00000000c0)=""/83, 0x3e3, &(0x7f00000001c0)={&(0x7f0000000040)={"6372633332632d696e74656c00fffffffa003100"}, &(0x7f00000001c0)}) poll(&(0x7f0000000080)=[{r0, 0x8}, {r0, 0x2010}, {r0, 0x1122}, {r0, 0x80}], 0x4, 0x7) 17:54:45 executing program 2 (fault-call:2 fault-nth:1): r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00'}}) 17:54:45 executing program 1: perf_event_open(&(0x7f0000000200)={0x4, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) [ 1061.680166] FAULT_INJECTION: forcing a failure. [ 1061.680166] name failslab, interval 1, probability 0, space 0, times 0 [ 1061.691803] CPU: 0 PID: 643 Comm: syz-executor2 Not tainted 4.20.0-rc3+ #128 [ 1061.699006] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1061.708365] Call Trace: [ 1061.710990] dump_stack+0x244/0x39d [ 1061.714646] ? dump_stack_print_info.cold.1+0x20/0x20 [ 1061.719860] ? zap_class+0x640/0x640 [ 1061.723606] should_fail.cold.4+0xa/0x17 [ 1061.727700] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1061.732828] ? crypto_alg_lookup+0x73/0x1d0 [ 1061.737181] ? lock_downgrade+0x900/0x900 [ 1061.741341] ? find_held_lock+0x36/0x1c0 [ 1061.745442] ? perf_trace_sched_process_exec+0x860/0x860 [ 1061.750899] ? __crypto_alg_lookup+0x31b/0x390 [ 1061.755504] __should_failslab+0x124/0x180 [ 1061.759750] should_failslab+0x9/0x14 [ 1061.763558] __kmalloc+0x2e0/0x760 [ 1061.767107] ? crypto_larval_alloc+0x1d0/0x1d0 [ 1061.771711] ? crypto_create_tfm+0x87/0x310 [ 1061.776066] crypto_create_tfm+0x87/0x310 [ 1061.780231] crypto_alloc_tfm+0x1b5/0x2d0 [ 1061.784401] crypto_alloc_shash+0x2c/0x40 [ 1061.788560] __keyctl_dh_compute+0x3bd/0x1e40 [ 1061.793063] ? find_held_lock+0x36/0x1c0 [ 1061.797142] ? lock_downgrade+0x900/0x900 [ 1061.801295] ? dh_data_from_key+0x3c0/0x3c0 [ 1061.805631] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1061.811173] ? proc_fail_nth_write+0x9e/0x210 [ 1061.811189] ? proc_cwd_link+0x1d0/0x1d0 [ 1061.811206] ? __switch_to_asm+0x34/0x70 [ 1061.819756] ? __might_fault+0x12b/0x1e0 17:54:45 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x1ad000}], 0x1, 0x0) 17:54:45 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000070000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:54:45 executing program 5: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000180)={r0, r1, r0}, &(0x7f00000000c0)=""/83, 0x3e3, &(0x7f00000001c0)={&(0x7f0000000040)={"6372633332632d696e74656c00fffffffa003100"}, &(0x7f00000001c0)}) r2 = syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x200000) accept4$packet(r2, &(0x7f0000000340), &(0x7f0000000380)=0x14, 0x80000) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000140)='/dev/dlm-monitor\x00', 0x400000, 0x0) ioctl$VT_GETSTATE(r3, 0x5603, &(0x7f0000000200)={0x8, 0xc32, 0x540c}) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$netlink_NETLINK_RX_RING(r4, 0x10e, 0x6, &(0x7f0000000080)={0x5, 0xda, 0x8, 0xffffffffffff8000}, 0xfffffffffffffedd) 17:54:45 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb08c, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) [ 1061.819776] ? lock_downgrade+0x900/0x900 [ 1061.832012] ? lock_release+0xa00/0xa00 [ 1061.836002] ? perf_trace_sched_process_exec+0x860/0x860 [ 1061.841477] ? __lock_is_held+0xb5/0x140 [ 1061.845565] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1061.851107] ? _copy_from_user+0xdf/0x150 [ 1061.855288] keyctl_dh_compute+0xc5/0x11f [ 1061.859448] ? __keyctl_dh_compute+0x1e40/0x1e40 [ 1061.864223] ? lockdep_hardirqs_on+0x3bb/0x5b0 [ 1061.868826] ? trace_hardirqs_off_caller+0x310/0x310 [ 1061.874059] __x64_sys_keyctl+0x17a/0x430 17:54:45 executing program 5: perf_event_open(0x0, 0x0, 0xfffffffffffff001, 0xffffffffffffffff, 0x400000000) r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000180)={r0, r1, r0}, &(0x7f00000000c0)=""/83, 0x3e3, &(0x7f00000001c0)={&(0x7f0000000040)={"6372633332632d696e74656c00fffffffa003100"}, &(0x7f00000001c0)}) [ 1061.878224] do_syscall_64+0x1b9/0x820 [ 1061.882125] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 1061.887503] ? syscall_return_slowpath+0x5e0/0x5e0 [ 1061.892446] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1061.897299] ? trace_hardirqs_on_caller+0x310/0x310 [ 1061.902326] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 1061.907351] ? prepare_exit_to_usermode+0x291/0x3b0 [ 1061.912115] binder: 649:653 got transaction with invalid data ptr [ 1061.912379] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1061.923450] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1061.923466] RIP: 0033:0x457569 [ 1061.931827] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1061.950823] RSP: 002b:00007f2a88a57c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000fa [ 1061.958546] RAX: ffffffffffffffda RBX: 00007f2a88a57c90 RCX: 0000000000457569 [ 1061.965857] RDX: 0000000020000140 RSI: 0000000020000080 RDI: 0000000000000017 [ 1061.973129] RBP: 000000000072bf00 R08: 0000000020000340 R09: 0000000000000000 17:54:45 executing program 5: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = syz_open_dev$admmidi(&(0x7f0000000080)='/dev/admmidi#\x00', 0x401, 0x301000) ioctl$SNDRV_TIMER_IOCTL_STATUS(r1, 0x80605414, &(0x7f0000000340)=""/96) r2 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000180)={r0, r2, r0}, &(0x7f00000000c0)=""/83, 0x3e3, &(0x7f00000001c0)={&(0x7f0000000040)={"6372633332632d696e74656c00fffffffa003100"}, &(0x7f00000001c0)}) [ 1061.980407] R10: 0000000000000020 R11: 0000000000000246 R12: 00007f2a88a586d4 [ 1061.987698] R13: 00000000004c286f R14: 00000000004d4258 R15: 0000000000000003 [ 1062.017388] binder_alloc: binder_alloc_mmap_handler: 649 20001000-20004000 already mapped failed -16 17:54:45 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x4002, 0x100) accept4$vsock_stream(r0, &(0x7f0000000080)={0x28, 0x0, 0x2711, @host}, 0x10, 0x80800) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000140)={{0x2, 0x4e21, @broadcast}, {0x6, @local}, 0x6, {0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x13}}, 'ip_vti0\x00'}) ioctl$TUNGETIFF(r1, 0x800454d2, &(0x7f0000000000)) 17:54:45 executing program 5: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/qat_adf_ctl\x00', 0x202a82, 0x0) accept$nfc_llcp(r1, &(0x7f0000000340), &(0x7f0000000140)=0x60) r2 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz', 0x1}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) getsockopt$sock_int(r1, 0x1, 0x1c, &(0x7f0000000200), &(0x7f00000002c0)=0x4) keyctl$dh_compute(0x17, &(0x7f0000000180)={r0, r2, r0}, &(0x7f00000000c0)=""/83, 0x3e3, &(0x7f00000001c0)={&(0x7f0000000040)={"6372633332632d696e74656c00fffffffa003100"}, &(0x7f00000001c0)}) [ 1062.049229] binder: BINDER_SET_CONTEXT_MGR already set [ 1062.055072] binder: 649:660 ioctl 40046207 0 returned -16 [ 1062.067124] binder_alloc_new_buf_locked: 17 callbacks suppressed [ 1062.067131] binder_alloc: 649: binder_alloc_buf, no vma [ 1062.069512] could not allocate digest TFM handle ghash-generic [ 1062.081369] binder_alloc: 649: binder_alloc_buf, no vma [ 1062.112670] binder_release_work: 36 callbacks suppressed [ 1062.112676] binder: undelivered TRANSACTION_ERROR: 29201 [ 1062.125729] binder: undelivered TRANSACTION_ERROR: 29189 [ 1062.146962] binder: undelivered TRANSACTION_ERROR: 29189 [ 1062.170164] binder: send failed reply for transaction 5372 to 649:653 [ 1062.187045] binder_release_work: 4 callbacks suppressed [ 1062.187050] binder: undelivered TRANSACTION_COMPLETE [ 1062.198429] binder: undelivered TRANSACTION_ERROR: 29189 17:54:46 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x89000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:54:46 executing program 2 (fault-call:2 fault-nth:2): r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00'}}) 17:54:46 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000000003000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:54:46 executing program 5: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz', 0x1}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000180)={r0, r1, r0}, &(0x7f00000000c0)=""/83, 0x3e3, &(0x7f00000001c0)={&(0x7f0000000040)={"6372633332632d696e74656c00fffffffa003100"}, &(0x7f00000001c0)}) [ 1062.623833] binder: 695:699 got transaction with invalid data ptr [ 1062.629247] FAULT_INJECTION: forcing a failure. [ 1062.629247] name failslab, interval 1, probability 0, space 0, times 0 [ 1062.641750] CPU: 0 PID: 701 Comm: syz-executor2 Not tainted 4.20.0-rc3+ #128 [ 1062.642179] binder_alloc: binder_alloc_mmap_handler: 695 20001000-20004000 already mapped failed -16 [ 1062.649072] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1062.649081] Call Trace: [ 1062.649106] dump_stack+0x244/0x39d [ 1062.649129] ? dump_stack_print_info.cold.1+0x20/0x20 [ 1062.649151] ? save_stack+0xa9/0xd0 [ 1062.649176] should_fail.cold.4+0xa/0x17 [ 1062.649187] ? __x64_sys_keyctl+0x17a/0x430 [ 1062.649202] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1062.649234] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1062.660268] binder: BINDER_SET_CONTEXT_MGR already set [ 1062.667849] ? find_held_lock+0x36/0x1c0 [ 1062.667888] ? perf_trace_sched_process_exec+0x860/0x860 [ 1062.667909] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1062.667928] __should_failslab+0x124/0x180 [ 1062.667949] should_failslab+0x9/0x14 [ 1062.671103] binder: 695:702 ioctl 40046207 0 returned -16 [ 1062.674149] __kmalloc+0x2e0/0x760 [ 1062.674173] ? __keyctl_dh_compute+0x49e/0x1e40 [ 1062.674192] __keyctl_dh_compute+0x49e/0x1e40 [ 1062.674211] ? find_held_lock+0x36/0x1c0 [ 1062.679945] binder_alloc: 695: binder_alloc_buf, no vma [ 1062.683014] ? dh_data_from_key+0x3c0/0x3c0 [ 1062.683033] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1062.683049] ? proc_fail_nth_write+0x9e/0x210 [ 1062.683066] ? proc_cwd_link+0x1d0/0x1d0 [ 1062.716786] binder_alloc: 695: binder_alloc_buf, no vma [ 1062.723272] binder: undelivered TRANSACTION_ERROR: 29189 [ 1062.726587] ? __might_fault+0x12b/0x1e0 [ 1062.726607] ? lock_downgrade+0x900/0x900 [ 1062.726625] ? lock_release+0xa00/0xa00 [ 1062.730640] binder: undelivered TRANSACTION_ERROR: 29189 [ 1062.735959] ? perf_trace_sched_process_exec+0x860/0x860 [ 1062.735975] ? __lock_is_held+0xb5/0x140 [ 1062.736006] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1062.745055] binder: send failed reply for transaction 5377 to 695:699 [ 1062.748756] ? _copy_from_user+0xdf/0x150 [ 1062.748779] keyctl_dh_compute+0xc5/0x11f [ 1062.748794] ? __keyctl_dh_compute+0x1e40/0x1e40 [ 1062.748812] ? lockdep_hardirqs_on+0x3bb/0x5b0 [ 1062.844151] ? trace_hardirqs_off_caller+0x310/0x310 [ 1062.849253] __x64_sys_keyctl+0x17a/0x430 [ 1062.853396] do_syscall_64+0x1b9/0x820 [ 1062.857273] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 1062.862628] ? syscall_return_slowpath+0x5e0/0x5e0 [ 1062.867545] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1062.872401] ? trace_hardirqs_on_caller+0x310/0x310 [ 1062.877404] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 1062.882407] ? prepare_exit_to_usermode+0x291/0x3b0 [ 1062.887412] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1062.892246] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1062.897420] RIP: 0033:0x457569 [ 1062.900603] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1062.919490] RSP: 002b:00007f2a88a57c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000fa [ 1062.927308] RAX: ffffffffffffffda RBX: 00007f2a88a57c90 RCX: 0000000000457569 [ 1062.934569] RDX: 0000000020000140 RSI: 0000000020000080 RDI: 0000000000000017 [ 1062.941824] RBP: 000000000072bf00 R08: 0000000020000340 R09: 0000000000000000 [ 1062.949081] R10: 0000000000000020 R11: 0000000000000246 R12: 00007f2a88a586d4 [ 1062.956337] R13: 00000000004c286f R14: 00000000004d4258 R15: 0000000000000003 [ 1062.967098] binder: undelivered TRANSACTION_COMPLETE [ 1062.973171] binder: undelivered TRANSACTION_ERROR: 29189 [ 1063.001976] binder: undelivered TRANSACTION_ERROR: 29201 17:54:46 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0xf2000}], 0x1, 0x0) 17:54:46 executing program 1: getpeername(0xffffffffffffffff, &(0x7f0000000000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @ipv4={[], [], @local}}}}, &(0x7f0000000080)=0x80) connect$bt_rfcomm(r0, &(0x7f00000000c0)={0x1f, {0x4, 0x4, 0x5, 0xe39, 0x2, 0x5}, 0xbb0d}, 0xa) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) 17:54:46 executing program 5: 17:54:46 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000000060000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:54:46 executing program 2 (fault-call:2 fault-nth:3): r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00'}}) [ 1063.191207] binder: 715:718 got transaction with invalid data ptr [ 1063.213183] binder_alloc: binder_alloc_mmap_handler: 715 20001000-20004000 already mapped failed -16 17:54:46 executing program 1: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth1_to_bond\x00', 0x43732e5398416f1a}) r2 = syz_open_dev$sndpcmc(&(0x7f0000000680)='/dev/snd/pcmC#D#c\x00', 0x5, 0x80000) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f00000006c0)={0x0, @rand_addr, @local}, &(0x7f0000000700)=0xc) sendmsg$xdp(r2, &(0x7f0000000a40)={&(0x7f0000000740)={0x2c, 0x4, r3, 0x31}, 0x10, &(0x7f00000009c0)=[{&(0x7f0000000780)="40a8bf5b9dc71cd2d9059e37580f213a6aeaeb023560a272f964c693443837e22649d054866e80d995b0c33ff902b7718767713a56f79b74825dc9337418798e5e1a8106e32ca96bfaa0a6cf53706773dff9c7c79324dbecf2fd2d8560b40d396fbcc7bd0b99091b5a11e046ec453012d7fbd9ad62a5626c4d68f0b6e8ad33a0af5df8bf339edd8992c9bd613cb34b96dc33b8efa3a4229d012f2e20285ba2906f67a5ea947e11f18ab56f60d9", 0xad}, {&(0x7f0000000840)="073f90ffc1bf7ca77cd3c34d69ab95f516fd663eecc84114fb689aa8e9a01864831bbc575adf639d3cb0ddc2627fd81c68f6691d13ed5e85a9011eb6d045c01bffe9f39ce2d1c1db169de21c5baaf2a1892226b062763e259710a50251068f2b72c8ffe89511f582f5812437755a0f5c3911ed3cb28236e174b8140ee568ce54df052739eb73d0b2ece5341dd7cdd14cf7e3921e206d8b", 0x97}, {&(0x7f0000000900)="cc78a4858ff0b0dc12d6b8ddc6058fa5af3b83d56d62012b17c4405291339c3f8c9879906052fd1d67b332adc72481a132", 0x31}, {&(0x7f0000000940)="5810b782c748619bdf66c27d4f8c40d7d02477328ba6c2b6f6fd94af59fbbb", 0x1f}, {&(0x7f0000000980)="20cbf87af13fb473d8e14f74070ee30e1cc6767925a54c1e", 0x18}], 0x5, 0x0, 0x0, 0x4000}, 0x4000000) stat(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0}) ioprio_set$uid(0x3, r4, 0x7) 17:54:46 executing program 5: [ 1063.249978] binder: BINDER_SET_CONTEXT_MGR already set [ 1063.255331] binder: 715:724 ioctl 40046207 0 returned -16 [ 1063.264309] binder_alloc: 715: binder_alloc_buf, no vma [ 1063.269988] binder_alloc: 715: binder_alloc_buf, no vma [ 1063.276000] binder: undelivered TRANSACTION_ERROR: 29201 [ 1063.282306] binder: undelivered TRANSACTION_ERROR: 29189 [ 1063.287041] FAULT_INJECTION: forcing a failure. [ 1063.287041] name failslab, interval 1, probability 0, space 0, times 0 [ 1063.301597] binder: send failed reply for transaction 5382 to 715:718 [ 1063.323898] CPU: 1 PID: 727 Comm: syz-executor2 Not tainted 4.20.0-rc3+ #128 [ 1063.331138] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1063.340496] Call Trace: [ 1063.343084] dump_stack+0x244/0x39d [ 1063.346709] ? dump_stack_print_info.cold.1+0x20/0x20 [ 1063.351894] ? avc_has_perm_noaudit+0x630/0x630 [ 1063.356558] should_fail.cold.4+0xa/0x17 [ 1063.360618] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1063.365710] ? rcu_read_unlock_special+0x1c0/0x1c0 [ 1063.370643] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1063.376168] ? key_validate+0x18e/0x240 [ 1063.380309] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1063.385836] ? zap_class+0x640/0x640 [ 1063.389559] ? find_held_lock+0x36/0x1c0 [ 1063.393628] ? __lock_is_held+0xb5/0x140 [ 1063.397691] ? perf_trace_sched_process_exec+0x860/0x860 [ 1063.403131] ? lock_release+0xa00/0xa00 [ 1063.407096] ? perf_trace_sched_process_exec+0x860/0x860 [ 1063.412537] ? key_validate+0x240/0x240 [ 1063.416506] __should_failslab+0x124/0x180 [ 1063.420744] should_failslab+0x9/0x14 [ 1063.425142] __kmalloc_track_caller+0x2d1/0x760 [ 1063.429818] ? down_read+0x8d/0x120 [ 1063.433431] ? dh_data_from_key+0x133/0x3c0 [ 1063.437748] ? __down_interruptible+0x700/0x700 [ 1063.442407] ? dh_data_from_key+0x207/0x3c0 [ 1063.446734] kmemdup+0x24/0x50 [ 1063.449915] dh_data_from_key+0x207/0x3c0 [ 1063.454051] ? dh_crypto_done+0x90/0x90 [ 1063.458030] __keyctl_dh_compute+0x593/0x1e40 [ 1063.462516] ? find_held_lock+0x36/0x1c0 [ 1063.466575] ? dh_data_from_key+0x3c0/0x3c0 [ 1063.470887] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1063.476414] ? proc_fail_nth_write+0x9e/0x210 [ 1063.480899] ? proc_cwd_link+0x1d0/0x1d0 [ 1063.484960] ? __might_fault+0x12b/0x1e0 [ 1063.489019] ? lock_release+0xa00/0xa00 [ 1063.492981] ? perf_trace_sched_process_exec+0x860/0x860 [ 1063.498423] ? __lock_is_held+0xb5/0x140 [ 1063.502495] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1063.508037] ? _copy_from_user+0xdf/0x150 [ 1063.512175] keyctl_dh_compute+0xc5/0x11f [ 1063.516311] ? __keyctl_dh_compute+0x1e40/0x1e40 [ 1063.521052] ? lockdep_hardirqs_on+0x3bb/0x5b0 [ 1063.525631] ? trace_hardirqs_off_caller+0x310/0x310 [ 1063.530722] __x64_sys_keyctl+0x17a/0x430 [ 1063.534864] do_syscall_64+0x1b9/0x820 [ 1063.538739] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 1063.544124] ? syscall_return_slowpath+0x5e0/0x5e0 [ 1063.549042] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1063.553870] ? trace_hardirqs_on_caller+0x310/0x310 [ 1063.558874] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 1063.563880] ? prepare_exit_to_usermode+0x291/0x3b0 [ 1063.568904] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1063.573739] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1063.578919] RIP: 0033:0x457569 [ 1063.582102] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 17:54:47 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000040000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) [ 1063.600990] RSP: 002b:00007f2a88a57c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000fa [ 1063.608776] RAX: ffffffffffffffda RBX: 00007f2a88a57c90 RCX: 0000000000457569 [ 1063.616031] RDX: 0000000020000140 RSI: 0000000020000080 RDI: 0000000000000017 [ 1063.623289] RBP: 000000000072bf00 R08: 0000000020000340 R09: 0000000000000000 [ 1063.630564] R10: 0000000000000020 R11: 0000000000000246 R12: 00007f2a88a586d4 [ 1063.637822] R13: 00000000004c286f R14: 00000000004d4258 R15: 0000000000000003 [ 1063.697624] binder: undelivered TRANSACTION_COMPLETE [ 1063.733106] binder: 734:736 got transaction with invalid data ptr [ 1063.755576] binder_transaction: 25 callbacks suppressed [ 1063.755592] binder: 734:736 transaction failed 29201/-14, size 255-0 line 2992 [ 1063.771730] binder_alloc: binder_alloc_mmap_handler: 734 20001000-20004000 already mapped failed -16 17:54:47 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x17c000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:54:47 executing program 5: 17:54:47 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) 17:54:47 executing program 2 (fault-call:2 fault-nth:4): r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00'}}) [ 1063.793601] binder: BINDER_SET_CONTEXT_MGR already set [ 1063.801918] binder: 734:742 ioctl 40046207 0 returned -16 [ 1063.819720] binder_alloc: 734: binder_alloc_buf, no vma [ 1063.844237] FAULT_INJECTION: forcing a failure. [ 1063.844237] name failslab, interval 1, probability 0, space 0, times 0 [ 1063.850194] binder: 734:736 transaction failed 29189/-3, size 0-0 line 2973 [ 1063.863050] binder_alloc: 734: binder_alloc_buf, no vma [ 1063.872869] CPU: 0 PID: 749 Comm: syz-executor2 Not tainted 4.20.0-rc3+ #128 [ 1063.880095] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1063.889459] Call Trace: [ 1063.889491] dump_stack+0x244/0x39d [ 1063.889514] ? dump_stack_print_info.cold.1+0x20/0x20 [ 1063.889538] ? avc_has_perm_noaudit+0x630/0x630 [ 1063.895766] should_fail.cold.4+0xa/0x17 [ 1063.895791] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1063.895811] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1063.895826] ? key_validate+0x18e/0x240 [ 1063.895846] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1063.895862] ? zap_class+0x640/0x640 [ 1063.895883] ? find_held_lock+0x36/0x1c0 [ 1063.902262] binder: send failed reply for transaction 5387 to 734:736 [ 1063.905722] ? __lock_is_held+0xb5/0x140 [ 1063.905751] ? perf_trace_sched_process_exec+0x860/0x860 [ 1063.905767] ? lock_release+0xa00/0xa00 [ 1063.916319] binder: undelivered TRANSACTION_COMPLETE [ 1063.920440] ? perf_trace_sched_process_exec+0x860/0x860 [ 1063.920459] ? key_validate+0x240/0x240 [ 1063.920487] __should_failslab+0x124/0x180 [ 1063.920508] should_failslab+0x9/0x14 [ 1063.920524] __kmalloc_track_caller+0x2d1/0x760 [ 1063.920539] ? down_read+0x8d/0x120 [ 1063.920555] ? dh_data_from_key+0x133/0x3c0 [ 1063.992963] ? __down_interruptible+0x700/0x700 [ 1063.997625] ? dh_data_from_key+0x207/0x3c0 [ 1064.001936] kmemdup+0x24/0x50 [ 1064.005119] dh_data_from_key+0x207/0x3c0 [ 1064.009265] ? dh_crypto_done+0x90/0x90 [ 1064.013233] __keyctl_dh_compute+0x619/0x1e40 [ 1064.017716] ? find_held_lock+0x36/0x1c0 [ 1064.021773] ? dh_data_from_key+0x3c0/0x3c0 [ 1064.026082] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1064.031617] ? proc_fail_nth_write+0x9e/0x210 [ 1064.036098] ? proc_cwd_link+0x1d0/0x1d0 [ 1064.040161] ? __might_fault+0x12b/0x1e0 [ 1064.044213] ? lock_release+0xa00/0xa00 [ 1064.048175] ? perf_trace_sched_process_exec+0x860/0x860 [ 1064.053612] ? __lock_is_held+0xb5/0x140 [ 1064.057670] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1064.063219] ? _copy_from_user+0xdf/0x150 [ 1064.067373] keyctl_dh_compute+0xc5/0x11f [ 1064.071536] ? __keyctl_dh_compute+0x1e40/0x1e40 [ 1064.076282] ? lockdep_hardirqs_on+0x3bb/0x5b0 [ 1064.080857] ? trace_hardirqs_off_caller+0x310/0x310 [ 1064.085948] __x64_sys_keyctl+0x17a/0x430 [ 1064.090086] do_syscall_64+0x1b9/0x820 [ 1064.093968] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 1064.099319] ? syscall_return_slowpath+0x5e0/0x5e0 [ 1064.104234] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1064.109110] ? trace_hardirqs_on_caller+0x310/0x310 [ 1064.114112] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 1064.119116] ? prepare_exit_to_usermode+0x291/0x3b0 [ 1064.124119] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1064.128958] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1064.134133] RIP: 0033:0x457569 [ 1064.137773] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1064.156662] RSP: 002b:00007f2a88a57c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000fa [ 1064.164362] RAX: ffffffffffffffda RBX: 00007f2a88a57c90 RCX: 0000000000457569 [ 1064.171625] RDX: 0000000020000140 RSI: 0000000020000080 RDI: 0000000000000017 [ 1064.178907] RBP: 000000000072bf00 R08: 0000000020000340 R09: 0000000000000000 [ 1064.186183] R10: 0000000000000020 R11: 0000000000000246 R12: 00007f2a88a586d4 [ 1064.193438] R13: 00000000004c286f R14: 00000000004d4258 R15: 0000000000000003 [ 1064.213110] binder: 734:751 transaction failed 29189/-3, size 255-0 line 2973 17:54:47 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x160000}], 0x1, 0x0) 17:54:47 executing program 5: 17:54:47 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000000000000060ff000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:54:47 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) clock_settime(0x7, &(0x7f0000000000)={0x0, 0x989680}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) 17:54:47 executing program 2 (fault-call:2 fault-nth:5): r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00'}}) [ 1064.458913] FAULT_INJECTION: forcing a failure. [ 1064.458913] name failslab, interval 1, probability 0, space 0, times 0 [ 1064.476091] binder: 766:777 got transaction with invalid data ptr [ 1064.482997] binder: 766:777 transaction failed 29201/-14, size 255-0 line 2992 [ 1064.492878] binder_alloc: binder_alloc_mmap_handler: 766 20001000-20004000 already mapped failed -16 [ 1064.502786] binder: BINDER_SET_CONTEXT_MGR already set 17:54:48 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x8eb, 0x22c00) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000080)={@empty, 0x8, 0x3, 0x0, 0x8, 0x160a, 0x5, 0x80}, &(0x7f00000000c0)=0x20) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={"7665740000bd0008d75300", 0x103}) 17:54:48 executing program 5: [ 1064.508427] binder: 766:778 ioctl 40046207 0 returned -16 [ 1064.514381] binder_alloc: 766: binder_alloc_buf, no vma [ 1064.523274] binder: 766:777 transaction failed 29189/-3, size 0-0 line 2973 [ 1064.530918] binder_alloc: 766: binder_alloc_buf, no vma [ 1064.536636] CPU: 0 PID: 770 Comm: syz-executor2 Not tainted 4.20.0-rc3+ #128 [ 1064.543868] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1064.553213] Call Trace: [ 1064.555815] dump_stack+0x244/0x39d [ 1064.559468] ? dump_stack_print_info.cold.1+0x20/0x20 [ 1064.564679] ? avc_has_perm_noaudit+0x630/0x630 [ 1064.569376] should_fail.cold.4+0xa/0x17 [ 1064.573464] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1064.578585] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1064.584128] ? key_validate+0x18e/0x240 [ 1064.588114] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1064.590307] binder: 766:780 transaction failed 29189/-3, size 255-0 line 2973 [ 1064.593658] ? zap_class+0x640/0x640 [ 1064.593683] ? find_held_lock+0x36/0x1c0 17:54:48 executing program 5: [ 1064.593702] ? __lock_is_held+0xb5/0x140 [ 1064.608749] ? perf_trace_sched_process_exec+0x860/0x860 [ 1064.618226] ? lock_release+0xa00/0xa00 [ 1064.618238] ? perf_trace_sched_process_exec+0x860/0x860 [ 1064.618251] ? key_validate+0x240/0x240 [ 1064.618270] __should_failslab+0x124/0x180 [ 1064.635851] should_failslab+0x9/0x14 [ 1064.638493] binder: release 766:777 transaction 5392 out, still active [ 1064.640043] __kmalloc_track_caller+0x2d1/0x760 [ 1064.640057] ? down_read+0x8d/0x120 [ 1064.640073] ? dh_data_from_key+0x133/0x3c0 [ 1064.651480] binder: undelivered TRANSACTION_COMPLETE [ 1064.655011] ? __down_interruptible+0x700/0x700 [ 1064.655028] ? dh_data_from_key+0x207/0x3c0 [ 1064.669112] kmemdup+0x24/0x50 [ 1064.669136] dh_data_from_key+0x207/0x3c0 [ 1064.676728] ? dh_crypto_done+0x90/0x90 [ 1064.676752] __keyctl_dh_compute+0x699/0x1e40 [ 1064.676770] ? find_held_lock+0x36/0x1c0 [ 1064.684948] binder: send failed reply for transaction 5392, target dead [ 1064.689380] ? dh_data_from_key+0x3c0/0x3c0 [ 1064.689397] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1064.689415] ? proc_fail_nth_write+0x9e/0x210 [ 1064.714502] ? proc_cwd_link+0x1d0/0x1d0 [ 1064.718564] ? __might_fault+0x12b/0x1e0 [ 1064.722619] ? lock_release+0xa00/0xa00 [ 1064.726586] ? perf_trace_sched_process_exec+0x860/0x860 [ 1064.732026] ? __lock_is_held+0xb5/0x140 [ 1064.736088] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1064.741614] ? _copy_from_user+0xdf/0x150 [ 1064.745752] keyctl_dh_compute+0xc5/0x11f [ 1064.749903] ? __keyctl_dh_compute+0x1e40/0x1e40 [ 1064.754646] ? lockdep_hardirqs_on+0x3bb/0x5b0 [ 1064.759219] ? trace_hardirqs_off_caller+0x310/0x310 [ 1064.764308] __x64_sys_keyctl+0x17a/0x430 [ 1064.768450] do_syscall_64+0x1b9/0x820 [ 1064.772327] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 1064.777710] ? syscall_return_slowpath+0x5e0/0x5e0 [ 1064.782625] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1064.787457] ? trace_hardirqs_on_caller+0x310/0x310 [ 1064.792463] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 1064.797555] ? prepare_exit_to_usermode+0x291/0x3b0 [ 1064.802563] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1064.807401] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1064.812577] RIP: 0033:0x457569 [ 1064.815843] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1064.834816] RSP: 002b:00007f2a88a57c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000fa [ 1064.842512] RAX: ffffffffffffffda RBX: 00007f2a88a57c90 RCX: 0000000000457569 [ 1064.849767] RDX: 0000000020000140 RSI: 0000000020000080 RDI: 0000000000000017 [ 1064.857021] RBP: 000000000072bf00 R08: 0000000020000340 R09: 0000000000000000 [ 1064.864275] R10: 0000000000000020 R11: 0000000000000246 R12: 00007f2a88a586d4 [ 1064.871531] R13: 00000000004c286f R14: 00000000004d4258 R15: 0000000000000003 17:54:48 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x149000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:54:48 executing program 5 (fault-call:7 fault-nth:0): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={'\x00', 0x8400}) 17:54:48 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000030000000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:54:48 executing program 1: r0 = socket$inet(0x2, 0x2000000080002, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000540)=@broute={'brolte\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000a80], 0x0, &(0x7f0000000300), &(0x7f0000000a80)=ANY=[@ANYBLOB="000000000000000000000000000000000000000000000000000000000000000063e173b90000feffffff01000000110000000000000000006263736630000000000800000000000073697430000002000000ffff00000000626f6e64300000000000000000000000766c616e300000000000000000000000ffffffffffff0000000000000000000000000000000000000000b0000000b0000000e000000074696d6500000000000000000000000000000000000040000000000000000000180000000000000000000000000000000000000007fffffe00000000000000004155444954000000000000000000000000000000000000030000000000000000080000000000000000000000000000000000000000000000000000000000becfed51d3a5e900000000000000000000000000000000000001000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000001000000ff00000000"]}, 0x1e6) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x400000, 0x0) ioctl$TUNGETFILTER(r1, 0x801054db, &(0x7f0000000080)=""/42) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x800, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x1e, &(0x7f00000000c0)=0x7, 0x4) write$UHID_CREATE2(r1, &(0x7f0000000600)=ANY=[@ANYBLOB="0b00000073797a300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a31000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fe00ff010600000001000000ff030000010001000946e0f107c4458c85591679a83527b1509864f23cb5bc6c3b5d70823be1ebd5388a262bbea40836a5979859cdc19258a5212f6452625a0249ea3b29e1d05ac43944ac71b8399f05528cc4075e60f26572420962b8f8130588c30a47dc8ccb02d7929004564935aa160c51cff24b9971b1974e760282d984446e2aacd3de30ffc8e6fd9ee040886845713296b62fda544248610d62d0ca3c2e3b0eafc216f5965a0139b49266fc44bd69ee6491a448d1399886f9a1b3935360fdb0f629be0f282f52286c349aee02d30f6dfaff3a01859a5004f25aec5a5ca4721de2070b3dee257b14af6c260c3c249a2bc8507ba2709bd0a9d2a389d736bd9dd00a5af71753dbcf44a5760de0179ed43da7d39de1947ad588b38d3a51d38506f24f31fac8db074c421a994fe0b359da292418db89c5f320e74057f3117cc87633023ba17c8988e8f71b361100e0b8cdadd8fba51b026173425a2fa02c83ab4e4e5a9c74f4fbd4458300002e7d617b04438644016cc7fb3a7cdf7456c1a791b1d2319d77d1b6a3bc972bb9ce7092b30f0412e320b9b63d5cbb326f04471a60aab457f82cefbf27565ae5b2fd5a4ccb2c82b6a25c37fdc63a7074163265c3f7d66548903ca19f3b146b05a1b1aeb09758bd3d"], 0x216) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) [ 1065.181989] kernel msg: ebtables bug: please report to author: Wrong len argument [ 1065.183465] binder: 798:799 got transaction with invalid data ptr [ 1065.220630] binder: 798:799 transaction failed 29201/-14, size 255-0 line 2992 [ 1065.238333] binder_alloc: binder_alloc_mmap_handler: 798 20001000-20004000 already mapped failed -16 [ 1065.247852] binder: BINDER_SET_CONTEXT_MGR already set [ 1065.253181] binder: 798:808 ioctl 40046207 0 returned -16 [ 1065.259274] binder: 798:799 transaction failed 29189/-3, size 0-0 line 2973 [ 1065.259780] binder: 798:810 transaction failed 29189/-3, size 255-0 line 2973 [ 1065.274969] binder: send failed reply for transaction 5397 to 798:799 [ 1065.293805] binder: undelivered TRANSACTION_COMPLETE 17:54:48 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000140)='/dev/md0\x00', 0x280, 0x0) ioctl$BLKALIGNOFF(r0, 0x127a, &(0x7f0000000180)) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) socketpair(0x9, 0x7, 0x6, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$DRM_IOCTL_RES_CTX(0xffffffffffffff9c, 0xc0106426, &(0x7f0000000080)={0x3, &(0x7f0000000040)=[{}, {0x0}, {}]}) ioctl$DRM_IOCTL_UNLOCK(r2, 0x4008642b, &(0x7f00000000c0)={r3, 0x293dc6f8e7ca8ee2}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) 17:54:48 executing program 2 (fault-call:2 fault-nth:6): r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00'}}) 17:54:48 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={'\x00', 0x8400}) 17:54:48 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0xf0000}], 0x1, 0x0) 17:54:48 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000007100000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) [ 1065.481041] FAULT_INJECTION: forcing a failure. [ 1065.481041] name failslab, interval 1, probability 0, space 0, times 0 [ 1065.506449] binder: 822:823 got transaction with invalid data ptr [ 1065.510310] CPU: 1 PID: 826 Comm: syz-executor2 Not tainted 4.20.0-rc3+ #128 [ 1065.512797] binder: 822:823 transaction failed 29201/-14, size 255-0 line 2992 [ 1065.519949] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1065.519956] Call Trace: [ 1065.519980] dump_stack+0x244/0x39d [ 1065.520003] ? dump_stack_print_info.cold.1+0x20/0x20 [ 1065.520023] ? save_stack+0xa9/0xd0 [ 1065.520048] should_fail.cold.4+0xa/0x17 [ 1065.536772] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1065.536796] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1065.536828] ? find_held_lock+0x36/0x1c0 [ 1065.561327] ? dh_data_from_key+0x278/0x3c0 [ 1065.574791] ? find_held_lock+0x36/0x1c0 [ 1065.574833] ? kasan_check_write+0x14/0x20 [ 1065.583106] ? perf_trace_sched_process_exec+0x860/0x860 [ 1065.583123] ? up_read_non_owner+0x100/0x100 [ 1065.583142] ? __down_interruptible+0x700/0x700 [ 1065.590916] binder_alloc: binder_alloc_mmap_handler: 822 20001000-20004000 already mapped failed -16 [ 1065.593003] __should_failslab+0x124/0x180 [ 1065.593023] should_failslab+0x9/0x14 [ 1065.598596] binder: BINDER_SET_CONTEXT_MGR already set [ 1065.606933] __kmalloc+0x2e0/0x760 [ 1065.606948] ? dh_crypto_done+0x90/0x90 [ 1065.606965] ? __keyctl_dh_compute+0x701/0x1e40 [ 1065.606988] __keyctl_dh_compute+0x701/0x1e40 [ 1065.615002] ? find_held_lock+0x36/0x1c0 [ 1065.615032] ? dh_data_from_key+0x3c0/0x3c0 [ 1065.639681] binder: 822:834 ioctl 40046207 0 returned -16 [ 1065.641003] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1065.656361] ? proc_fail_nth_write+0x9e/0x210 [ 1065.656378] ? proc_cwd_link+0x1d0/0x1d0 [ 1065.656409] ? __might_fault+0x12b/0x1e0 [ 1065.656431] ? lock_release+0xa00/0xa00 [ 1065.656447] ? perf_trace_sched_process_exec+0x860/0x860 [ 1065.661437] binder: release 822:823 transaction 5402 out, still active [ 1065.665003] ? __lock_is_held+0xb5/0x140 [ 1065.665058] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1065.673054] ? _copy_from_user+0xdf/0x150 [ 1065.673076] keyctl_dh_compute+0xc5/0x11f [ 1065.673093] ? __keyctl_dh_compute+0x1e40/0x1e40 [ 1065.678631] binder: undelivered TRANSACTION_COMPLETE [ 1065.685270] ? lockdep_hardirqs_on+0x3bb/0x5b0 [ 1065.685294] ? trace_hardirqs_off_caller+0x310/0x310 [ 1065.685314] __x64_sys_keyctl+0x17a/0x430 [ 1065.699041] do_syscall_64+0x1b9/0x820 [ 1065.705689] binder: send failed reply for transaction 5402, target dead [ 1065.707920] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 1065.707937] ? syscall_return_slowpath+0x5e0/0x5e0 [ 1065.707953] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1065.752496] ? trace_hardirqs_on_caller+0x310/0x310 [ 1065.757502] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 1065.762523] ? prepare_exit_to_usermode+0x291/0x3b0 [ 1065.767533] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1065.772373] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1065.777548] RIP: 0033:0x457569 [ 1065.780748] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1065.799633] RSP: 002b:00007f2a88a57c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000fa [ 1065.807326] RAX: ffffffffffffffda RBX: 00007f2a88a57c90 RCX: 0000000000457569 [ 1065.814582] RDX: 0000000020000140 RSI: 0000000020000080 RDI: 0000000000000017 [ 1065.821852] RBP: 000000000072bf00 R08: 0000000020000340 R09: 0000000000000000 17:54:49 executing program 1: r0 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x123000) ioctl$RTC_WKALM_RD(r0, 0x80287010, &(0x7f0000000040)) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$SG_GET_ACCESS_COUNT(r0, 0x2289, &(0x7f0000000080)) 17:54:49 executing program 2 (fault-call:2 fault-nth:7): r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00'}}) 17:54:49 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000050000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) [ 1065.829106] R10: 0000000000000020 R11: 0000000000000246 R12: 00007f2a88a586d4 [ 1065.836446] R13: 00000000004c286f R14: 00000000004d4258 R15: 0000000000000003 [ 1065.959244] FAULT_INJECTION: forcing a failure. [ 1065.959244] name failslab, interval 1, probability 0, space 0, times 0 [ 1065.974107] CPU: 0 PID: 847 Comm: syz-executor2 Not tainted 4.20.0-rc3+ #128 [ 1065.979228] binder: 845:848 got transaction with invalid data ptr [ 1065.981341] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1065.981348] Call Trace: [ 1065.981374] dump_stack+0x244/0x39d [ 1065.981393] ? dump_stack_print_info.cold.1+0x20/0x20 [ 1065.981414] ? zap_class+0x640/0x640 [ 1065.992666] binder_alloc: binder_alloc_mmap_handler: 845 20001000-20004000 already mapped failed -16 [ 1065.997009] should_fail.cold.4+0xa/0x17 [ 1065.997033] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1065.997063] ? crypto_alg_lookup+0x73/0x1d0 [ 1065.997085] ? lock_downgrade+0x900/0x900 [ 1066.001937] binder: BINDER_SET_CONTEXT_MGR already set [ 1066.003291] ? find_held_lock+0x36/0x1c0 [ 1066.003333] ? perf_trace_sched_process_exec+0x860/0x860 [ 1066.008746] binder: 845:849 ioctl 40046207 0 returned -16 [ 1066.012227] ? __crypto_alg_lookup+0x31b/0x390 [ 1066.012255] __should_failslab+0x124/0x180 [ 1066.012275] should_failslab+0x9/0x14 [ 1066.012294] __kmalloc+0x2e0/0x760 [ 1066.023637] binder: release 845:848 transaction 5407 out, still active [ 1066.025601] ? crypto_larval_alloc+0x1d0/0x1d0 [ 1066.025625] ? rcu_lockdep_current_cpu_online+0x1a4/0x210 [ 1066.025643] ? rcu_pm_notify+0xc0/0xc0 [ 1066.025657] ? crypto_create_tfm+0x87/0x310 [ 1066.025679] crypto_create_tfm+0x87/0x310 [ 1066.025701] crypto_alloc_tfm+0x1b5/0x2d0 [ 1066.031304] binder: undelivered TRANSACTION_COMPLETE [ 1066.035135] crypto_alloc_kpp+0x2c/0x40 [ 1066.035156] __keyctl_dh_compute+0x980/0x1e40 [ 1066.035174] ? find_held_lock+0x36/0x1c0 [ 1066.035201] ? dh_data_from_key+0x3c0/0x3c0 [ 1066.044275] binder: send failed reply for transaction 5407, target dead [ 1066.044591] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1066.143312] ? proc_fail_nth_write+0x9e/0x210 [ 1066.147796] ? proc_cwd_link+0x1d0/0x1d0 [ 1066.151859] ? __might_fault+0x12b/0x1e0 [ 1066.155915] ? lock_release+0xa00/0xa00 [ 1066.159875] ? perf_trace_sched_process_exec+0x860/0x860 [ 1066.165321] ? __lock_is_held+0xb5/0x140 [ 1066.169384] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1066.174909] ? _copy_from_user+0xdf/0x150 [ 1066.179049] keyctl_dh_compute+0xc5/0x11f [ 1066.183186] ? __keyctl_dh_compute+0x1e40/0x1e40 [ 1066.187935] ? lockdep_hardirqs_on+0x3bb/0x5b0 [ 1066.192511] ? trace_hardirqs_off_caller+0x310/0x310 [ 1066.197604] __x64_sys_keyctl+0x17a/0x430 [ 1066.201740] do_syscall_64+0x1b9/0x820 [ 1066.205615] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 1066.210969] ? syscall_return_slowpath+0x5e0/0x5e0 [ 1066.215889] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1066.220719] ? trace_hardirqs_on_caller+0x310/0x310 [ 1066.225726] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 1066.230729] ? prepare_exit_to_usermode+0x291/0x3b0 [ 1066.235734] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1066.240563] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1066.245740] RIP: 0033:0x457569 [ 1066.248923] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1066.267894] RSP: 002b:00007f2a88a57c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000fa [ 1066.275586] RAX: ffffffffffffffda RBX: 00007f2a88a57c90 RCX: 0000000000457569 [ 1066.282837] RDX: 0000000020000140 RSI: 0000000020000080 RDI: 0000000000000017 [ 1066.291011] RBP: 000000000072bf00 R08: 0000000020000340 R09: 0000000000000000 [ 1066.298273] R10: 0000000000000020 R11: 0000000000000246 R12: 00007f2a88a586d4 [ 1066.305759] R13: 00000000004c286f R14: 00000000004d4258 R15: 0000000000000003 17:54:49 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x8d000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:54:49 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x40086602, &(0x7f00000000c0)={'\x00', 0x8400}) 17:54:49 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x2000000000a67fc, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) 17:54:49 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000120000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:54:49 executing program 2 (fault-call:2 fault-nth:8): r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00'}}) [ 1066.496713] binder: 861:862 got transaction with invalid data ptr [ 1066.507740] FAULT_INJECTION: forcing a failure. [ 1066.507740] name failslab, interval 1, probability 0, space 0, times 0 17:54:50 executing program 1: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) r2 = getuid() r3 = getegid() fchown(r0, r2, r3) r4 = open(&(0x7f0000000000)='./file0\x00', 0x4000, 0x1) ioctl$KVM_SMI(r4, 0xaeb7) socket$key(0xf, 0x3, 0x2) [ 1066.545364] binder_alloc: binder_alloc_mmap_handler: 861 20001000-20004000 already mapped failed -16 [ 1066.546104] binder: BINDER_SET_CONTEXT_MGR already set [ 1066.595962] CPU: 0 PID: 870 Comm: syz-executor2 Not tainted 4.20.0-rc3+ #128 [ 1066.603242] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1066.606338] binder: 861:872 ioctl 40046207 0 returned -16 [ 1066.612721] Call Trace: [ 1066.618444] binder: release 861:862 transaction 5412 out, still active [ 1066.620857] dump_stack+0x244/0x39d [ 1066.620882] ? dump_stack_print_info.cold.1+0x20/0x20 [ 1066.620910] should_fail.cold.4+0xa/0x17 [ 1066.640413] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1066.645662] ? __save_stack_trace+0x8d/0xf0 [ 1066.650022] ? save_stack+0xa9/0xd0 [ 1066.653667] ? find_held_lock+0x36/0x1c0 [ 1066.656800] binder: undelivered TRANSACTION_COMPLETE [ 1066.657885] ? perf_trace_sched_process_exec+0x860/0x860 [ 1066.657906] ? check_preemption_disabled+0x48/0x280 [ 1066.670820] binder: send failed reply for transaction 5412, target dead [ 1066.673443] __should_failslab+0x124/0x180 [ 1066.673464] should_failslab+0x9/0x14 [ 1066.673480] kmem_cache_alloc_trace+0x2d7/0x750 [ 1066.673503] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1066.698428] mpi_alloc+0x4b/0x230 [ 1066.701876] mpi_read_raw_data+0x22a/0x490 [ 1066.706098] ? memset+0x31/0x40 [ 1066.709373] dh_set_secret+0x159/0x4a0 [ 1066.713249] ? dh_exit_tfm+0x20/0x20 [ 1066.716964] __keyctl_dh_compute+0xa1f/0x1e40 [ 1066.721448] ? find_held_lock+0x36/0x1c0 [ 1066.725503] ? dh_data_from_key+0x3c0/0x3c0 [ 1066.729828] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1066.735354] ? proc_fail_nth_write+0x9e/0x210 [ 1066.739837] ? proc_cwd_link+0x1d0/0x1d0 [ 1066.743897] ? __might_fault+0x12b/0x1e0 [ 1066.747951] ? lock_release+0xa00/0xa00 [ 1066.752016] ? perf_trace_sched_process_exec+0x860/0x860 [ 1066.757454] ? __lock_is_held+0xb5/0x140 [ 1066.761514] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1066.767043] ? _copy_from_user+0xdf/0x150 [ 1066.771179] keyctl_dh_compute+0xc5/0x11f [ 1066.775313] ? __keyctl_dh_compute+0x1e40/0x1e40 [ 1066.780058] ? lockdep_hardirqs_on+0x3bb/0x5b0 [ 1066.784635] ? trace_hardirqs_off_caller+0x310/0x310 [ 1066.789729] __x64_sys_keyctl+0x17a/0x430 [ 1066.793870] do_syscall_64+0x1b9/0x820 [ 1066.797747] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 1066.803102] ? syscall_return_slowpath+0x5e0/0x5e0 [ 1066.808019] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1066.812853] ? trace_hardirqs_on_caller+0x310/0x310 [ 1066.817859] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 1066.822952] ? prepare_exit_to_usermode+0x291/0x3b0 [ 1066.827972] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1066.832816] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1066.837992] RIP: 0033:0x457569 [ 1066.841178] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1066.860074] RSP: 002b:00007f2a88a57c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000fa [ 1066.867784] RAX: ffffffffffffffda RBX: 00007f2a88a57c90 RCX: 0000000000457569 [ 1066.875041] RDX: 0000000020000140 RSI: 0000000020000080 RDI: 0000000000000017 [ 1066.882296] RBP: 000000000072bf00 R08: 0000000020000340 R09: 0000000000000000 [ 1066.889549] R10: 0000000000000020 R11: 0000000000000246 R12: 00007f2a88a586d4 17:54:50 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0xfe000}], 0x1, 0x0) 17:54:50 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000480000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) [ 1066.896806] R13: 00000000004c286f R14: 00000000004d4258 R15: 0000000000000003 17:54:50 executing program 1: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0xf, 0x101, 0x1f, 0x8001, 0x19, 0xffffffffffffff9c, 0x5}, 0x2c) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r0, 0x28, &(0x7f0000000040)}, 0x10) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) 17:54:50 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x80086601, &(0x7f00000000c0)={'\x00', 0x8400}) [ 1066.982424] binder: 887:889 got transaction with invalid data ptr [ 1066.990440] binder_alloc: binder_alloc_mmap_handler: 887 20001000-20004000 already mapped failed -16 [ 1067.001229] binder: BINDER_SET_CONTEXT_MGR already set [ 1067.007144] binder: 887:890 ioctl 40046207 0 returned -16 [ 1067.021220] binder: release 887:889 transaction 5417 out, still active 17:54:50 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000730000000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) [ 1067.029232] binder: undelivered TRANSACTION_COMPLETE [ 1067.043386] binder: send failed reply for transaction 5417, target dead 17:54:50 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x101002, 0x0) ioctl$TUNSETTXFILTER(r0, 0x400454d1, &(0x7f0000000040)={0x1, 0x2, [@local, @dev={[], 0xf}]}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) [ 1067.116148] binder: 898:900 got transaction with invalid data ptr [ 1067.137452] binder_alloc: binder_alloc_mmap_handler: 898 20001000-20004000 already mapped failed -16 [ 1067.137456] binder: BINDER_SET_CONTEXT_MGR already set [ 1067.137472] binder: 898:903 ioctl 40046207 0 returned -16 [ 1067.167488] binder_alloc_new_buf_locked: 10 callbacks suppressed [ 1067.167495] binder_alloc: 898: binder_alloc_buf, no vma [ 1067.205776] binder_alloc: 898: binder_alloc_buf, no vma [ 1067.219369] binder_release_work: 25 callbacks suppressed [ 1067.219376] binder: undelivered TRANSACTION_ERROR: 29201 [ 1067.226009] binder: undelivered TRANSACTION_ERROR: 29189 [ 1067.238177] binder: undelivered TRANSACTION_ERROR: 29189 [ 1067.243975] binder: send failed reply for transaction 5422 to 898:900 [ 1067.252349] binder: undelivered TRANSACTION_COMPLETE [ 1067.257885] binder: undelivered TRANSACTION_ERROR: 29189 17:54:51 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x52000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:54:51 executing program 2 (fault-call:2 fault-nth:9): r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00'}}) 17:54:51 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="00634040000000000000000000006c000000000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:54:51 executing program 1: perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) 17:54:51 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x5452, &(0x7f00000000c0)={'\x00', 0x8400}) [ 1067.556527] FAULT_INJECTION: forcing a failure. [ 1067.556527] name failslab, interval 1, probability 0, space 0, times 0 [ 1067.578262] binder: 926:931 got transaction with invalid data ptr [ 1067.585563] CPU: 1 PID: 923 Comm: syz-executor2 Not tainted 4.20.0-rc3+ #128 [ 1067.592772] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1067.602212] Call Trace: [ 1067.602240] dump_stack+0x244/0x39d [ 1067.602264] ? dump_stack_print_info.cold.1+0x20/0x20 [ 1067.602286] ? kernel_text_address+0x79/0xf0 [ 1067.602312] should_fail.cold.4+0xa/0x17 [ 1067.602335] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1067.602359] ? save_stack+0xa9/0xd0 [ 1067.602375] ? save_stack+0x43/0xd0 [ 1067.602393] ? kasan_kmalloc+0xc7/0xe0 [ 1067.608603] ? mpi_alloc+0x4b/0x230 [ 1067.608619] ? mpi_read_raw_data+0x22a/0x490 [ 1067.608644] ? dh_set_secret+0x159/0x4a0 [ 1067.618307] ? __keyctl_dh_compute+0xa1f/0x1e40 [ 1067.618323] ? keyctl_dh_compute+0xc5/0x11f [ 1067.618336] ? __x64_sys_keyctl+0x17a/0x430 [ 1067.618351] ? do_syscall_64+0x1b9/0x820 [ 1067.618365] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1067.618385] ? find_held_lock+0x36/0x1c0 [ 1067.627975] ? perf_trace_sched_process_exec+0x860/0x860 [ 1067.628008] __should_failslab+0x124/0x180 [ 1067.628027] should_failslab+0x9/0x14 [ 1067.635254] __kmalloc+0x2e0/0x760 [ 1067.635283] ? rcu_read_lock_sched_held+0x14f/0x180 [ 1067.635298] ? kmem_cache_alloc_trace+0x353/0x750 17:54:51 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000280)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x64, 0x7c, 0x7ff, {"85e3c47aaca0dfc518add375e1992160c10e2714aa25c3d72cf90f2081137af19eb4c1c5defd819dd877cc01527b6e949bc61fc035eef085761b99b7709e48156730b06f4309339362e6014500e918686ac3943a687dd6f25ca40beb584514abc046f01a"}}, {0x0, "07c61abd8d362fb3381414a6471cefad108d90c18252fc370030e91fd3417602317109c49e467163ea87ac63c6828beb80fee8300bd4f068efb741a5efceb7034ba163fa518a01bbea130272c9d07e56b8908dec8942a9f7de62730a1cfb6d538124ac431c03fbc320e0bb6b85ff077595ccdc5622d00d9e74c05bcd20581d53e66787a47fb4b2c4123f3b3eb8ec22a4a91baf6da6a6be090aa8b000c6241451e6cc7549712f990165235c8776bd87391578537278365d4b8887b36a647d946ef9dcd033e150a75dc565bf1aafa963b7eb1a5632b0b369b8fd5ed0520a88fedeea"}}, &(0x7f0000000000)=""/93, 0x15f, 0x5d}, 0x20) dup(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) [ 1067.635319] ? mpi_alloc_limb_space+0x31/0x50 [ 1067.642803] mpi_alloc_limb_space+0x31/0x50 [ 1067.642820] mpi_alloc+0x1a0/0x230 [ 1067.642835] mpi_read_raw_data+0x22a/0x490 [ 1067.642852] ? memset+0x31/0x40 [ 1067.651298] dh_set_secret+0x159/0x4a0 [ 1067.651317] ? dh_exit_tfm+0x20/0x20 [ 1067.651348] __keyctl_dh_compute+0xa1f/0x1e40 [ 1067.660304] ? find_held_lock+0x36/0x1c0 [ 1067.660336] ? dh_data_from_key+0x3c0/0x3c0 [ 1067.660356] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1067.668698] ? proc_fail_nth_write+0x9e/0x210 [ 1067.668714] ? proc_cwd_link+0x1d0/0x1d0 [ 1067.668749] ? __might_fault+0x12b/0x1e0 [ 1067.668768] ? lock_release+0xa00/0xa00 [ 1067.668780] ? perf_trace_sched_process_exec+0x860/0x860 [ 1067.668799] ? __lock_is_held+0xb5/0x140 [ 1067.678228] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1067.678245] ? _copy_from_user+0xdf/0x150 [ 1067.678266] keyctl_dh_compute+0xc5/0x11f [ 1067.678279] ? __keyctl_dh_compute+0x1e40/0x1e40 [ 1067.678296] ? lockdep_hardirqs_on+0x3bb/0x5b0 [ 1067.687950] ? trace_hardirqs_off_caller+0x310/0x310 [ 1067.687971] __x64_sys_keyctl+0x17a/0x430 [ 1067.687991] do_syscall_64+0x1b9/0x820 [ 1067.688007] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 1067.688025] ? syscall_return_slowpath+0x5e0/0x5e0 [ 1067.695332] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1067.718407] binder_alloc: binder_alloc_mmap_handler: 926 20001000-20004000 already mapped failed -16 [ 1067.721731] ? trace_hardirqs_on_caller+0x310/0x310 [ 1067.721750] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 1067.721767] ? prepare_exit_to_usermode+0x291/0x3b0 [ 1067.725179] binder: BINDER_SET_CONTEXT_MGR already set [ 1067.728916] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1067.728939] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1067.728952] RIP: 0033:0x457569 [ 1067.728967] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1067.728975] RSP: 002b:00007f2a88a57c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000fa [ 1067.728988] RAX: ffffffffffffffda RBX: 00007f2a88a57c90 RCX: 0000000000457569 17:54:51 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x98000}], 0x1, 0x0) 17:54:51 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0xfffffffffffffffe, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) 17:54:51 executing program 2 (fault-call:2 fault-nth:10): r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00'}}) [ 1067.729002] RDX: 0000000020000140 RSI: 0000000020000080 RDI: 0000000000000017 [ 1067.732963] binder: 926:937 ioctl 40046207 0 returned -16 [ 1067.737185] RBP: 000000000072bf00 R08: 0000000020000340 R09: 0000000000000000 [ 1067.737195] R10: 0000000000000020 R11: 0000000000000246 R12: 00007f2a88a586d4 [ 1067.737205] R13: 00000000004c286f R14: 00000000004d4258 R15: 0000000000000003 [ 1067.814457] binder_alloc: 926: binder_alloc_buf, no vma [ 1067.840658] binder_alloc: 926: binder_alloc_buf, no vma [ 1067.852656] binder: undelivered TRANSACTION_ERROR: 29201 [ 1067.860507] binder: undelivered TRANSACTION_ERROR: 29189 17:54:51 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00'}}) [ 1068.004664] binder: undelivered TRANSACTION_ERROR: 29189 [ 1068.011643] binder: send failed reply for transaction 5427 to 926:931 [ 1068.033012] binder: undelivered TRANSACTION_COMPLETE [ 1068.046386] binder: undelivered TRANSACTION_ERROR: 29189 17:54:51 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x19, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00'}}) 17:54:51 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000000000007070000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) [ 1068.193368] binder: 968:969 got transaction with invalid data ptr [ 1068.202617] binder_alloc: binder_alloc_mmap_handler: 968 20001000-20004000 already mapped failed -16 [ 1068.205770] binder: BINDER_SET_CONTEXT_MGR already set [ 1068.217321] binder: 968:970 ioctl 40046207 0 returned -16 [ 1068.223000] binder_alloc: 968: binder_alloc_buf, no vma [ 1068.228666] binder_alloc: 968: binder_alloc_buf, no vma [ 1068.234558] binder: undelivered TRANSACTION_ERROR: 29201 [ 1068.240208] binder: undelivered TRANSACTION_ERROR: 29189 [ 1068.255605] binder: send failed reply for transaction 5432 to 968:969 [ 1068.262266] binder: undelivered TRANSACTION_COMPLETE 17:54:52 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x10d000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:54:52 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) r1 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x0, 0x2) ioctl$SG_SET_KEEP_ORPHAN(r1, 0x2287, &(0x7f0000000040)=0xfffffffffffffffd) 17:54:52 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x80087601, &(0x7f00000000c0)={'\x00', 0x8400}) 17:54:52 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x3, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00'}}) 17:54:52 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="00634040000000000000000000000000000a000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) [ 1068.635689] binder: 978:983 got transaction with invalid data ptr 17:54:52 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x5, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00'}}) [ 1068.689275] binder: BINDER_SET_CONTEXT_MGR already set [ 1068.707316] binder_alloc: binder_alloc_mmap_handler: 978 20001000-20004000 already mapped failed -16 [ 1068.716951] binder: 978:991 ioctl 40046207 0 returned -16 [ 1068.722834] binder_alloc: 978: binder_alloc_buf, no vma [ 1068.729302] binder_alloc: 978: binder_alloc_buf, no vma [ 1068.744154] binder: release 978:983 transaction 5437 out, still active [ 1068.751923] binder: undelivered TRANSACTION_COMPLETE [ 1068.790731] binder: send failed reply for transaction 5437, target dead 17:54:52 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x150000}], 0x1, 0x0) 17:54:52 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) r1 = accept4(0xffffffffffffff9c, &(0x7f0000000280)=@vsock={0x28, 0x0, 0x0, @my}, &(0x7f0000000300)=0x80, 0x80800) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f0000000000)=0x7) setsockopt$inet_sctp_SCTP_HMAC_IDENT(r1, 0x84, 0x16, &(0x7f0000000340)={0x1, [0x3]}, 0x6) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) 17:54:52 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000000001000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) [ 1068.922413] binder: 1005:1006 got transaction with invalid data ptr [ 1068.931102] binder_transaction: 23 callbacks suppressed [ 1068.931119] binder: 1005:1006 transaction failed 29201/-14, size 255-0 line 2992 [ 1068.959716] binder: BINDER_SET_CONTEXT_MGR already set 17:54:52 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x40087602, &(0x7f00000000c0)={'\x00', 0x8400}) [ 1068.959741] binder_alloc: binder_alloc_mmap_handler: 1005 20001000-20004000 already mapped failed -16 [ 1068.985594] binder: 1005:1010 ioctl 40046207 0 returned -16 [ 1068.991722] binder_alloc: 1005: binder_alloc_buf, no vma [ 1069.002651] binder: 1005:1006 transaction failed 29189/-3, size 0-0 line 2973 [ 1069.043182] binder_alloc: 1005: binder_alloc_buf, no vma [ 1069.064975] binder: 1005:1022 transaction failed 29189/-3, size 255-0 line 2973 17:54:52 executing program 1: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) r1 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x7, 0x208000) ioctl$TUNGETVNETHDRSZ(r1, 0x800454d7, &(0x7f0000000080)) connect$bt_rfcomm(r1, &(0x7f00000000c0)={0x1f, {0x5f7d, 0x7, 0x9, 0x1, 0x7}, 0x3}, 0xa) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'veth\x00', 0x43732e5398416f16}) setsockopt$inet_MCAST_JOIN_GROUP(r1, 0x0, 0x2a, &(0x7f0000000140)={0x3, {{0x2, 0x4e22, @local}}}, 0x88) 17:54:52 executing program 1: r0 = fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffff9c) ioctl$TIOCGPTPEER(r0, 0x5441, 0x3f) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, @perf_bp={0x0}, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) [ 1069.088515] binder: release 1005:1006 transaction 5442 out, still active [ 1069.104558] binder: undelivered TRANSACTION_COMPLETE [ 1069.122479] binder: send failed reply for transaction 5442, target dead 17:54:53 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x7b000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:54:53 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000480000000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:54:53 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x1, 0x80000100) 17:54:53 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0xc020660b, &(0x7f00000000c0)={'\x00', 0x8400}) 17:54:53 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0xe, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00'}}) [ 1069.660168] audit: type=1400 audit(1543168493.161:199): avc: denied { map } for pid=1049 comm="syz-executor2" path="/root/syz-executor2" dev="sda1" ino=16482 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 17:54:53 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x200000, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$VHOST_GET_VRING_ENDIAN(r0, 0x4008af14, &(0x7f0000000040)={0x3, 0xda}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) [ 1069.747508] binder: 1046:1059 transaction failed 29201/-14, size 255-0 line 2992 17:54:53 executing program 1: openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0xb0080, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_PDEATHSIG(0x1, 0x32) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) 17:54:53 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x8a000}], 0x1, 0x0) [ 1069.912722] IPVS: ftp: loaded support on port[0] = 21 17:54:53 executing program 1: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = dup3(r0, r0, 0x80000) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000000c0)='pids.current\x00', 0x0, 0x0) epoll_pwait(r3, &(0x7f0000000040)=[{}, {}, {}, {}], 0x4, 0x1, &(0x7f0000000080)={0x80}, 0x8) 17:54:53 executing program 1: r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/checkreqprot\x00', 0x0, 0x0) ioctl$TIOCLINUX7(r0, 0x541c, &(0x7f0000000080)={0x7, 0x6}) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/status\x00', 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$VT_WAITACTIVE(r1, 0x5607) 17:54:53 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x501000, 0x0) bind$bt_sco(r1, &(0x7f0000000040)={0x1f, {0x0, 0x5, 0x3f, 0x10001, 0x6, 0x3f1}}, 0x8) [ 1070.062345] binder: BINDER_SET_CONTEXT_MGR already set [ 1070.076815] binder: 1046:1054 ioctl 40046207 0 returned -16 17:54:53 executing program 1: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) r2 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x400400, 0x0) bind$nfc_llcp(r2, &(0x7f0000000040)={0x27, 0x0, 0x0, 0x7, 0x5, 0x1b2, "692133a1537a4a94f44832b14fe76cc6333f38fee893efcfc8d86a02da7adfde4117d2a73b19875cf24d75786bd84bcc25d68f05171f499ba720189238ff0c", 0x1e}, 0x60) close(r0) [ 1070.106365] binder: 1046:1054 transaction failed 29189/-3, size 0-0 line 2973 [ 1070.106375] binder: 1046:1086 transaction failed 29189/-3, size 255-0 line 2973 [ 1070.148968] binder: release 1046:1054 transaction 5447 out, still active [ 1070.157745] binder: undelivered TRANSACTION_COMPLETE [ 1070.169861] binder: send failed reply for transaction 5447, target dead 17:54:54 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x14e000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:54:54 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x100, 0xffffffffffffffff}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x1, 0x0) 17:54:54 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000000000007300000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:54:54 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454ca, &(0x7f00000000c0)={'\x00', 0x8400}) [ 1070.935981] binder_transaction: 1 callbacks suppressed [ 1070.935996] binder: 1116:1125 got transaction with invalid data ptr [ 1070.948851] binder: 1116:1125 transaction failed 29201/-14, size 255-0 line 2992 [ 1070.998025] binder_alloc: binder_alloc_mmap_handler: 1116 20001000-20004000 already mapped failed -16 [ 1071.035664] binder: BINDER_SET_CONTEXT_MGR already set [ 1071.040991] binder: 1116:1125 ioctl 40046207 0 returned -16 [ 1071.054657] binder: 1116:1133 transaction failed 29189/-3, size 255-0 line 2973 [ 1071.065152] binder: 1116:1132 transaction failed 29189/-3, size 0-0 line 2973 [ 1071.072925] binder: release 1116:1122 transaction 5452 out, still active [ 1071.085796] binder: undelivered TRANSACTION_COMPLETE [ 1071.091010] binder: send failed reply for transaction 5452, target dead [ 1071.739061] device bridge_slave_1 left promiscuous mode [ 1071.744671] bridge0: port 2(bridge_slave_1) entered disabled state [ 1071.753065] device bridge_slave_0 left promiscuous mode [ 1071.758838] bridge0: port 1(bridge_slave_0) entered disabled state [ 1073.750398] team0 (unregistering): Port device team_slave_1 removed [ 1073.760219] team0 (unregistering): Port device team_slave_0 removed [ 1073.769855] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 1073.780623] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 1073.805531] bond0 (unregistering): Released all slaves [ 1073.994318] bridge0: port 1(bridge_slave_0) entered blocking state [ 1074.000846] bridge0: port 1(bridge_slave_0) entered disabled state [ 1074.008218] device bridge_slave_0 entered promiscuous mode [ 1074.051892] bridge0: port 2(bridge_slave_1) entered blocking state [ 1074.058852] bridge0: port 2(bridge_slave_1) entered disabled state [ 1074.066240] device bridge_slave_1 entered promiscuous mode [ 1074.112744] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 1074.156549] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 1074.283724] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 1074.330989] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 1074.534462] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 1074.542307] team0: Port device team_slave_0 added [ 1074.587547] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 1074.595036] team0: Port device team_slave_1 added [ 1074.640694] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 1074.687789] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 1074.736292] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 1074.781178] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 1075.185528] bridge0: port 2(bridge_slave_1) entered blocking state [ 1075.191896] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1075.198584] bridge0: port 1(bridge_slave_0) entered blocking state [ 1075.204931] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1075.212383] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 1075.915682] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 1076.161098] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1076.250376] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 1076.340843] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 1076.347249] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 1076.355212] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 1076.445133] 8021q: adding VLAN 0 to HW filter on device team0 17:55:00 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x4, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00'}}) 17:55:00 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0xd000}], 0x1, 0x0) 17:55:00 executing program 1: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x401}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(r0, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000080)='/dev/zero\x00', 0x101, 0x0) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_bt_bnep_BNEPCONNADD(r2, 0x400442c8, &(0x7f0000000140)={r3, 0x4, 0x1, "32a0cd0fe2f860e25a28a37fce4b5492a11e1477b42ed9eacfb350dcb61758c7ac5310fb44437f2085afdf302f89e9c7f9e138e622d66f60b22c663cc82643fc80927b872975bdecd67a12e4cfe14b8858644568b76c072fbae5bc6de4c8c0548af64d1df30841e069253a2b3faf1215774fba7890d857f35d98fbeff8e3fabe577ba70c63cab7a24ac90822cf"}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000000)={0x0}, &(0x7f0000000040)=0xc) tkill(r4, 0x3c) 17:55:00 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000004c0000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:00 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x40049409, &(0x7f00000000c0)={'\x00', 0x8400}) 17:55:00 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x58000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:55:00 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'bridge_slave_0\x00'}) [ 1077.060492] binder: 1404:1411 got transaction with invalid data ptr [ 1077.072653] binder: 1404:1411 transaction failed 29201/-14, size 255-0 line 2992 [ 1077.082987] binder: BINDER_SET_CONTEXT_MGR already set [ 1077.083000] binder_alloc: binder_alloc_mmap_handler: 1404 20001000-20004000 already mapped failed -16 17:55:00 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x2, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00'}}) [ 1077.122312] binder: 1404:1417 ioctl 40046207 0 returned -16 [ 1077.129372] binder_alloc_new_buf_locked: 4 callbacks suppressed [ 1077.129380] binder_alloc: 1404: binder_alloc_buf, no vma 17:55:00 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0xc0045878, &(0x7f00000000c0)={'\x00', 0x8400}) [ 1077.166853] binder_alloc: 1404: binder_alloc_buf, no vma [ 1077.186950] binder: 1404:1422 transaction failed 29189/-3, size 255-0 line 2973 [ 1077.194721] binder_release_work: 14 callbacks suppressed [ 1077.194726] binder: undelivered TRANSACTION_ERROR: 29189 17:55:00 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) [ 1077.221842] binder: 1404:1411 transaction failed 29189/-3, size 0-0 line 2973 [ 1077.229709] binder: send failed reply for transaction 5457 to 1404:1411 [ 1077.243479] binder: undelivered TRANSACTION_COMPLETE [ 1077.248790] binder: undelivered TRANSACTION_ERROR: 29189 [ 1077.256743] binder: undelivered TRANSACTION_ERROR: 29201 17:55:00 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x8, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00'}}) [ 1077.289349] binder: undelivered TRANSACTION_ERROR: 29189 17:55:00 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="00634040000000000000000000000000004c000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:00 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x80000000, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) pipe(&(0x7f0000000000)={0xffffffffffffffff}) socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r1, 0x84, 0xc, &(0x7f0000000040), &(0x7f0000000080)=0x4) [ 1077.431197] binder: 1444:1448 got transaction with invalid data ptr [ 1077.443876] binder: 1444:1448 transaction failed 29201/-14, size 255-0 line 2992 [ 1077.484059] binder_alloc: binder_alloc_mmap_handler: 1444 20001000-20004000 already mapped failed -16 [ 1077.493650] binder: BINDER_SET_CONTEXT_MGR already set [ 1077.500540] binder: 1444:1453 ioctl 40046207 0 returned -16 [ 1077.507245] binder_alloc: 1444: binder_alloc_buf, no vma [ 1077.512751] binder: 1444:1448 transaction failed 29189/-3, size 0-0 line 2973 [ 1077.520663] binder_alloc: 1444: binder_alloc_buf, no vma [ 1077.526253] binder: 1444:1448 transaction failed 29189/-3, size 255-0 line 2973 [ 1077.534252] binder: undelivered TRANSACTION_ERROR: 29189 [ 1077.540360] binder: undelivered TRANSACTION_ERROR: 29189 [ 1077.546382] binder: send failed reply for transaction 5462 to 1444:1448 [ 1077.562248] binder: undelivered TRANSACTION_COMPLETE [ 1077.567549] binder: undelivered TRANSACTION_ERROR: 29189 [ 1077.573027] binder: undelivered TRANSACTION_ERROR: 29201 17:55:01 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x86000}], 0x1, 0x0) 17:55:01 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x5451, &(0x7f00000000c0)={'\x00', 0x8400}) 17:55:01 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x16, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00'}}) 17:55:01 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000100), 0x1c2) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x1e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ID(r0, 0x80082407, &(0x7f00000000c0)) socketpair$inet6_tcp(0xa, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) sendmsg(r1, &(0x7f0000000080)={&(0x7f0000000180)=@pptp={0x18, 0x2, {0x0, @multicast1}}, 0x80, &(0x7f0000000980), 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="c80000000000000084000000d9000000c43b94baa5da396559fe5e302e044f3bf84753c286e63cee819d6af2e4902412fd746ff2ce3051dd9e5d83e3d319b21266a80f7605816705d213dbd042bc9bcf0ef70fafc7c55716591b20a6f62fac151d38028db214b3a441ac71023f72cc26516f0fef40e0d28129fbe942f147bd4d357f802235250fa82c9dba44bdca26e449a412c6894e2f42c7ecec5ab4d880efde81d7938840346769c207a61e7cf60b390fe28f5d54e59e6600000000000000878de81c46845bf08657525fd15863938cf06b1f495dfa884940f5398798d60bb26b985ee46dd77edaf40e298604b0af0c370ab4a4ea63de6ca9644b06a4ed5e7efcdcda40a7bc"], 0x107}, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={"000000000000000000e9dc00", 0x200082}) socketpair$inet_tcp(0x2, 0x1, 0x0, &(0x7f0000000040)) socketpair(0x1, 0x1, 0x0, &(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x89f1, &(0x7f0000000080)='ip6tnl0\x00') socketpair$inet_smc(0x2b, 0x1, 0x0, &(0x7f0000000200)) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x40082406, &(0x7f00000003c0)="00601b451b919fadd5c04e2b1ee7") ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x2400, 0x7fffffff) socketpair(0x1, 0x1, 0x0, &(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r4, 0x89f2, &(0x7f0000000080)='ip6tnl0\x00') r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) 17:55:01 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000710000000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:01 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3f000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) [ 1078.070845] binder: 1466:1468 got transaction with invalid data ptr [ 1078.079877] binder: 1466:1468 transaction failed 29201/-14, size 255-0 line 2992 [ 1078.098376] binder_alloc: binder_alloc_mmap_handler: 1466 20001000-20004000 already mapped failed -16 [ 1078.110578] binder: BINDER_SET_CONTEXT_MGR already set [ 1078.133653] binder: 1466:1479 ioctl 40046207 0 returned -16 [ 1078.157677] binder_alloc: 1466: binder_alloc_buf, no vma 17:55:01 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0xb, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00'}}) 17:55:01 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000200000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) [ 1078.182442] binder: 1466:1468 transaction failed 29189/-3, size 0-0 line 2973 [ 1078.191495] binder_alloc: 1466: binder_alloc_buf, no vma [ 1078.199840] binder: 1466:1482 transaction failed 29189/-3, size 255-0 line 2973 [ 1078.204109] binder: send failed reply for transaction 5467 to 1466:1468 [ 1078.214516] binder: undelivered TRANSACTION_ERROR: 29189 17:55:01 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0xc0045878, &(0x7f00000000c0)={'\x00', 0x8400}) [ 1078.242656] binder: undelivered TRANSACTION_ERROR: 29189 [ 1078.272558] binder: undelivered TRANSACTION_COMPLETE 17:55:01 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) setsockopt$ARPT_SO_SET_ADD_COUNTERS(r1, 0x0, 0x61, &(0x7f0000000040)={'filter\x00', 0x4}, 0x68) 17:55:01 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x10, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00'}}) [ 1078.333692] binder: 1486:1491 got transaction with invalid data ptr [ 1078.353029] binder: 1486:1491 transaction failed 29201/-14, size 255-0 line 2992 [ 1078.384008] binder: BINDER_SET_CONTEXT_MGR already set [ 1078.394749] binder_alloc: binder_alloc_mmap_handler: 1486 20001000-20004000 already mapped failed -16 17:55:01 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x15, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00'}}) [ 1078.459874] binder: 1486:1498 ioctl 40046207 0 returned -16 [ 1078.459911] binder_alloc: 1486: binder_alloc_buf, no vma [ 1078.484243] binder_alloc: 1486: binder_alloc_buf, no vma [ 1078.519337] binder: release 1486:1491 transaction 5472 out, still active [ 1078.529984] binder: undelivered TRANSACTION_COMPLETE [ 1078.555324] binder: send failed reply for transaction 5472, target dead 17:55:02 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x182000}], 0x1, 0x0) 17:55:02 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x4b49, &(0x7f00000000c0)={'\x00', 0x8400}) 17:55:02 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) r1 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x0, 0x0) write$P9_RVERSION(r1, &(0x7f0000000040)={0x13, 0x65, 0xffff, 0x8, 0x6, '9P2000'}, 0x13) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/mls\x00', 0x0, 0x0) 17:55:02 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000000074000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:02 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x11, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00'}}) [ 1078.997136] binder: 1528:1546 got transaction with invalid data ptr [ 1079.020944] binder_alloc: binder_alloc_mmap_handler: 1528 20001000-20004000 already mapped failed -16 [ 1079.031399] binder: BINDER_SET_CONTEXT_MGR already set [ 1079.038523] binder: 1528:1551 ioctl 40046207 0 returned -16 [ 1079.044936] binder_alloc: 1528: binder_alloc_buf, no vma [ 1079.060893] binder_alloc: 1528: binder_alloc_buf, no vma [ 1079.061346] binder: release 1528:1546 transaction 5477 out, still active [ 1079.074423] binder: undelivered TRANSACTION_COMPLETE [ 1079.083948] binder: send failed reply for transaction 5477, target dead 17:55:02 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x1c, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00'}}) 17:55:02 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) r1 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x7b1, 0x20000) ioctl$RTC_AIE_ON(r1, 0x7001) 17:55:02 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x800454cf, &(0x7f00000000c0)={'\x00', 0x8400}) 17:55:02 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x148000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:55:02 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="00634040000000000000000000007fffffff000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:02 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0xc, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00'}}) 17:55:02 executing program 1: socket$inet6(0xa, 0x80000, 0x7ff) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) r1 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x40000) setsockopt$RDS_CONG_MONITOR(r1, 0x114, 0x6, &(0x7f0000000040)=0x4000, 0x4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) [ 1079.336664] binder: 1568:1570 got transaction with invalid data ptr [ 1079.359391] binder: BINDER_SET_CONTEXT_MGR already set [ 1079.371445] binder_alloc: binder_alloc_mmap_handler: 1568 20001000-20004000 already mapped failed -16 [ 1079.382913] binder: 1568:1576 ioctl 40046207 0 returned -16 [ 1079.390058] binder: release 1568:1570 transaction 5482 out, still active [ 1079.417348] binder: undelivered TRANSACTION_COMPLETE [ 1079.423625] binder: send failed reply for transaction 5482, target dead 17:55:03 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x94000}], 0x1, 0x0) 17:55:03 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000000000004c0000000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:03 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x1b, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00'}}) 17:55:03 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x4020940d, &(0x7f00000000c0)={'\x00', 0x8400}) 17:55:03 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x80000, 0x0) ioctl$TIOCGLCKTRMIOS(r1, 0x5456, &(0x7f0000000040)={0x2, 0x6, 0x3, 0x800, 0xfffffffffffffffa, 0x7, 0x10000, 0x6, 0x7, 0x0, 0x7, 0xff}) 17:55:03 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0xa, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00'}}) [ 1079.913271] binder: 1601:1606 got transaction with invalid data ptr [ 1079.945124] binder_alloc: binder_alloc_mmap_handler: 1601 20001000-20004000 already mapped failed -16 17:55:03 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0xfffffffffffff3b3, 0x100) setsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(r0, 0x84, 0x7, &(0x7f0000000380)={0x9}, 0x4) faccessat(r0, &(0x7f0000000040)='./file0\x00', 0x10, 0x300) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000080)=0x0) fsetxattr(r0, &(0x7f0000000140)=@known='com.apple.FinderInfo\x00', &(0x7f0000000180)=']!', 0x2, 0x3) write$selinux_context(r0, &(0x7f00000001c0)='system_u:object_r:devicekit_exec_t:s0\x00', 0x26) ptrace$setregs(0xf, r1, 0x1000, &(0x7f0000000280)="5af5b0c8af098ef40078eae546b8a5d163b57780d445b4575f717178220b2cd0d2db3f15cc1fbdc9674fcc36675b1b75b8940891d860ea3d25a0ca3d263ff60808adb8ece084815324ffd254aba9f679bc26c8746b63d06ac5716c085d4c7bc17f87551d88a29a6d578bbe9e028da29b09c214cbd14978e1fbab1395ed4f648fc1e493a0c2f482d756ade1815d3f876fe8177882b5f33d372e73303a4621eadf851fb426a977541523cca1f0e913347a6ae15731f1ea83ce57cfd0be4814844098fe4c39d5a2fc971f4bad12a07f7a0f1d4fe6589bede00ac7527d35") r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) fcntl$F_SET_RW_HINT(r2, 0x40c, &(0x7f00000000c0)=0x5) [ 1079.960963] binder: BINDER_SET_CONTEXT_MGR already set [ 1079.975962] binder: 1601:1617 ioctl 40046207 0 returned -16 [ 1079.984053] binder: release 1601:1606 transaction 5487 out, still active [ 1079.992267] binder: undelivered TRANSACTION_COMPLETE [ 1080.003301] binder: send failed reply for transaction 5487, target dead 17:55:03 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="00634040000000000000000000004c000000000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) [ 1080.130060] binder: 1627:1630 got transaction with invalid data ptr [ 1080.139041] binder_alloc: binder_alloc_mmap_handler: 1627 20001000-20004000 already mapped failed -16 [ 1080.151191] binder: BINDER_SET_CONTEXT_MGR already set [ 1080.156686] binder: 1627:1631 ioctl 40046207 0 returned -16 [ 1080.167994] binder: send failed reply for transaction 5492 to 1627:1630 [ 1080.175263] binder: undelivered TRANSACTION_COMPLETE 17:55:03 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000005c0)={'bcsh0\x00', 0x43732e5398416f1a}) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x40, 0x0) 17:55:03 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x5421, &(0x7f00000000c0)={'\x00', 0x8400}) 17:55:03 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x13, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00'}}) 17:55:03 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x10e000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:55:04 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x14d000}], 0x1, 0x0) 17:55:04 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000005000000000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:04 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x1d, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00'}}) 17:55:04 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8e10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$TUNGETFEATURES(r0, 0x800454cf, &(0x7f0000000040)) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000005c0)={'veth0_to_bridge\x00', 0x43732e5398416f1a}) 17:55:04 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x5460, &(0x7f00000000c0)={'\x00', 0x8400}) 17:55:04 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) 17:55:04 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x9, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00'}}) [ 1080.937972] binder: 1660:1667 got transaction with invalid data ptr [ 1080.969849] binder_alloc: binder_alloc_mmap_handler: 1660 20001000-20004000 already mapped failed -16 17:55:04 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x1ffd, 0x0) [ 1081.015658] binder: BINDER_SET_CONTEXT_MGR already set [ 1081.033321] binder: 1660:1675 ioctl 40046207 0 returned -16 17:55:04 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x12, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00'}}) [ 1081.068140] binder: release 1660:1667 transaction 5497 out, still active [ 1081.078810] binder: undelivered TRANSACTION_COMPLETE [ 1081.102975] binder: send failed reply for transaction 5497, target dead 17:55:04 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000012000000000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:04 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x2, &(0x7f00000000c0)={'\x00', 0x8400}) [ 1081.212410] binder: 1694:1702 got transaction with invalid data ptr [ 1081.246206] binder: BINDER_SET_CONTEXT_MGR already set [ 1081.276967] binder: 1694:1704 ioctl 40046207 0 returned -16 [ 1081.290563] binder_alloc: binder_alloc_mmap_handler: 1694 20001000-20004000 already mapped failed -16 [ 1081.322003] binder: release 1694:1702 transaction 5502 out, still active [ 1081.329879] binder: undelivered TRANSACTION_COMPLETE [ 1081.335279] binder: send failed reply for transaction 5502, target dead 17:55:04 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0xac000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:55:05 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x80000, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, &(0x7f0000000180)={0x0, 0x2, 0x30}, &(0x7f00000001c0)=0xc) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f0000000280)={r2, 0x7}, 0x8) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x402, 0x0) getsockopt$inet_sctp6_SCTP_NODELAY(r3, 0x84, 0x3, &(0x7f0000000080), &(0x7f00000000c0)=0x4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={"018000", 0x43732e5398416f1a}) 17:55:05 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x7, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00'}}) 17:55:05 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000074000000000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:05 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x164000}], 0x1, 0x0) 17:55:05 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x541b, &(0x7f00000000c0)={'\x00', 0x8400}) 17:55:05 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0xf, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00'}}) 17:55:05 executing program 1: r0 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) getsockopt$inet_sctp6_SCTP_STATUS(r0, 0x84, 0xe, &(0x7f0000000000)={0x0, 0x7, 0x9, 0x9c8, 0x4, 0x81, 0x1, 0x0, {0x0, @in={{0x2, 0x9, @broadcast}}, 0x8, 0x0, 0x0, 0x9, 0x100000000}}, &(0x7f00000000c0)=0xb0) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000140)={r1, @in6={{0xa, 0x4e21, 0xffffffffffffff45, @dev={0xfe, 0x80, [], 0xa}, 0x200}}}, &(0x7f0000000280)=0x84) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) [ 1081.900337] binder: BINDER_SET_CONTEXT_MGR already set [ 1081.936011] binder: 1725:1736 ioctl 40046207 0 returned -16 17:55:05 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000200000000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) [ 1081.944904] binder: release 1725:1732 transaction 5507 out, still active [ 1081.954670] binder: send failed reply for transaction 5507, target dead 17:55:05 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x67fc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0xfffffffffffffffe, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x240, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$VIDIOC_ENUMSTD(r0, 0xc0485619, &(0x7f0000000000)={0xe11, 0x80000, "bdde890d994fcdf8d7913320c84935af272943a410eb9ab4", {0x3, 0x401}, 0x101}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000005c0)={"74000000000000000000bd6800", 0x7efd}) 17:55:05 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x4b47, &(0x7f00000000c0)={'\x00', 0x8400}) 17:55:05 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0xd, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00'}}) [ 1082.066458] binder: BINDER_SET_CONTEXT_MGR already set [ 1082.095089] binder: 1747:1752 ioctl 40046207 0 returned -16 [ 1082.112739] binder_transaction: 24 callbacks suppressed [ 1082.112758] binder: 1747:1751 transaction failed 29189/-3, size 0-0 line 2973 [ 1082.114298] binder: 1747:1756 transaction failed 29189/-3, size 255-0 line 2973 [ 1082.158950] binder: release 1747:1751 transaction 5512 out, still active [ 1082.174382] binder: send failed reply for transaction 5512, target dead 17:55:05 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x34000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:55:05 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x14, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00'}}) 17:55:05 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) fcntl$F_GET_RW_HINT(r0, 0x40b, &(0x7f0000000000)) 17:55:05 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000004000000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) [ 1082.524478] binder_transaction: 2 callbacks suppressed [ 1082.524486] binder: 1777:1781 got transaction with invalid data ptr [ 1082.557608] binder: 1777:1781 transaction failed 29201/-14, size 255-0 line 2992 [ 1082.572775] binder_alloc_mmap_handler: 2 callbacks suppressed [ 1082.572791] binder_alloc: binder_alloc_mmap_handler: 1777 20001000-20004000 already mapped failed -16 [ 1082.586530] binder: BINDER_SET_CONTEXT_MGR already set [ 1082.593707] binder: 1777:1788 ioctl 40046207 0 returned -16 [ 1082.600088] binder_alloc_new_buf_locked: 14 callbacks suppressed [ 1082.600096] binder_alloc: 1777: binder_alloc_buf, no vma [ 1082.613387] binder: 1777:1788 transaction failed 29189/-3, size 0-0 line 2973 [ 1082.621056] binder_alloc: 1777: binder_alloc_buf, no vma [ 1082.627096] binder: 1777:1789 transaction failed 29189/-3, size 255-0 line 2973 [ 1082.638891] binder_release_work: 30 callbacks suppressed [ 1082.638898] binder: undelivered TRANSACTION_ERROR: 29201 [ 1082.665681] binder: undelivered TRANSACTION_ERROR: 29189 [ 1082.671202] binder: undelivered TRANSACTION_ERROR: 29189 [ 1082.685585] binder: send failed reply for transaction 5517 to 1777:1781 [ 1082.692444] binder_release_work: 2 callbacks suppressed [ 1082.692449] binder: undelivered TRANSACTION_COMPLETE [ 1082.707748] binder: undelivered TRANSACTION_ERROR: 29189 17:55:06 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x18, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00'}}) 17:55:06 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0xc0189436, &(0x7f00000000c0)={'\x00', 0x8400}) 17:55:06 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000140)='/dev/snapshot\x00', 0x40000, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x40000, 0x0) r1 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x19a, 0x0) ioctl$sock_bt_hci(r1, 0x0, &(0x7f0000000040)="70714b31640c606efb282ac2f352257056275a32c75bbe339a165115b578251f3defdf1e9279f770193ea8abd826a91338a4e3417d1d0203c03941da168fb21db5686a0373b7c598cff1a7dfd715599fbcc87fd782632eb434290a83e2e70c5eff95a6ebd094333482593a9bf5834f0229141f76b4ff82d5420a02c7d866143ec5f5b74b93a3c8c4d99eadd4db695cc40f4049b82af3dc39272cc88ed4520c2b0b232718fd1f3d136fc2490f979be6aabd481ad0") ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000002c0)={'bridge_slave_0\x00', 0x43732e5398416f17}) ioctl$SCSI_IOCTL_SEND_COMMAND(r1, 0x1, &(0x7f0000000300)={0x8a, 0x7, 0x4, "5e2b6e29dd2371e516e091c945fa419efb8edb5293b620e2eeeb33f2ce55256a0a014b4473664cef611394f9107886251e22d3cbd67f266240b9bd1e81c1e42f60e5ff6af1eca1e176671b3a890a2074e9b2c4462653e3e8957d3935ca64c10c9a8214d5c3e81fa3483a04508e854dd9f7eebf5d55c12cc8e89cd927b9db2877ae0ac9af285628520b6f"}) r2 = socket$netlink(0x10, 0x3, 0x0) writev(r2, &(0x7f00000000c0)=[{&(0x7f0000000200)="390000001300090468fe000081000000c9ffff3f03000000450001070000003719001a000400200007e91ee400538a274d69a26cdf12f24006", 0x39}], 0x1) openat$nullb(0xffffffffffffff9c, &(0x7f0000000180)='/dev/nullb0\x00', 0xfffc, 0x0) 17:55:06 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0xe8000}], 0x1, 0x0) 17:55:06 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000000000fffffdfd000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) [ 1082.948331] binder: 1801:1804 got transaction with invalid data ptr [ 1082.955052] binder: 1801:1804 transaction failed 29201/-14, size 255-0 line 2992 [ 1082.979478] binder_alloc: binder_alloc_mmap_handler: 1801 20001000-20004000 already mapped failed -16 [ 1082.989071] binder: BINDER_SET_CONTEXT_MGR already set 17:55:06 executing program 1: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x125000, 0x0) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000040)=0x0) sched_setattr(r2, &(0x7f0000000080)={0x30, 0x7, 0x0, 0x3, 0x7, 0x800, 0x2, 0x9}, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) r3 = openat$rtc(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/rtc0\x00', 0x620100, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(0xffffffffffffff9c, 0x84, 0x70, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e20}}, [0x1f, 0x138a, 0x2, 0x5, 0x1ff, 0x0, 0xfff, 0x4, 0xffffffffffff8000, 0x5, 0x8, 0x3ff, 0x8, 0x5, 0x918]}, &(0x7f0000000140)=0x100) setsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0x14, &(0x7f0000000180)=@assoc_value={r4, 0xffffffffffff81f5}, 0x8) 17:55:06 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x6, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00'}}) [ 1082.994475] binder: 1801:1813 ioctl 40046207 0 returned -16 [ 1083.000981] binder_alloc: 1801: binder_alloc_buf, no vma [ 1083.007552] binder: 1801:1804 transaction failed 29189/-3, size 0-0 line 2973 [ 1083.025772] binder_alloc: 1801: binder_alloc_buf, no vma [ 1083.041211] binder: 1801:1814 transaction failed 29189/-3, size 255-0 line 2973 17:55:06 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000680000000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) [ 1083.056575] binder: undelivered TRANSACTION_ERROR: 29189 [ 1083.062163] binder: send failed reply for transaction 5522 to 1801:1804 [ 1083.081170] binder: undelivered TRANSACTION_ERROR: 29189 [ 1083.093148] binder: undelivered TRANSACTION_COMPLETE [ 1083.099301] binder: undelivered TRANSACTION_ERROR: 29189 [ 1083.113756] binder: undelivered TRANSACTION_ERROR: 29201 [ 1083.168719] binder: 1826:1828 got transaction with invalid data ptr [ 1083.185052] binder: 1826:1828 transaction failed 29201/-14, size 255-0 line 2992 [ 1083.203960] binder_alloc: binder_alloc_mmap_handler: 1826 20001000-20004000 already mapped failed -16 [ 1083.216262] binder: BINDER_SET_CONTEXT_MGR already set [ 1083.221729] binder: 1826:1830 ioctl 40046207 0 returned -16 [ 1083.227860] binder_alloc: 1826: binder_alloc_buf, no vma [ 1083.233371] binder: 1826:1828 transaction failed 29189/-3, size 0-0 line 2973 [ 1083.240835] binder_alloc: 1826: binder_alloc_buf, no vma [ 1083.246522] binder: undelivered TRANSACTION_ERROR: 29201 [ 1083.252187] binder: send failed reply for transaction 5527 to 1826:1828 [ 1083.259553] binder: undelivered TRANSACTION_ERROR: 29189 [ 1083.265215] binder: undelivered TRANSACTION_COMPLETE 17:55:06 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x32000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:55:06 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696300000000000c90f700"}}) 17:55:06 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) munmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) 17:55:06 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x5450, &(0x7f00000000c0)={'\x00', 0x8400}) 17:55:06 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000120000000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:07 executing program 1: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$binfmt_elf32(r0, &(0x7f0000000080)={{0x7f, 0x45, 0x4c, 0x46, 0xffff, 0x0, 0x6, 0x100000000000, 0x8, 0x3, 0x7, 0x400, 0x1ae, 0x38, 0x31d, 0x20, 0x80e, 0x20, 0x2, 0x7, 0x6, 0x7}, [{0x0, 0x1, 0x200, 0x35, 0x100000000, 0x9, 0x6, 0x7}], "1b6eb19d6f6ea897d71ab536abf80f15a6a54b4f84d81dde408180bd086a4c4f401246915aff0814519f737b3dda2c56ce1336ac04a569658991117db2941848efcf425af00b92cb1f4c46fd62cef91d3dc3272ee93b9256a3f9854f6db65750970c496c0eb15c5a48e1bbf328f6698bb80ec092a2bab94ebf2ba8cd6cf46d9e3dd5d2f4ead1867f2dceb59a4665a9b4d583e1"}, 0xeb) r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x404000, 0x0) ioctl$UI_BEGIN_FF_UPLOAD(r1, 0xc06855c8, &(0x7f0000000180)={0xc, 0xfffffffffffff001, {0x57, 0x20, 0x8, {0x3, 0x220a}, {0x4, 0x4}, @ramp={0xb1, 0x2, {0xffffffffffffff32, 0x5, 0x2, 0x2}}}, {0x53, 0x0, 0xd41, {0x25b3, 0xffff}, {0xe9b, 0xfffffffffffffffa}, @ramp={0x401, 0xffff, {0x6, 0x4, 0x1fffc000000, 0x62}}}}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x2004fe, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) [ 1083.523514] binder: 1841:1843 got transaction with invalid data ptr [ 1083.535174] binder_alloc: binder_alloc_mmap_handler: 1841 20001000-20004000 already mapped failed -16 [ 1083.550124] binder: BINDER_SET_CONTEXT_MGR already set [ 1083.557332] binder: 1841:1852 ioctl 40046207 0 returned -16 [ 1083.563781] binder_alloc: 1841: binder_alloc_buf, no vma 17:55:07 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e65726963000000000000000100"}}) [ 1083.572369] binder_alloc: 1841: binder_alloc_buf, no vma [ 1083.596266] binder: release 1841:1843 transaction 5532 out, still active [ 1083.610517] binder: undelivered TRANSACTION_COMPLETE [ 1083.646204] binder: send failed reply for transaction 5532, target dead 17:55:07 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x19e000}], 0x1, 0x0) 17:55:07 executing program 1: perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) 17:55:07 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000000012000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:07 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={'\x00@\x00', 0x8400}) 17:55:07 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696300000000fffffe00"}}) [ 1083.951980] binder: 1874:1878 got transaction with invalid data ptr [ 1083.976235] binder_alloc: binder_alloc_mmap_handler: 1874 20001000-20004000 already mapped failed -16 [ 1083.977210] binder: BINDER_SET_CONTEXT_MGR already set [ 1084.006539] binder: 1874:1885 ioctl 40046207 0 returned -16 [ 1084.013773] binder_alloc: 1874: binder_alloc_buf, no vma [ 1084.020779] binder_alloc: 1874: binder_alloc_buf, no vma [ 1084.028257] binder: release 1874:1878 transaction 5537 out, still active [ 1084.035117] binder: undelivered TRANSACTION_COMPLETE [ 1084.055971] binder: send failed reply for transaction 5537, target dead 17:55:08 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x12d000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:55:08 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e657269630000015700"}}) 17:55:08 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x600000, 0x0) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000040)="97a744d119fa123a364366de8336601a575c035a9674a408d8b24e1fd5b35f62c9bfa4071b50212f4615b108c3ccd12f7df02c3304df5494e316acbf6027dea80ad61adc4b456c13a1b3c3e1497f654169ddc9039a747fce23f8d30fb6aed93894005ea052b611566cd194dd2d545619ec3a473e3f1245157af5b0a6f7f6587fbc7313dd5619a84496a208fcf43fd301403231dda93c0bdea247f566b241dc6317451280f3f1fef6db857e5f324b19d1", 0xb0) 17:55:08 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000009300000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:08 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={"000000000000000100", 0x8400}) 17:55:08 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generickkk\x00'}}) 17:55:08 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000000)={0xffffffffffffffff}) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000040)=0x40, 0x4) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) [ 1084.646213] binder: 1900:1906 got transaction with invalid data ptr [ 1084.664688] binder_alloc: binder_alloc_mmap_handler: 1900 20001000-20004000 already mapped failed -16 [ 1084.686251] binder: BINDER_SET_CONTEXT_MGR already set [ 1084.707424] binder: 1900:1912 ioctl 40046207 0 returned -16 [ 1084.730449] binder: release 1900:1906 transaction 5542 out, still active [ 1084.742755] binder: undelivered TRANSACTION_COMPLETE [ 1084.755896] binder: send failed reply for transaction 5542, target dead [ 1084.892555] could not allocate digest TFM handle ghash-generickkk [ 1084.953056] could not allocate digest TFM handle ghash-generickkk 17:55:08 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x46000}], 0x1, 0x0) 17:55:08 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000000000ffffffffff6000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:08 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={"00000000ffffffff00", 0x8400}) 17:55:08 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) init_module(&(0x7f0000000000)='/dev/net/tun\x00', 0xd, &(0x7f0000000040)='/dev/net/tun\x00') ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) 17:55:08 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00@\x00'}}) [ 1085.038635] binder: 1941:1944 got transaction with invalid data ptr [ 1085.046836] binder_alloc: binder_alloc_mmap_handler: 1941 20001000-20004000 already mapped failed -16 [ 1085.057770] binder: BINDER_SET_CONTEXT_MGR already set [ 1085.063193] binder: 1941:1945 ioctl 40046207 0 returned -16 [ 1085.070508] binder: release 1941:1944 transaction 5547 out, still active [ 1085.082740] binder: undelivered TRANSACTION_COMPLETE [ 1085.105161] binder: send failed reply for transaction 5547, target dead 17:55:09 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x7ffff000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:55:09 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000000000004000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:09 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xffffffffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0xffffffffffffffff, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) 17:55:09 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696300f0ffffff7f00"}}) 17:55:09 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={'\x00\x00\x00\x00\x00\x00\x00?\x00', 0x8400}) 17:55:09 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x1801}) r1 = syz_open_dev$mouse(&(0x7f0000000040)='/dev/input/mouse#\x00', 0x0, 0x0) ioctl$KDMKTONE(r1, 0x4b30, 0x1) socketpair$inet_dccp(0x2, 0x6, 0x0, &(0x7f0000000080)) 17:55:09 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696300000000000000c000"}}) [ 1085.755264] binder: 1966:1968 got transaction with invalid data ptr [ 1085.790863] binder_alloc: binder_alloc_mmap_handler: 1966 20001000-20004000 already mapped failed -16 [ 1085.838925] binder: BINDER_SET_CONTEXT_MGR already set [ 1085.863510] binder: 1966:1980 ioctl 40046207 0 returned -16 [ 1085.882768] binder: release 1966:1968 transaction 5552 out, still active [ 1085.904823] binder: undelivered TRANSACTION_COMPLETE [ 1085.924730] binder: send failed reply for transaction 5552, target dead 17:55:09 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0xfc000}], 0x1, 0x0) 17:55:09 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={'\x00\x00\x00\x00\x00\x00\x00@\x00', 0x8400}) 17:55:09 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x110}) 17:55:09 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000007a0000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:09 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x000\x00'}}) [ 1086.083284] binder: 2000:2004 got transaction with invalid data ptr [ 1086.134892] binder_alloc: binder_alloc_mmap_handler: 2000 20001000-20004000 already mapped failed -16 [ 1086.159606] binder: BINDER_SET_CONTEXT_MGR already set [ 1086.165026] binder: 2000:2014 ioctl 40046207 0 returned -16 [ 1086.178477] binder: release 2000:2004 transaction 5557 out, still active [ 1086.186799] binder: undelivered TRANSACTION_COMPLETE [ 1086.206522] binder: send failed reply for transaction 5557, target dead 17:55:09 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0xb3000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:55:09 executing program 1: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x40082406, &(0x7f0000000000)='security\x00') ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) 17:55:09 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00\x00\x00\x00\x00\x00\x001\x00'}}) 17:55:09 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000070000000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:09 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={'\x00\x00\x00@\x00', 0x8400}) 17:55:09 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) 17:55:10 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e657269630000000100"}}) [ 1086.505931] binder: 2029:2033 got transaction with invalid data ptr [ 1086.525905] binder: BINDER_SET_CONTEXT_MGR already set [ 1086.538468] binder_alloc: binder_alloc_mmap_handler: 2029 20001000-20004000 already mapped failed -16 [ 1086.555871] binder: 2029:2042 ioctl 40046207 0 returned -16 [ 1086.580025] binder: release 2029:2033 transaction 5562 out, still active [ 1086.593036] binder: undelivered TRANSACTION_COMPLETE [ 1086.601734] binder: send failed reply for transaction 5562, target dead 17:55:10 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000000000007a0000000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:10 executing program 1: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x40, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x101000, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x1000}, 0x0, 0x0, r1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0xd010}) 17:55:10 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e657269630f00"}}) 17:55:10 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x16a000}], 0x1, 0x0) 17:55:10 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={'\x00?\x00', 0x8400}) [ 1087.082654] binder: BINDER_SET_CONTEXT_MGR already set [ 1087.105942] binder: 2062:2070 ioctl 40046207 0 returned -16 [ 1087.116533] binder_transaction: 23 callbacks suppressed [ 1087.116547] binder: 2062:2067 transaction failed 29189/-3, size 0-0 line 2973 [ 1087.129418] could not allocate digest TFM handle ghash-generic [ 1087.140702] binder: 2062:2070 transaction failed 29189/-3, size 255-0 line 2973 [ 1087.148700] binder: release 2062:2067 transaction 5567 out, still active [ 1087.157149] binder: send failed reply for transaction 5567, target dead [ 1087.193753] could not allocate digest TFM handle ghash-generic 17:55:11 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x41000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:55:11 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) 17:55:11 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="00634040000000000000000000000a000000000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:11 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e65726963000000000000000200"}}) 17:55:11 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={"fdfdffff00", 0x8400}) 17:55:11 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e657269630000000200"}}) 17:55:11 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000000080)="766574000000000000000000bd6800", 0x1) ioctl$TUNGETSNDBUF(r0, 0x800454d3, &(0x7f00000000c0)) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) ioctl$IOC_PR_PREEMPT(r2, 0x401870cb, &(0x7f0000000040)={0x0, 0x101, 0x101, 0x80000000}) [ 1087.601240] binder_transaction: 1 callbacks suppressed [ 1087.601249] binder: 2093:2100 got transaction with invalid data ptr [ 1087.616802] binder: 2093:2100 transaction failed 29201/-14, size 255-0 line 2992 [ 1087.628564] binder_alloc_mmap_handler: 1 callbacks suppressed [ 1087.628578] binder_alloc: binder_alloc_mmap_handler: 2093 20001000-20004000 already mapped failed -16 [ 1087.646204] binder: BINDER_SET_CONTEXT_MGR already set [ 1087.652137] binder: 2093:2104 ioctl 40046207 0 returned -16 [ 1087.658079] binder_alloc_new_buf_locked: 12 callbacks suppressed [ 1087.658086] binder_alloc: 2093: binder_alloc_buf, no vma [ 1087.688878] binder_alloc: 2093: binder_alloc_buf, no vma 17:55:11 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={"0000000000000100", 0x8400}) [ 1087.701572] binder: 2093:2109 transaction failed 29189/-3, size 255-0 line 2973 [ 1087.746284] binder_release_work: 26 callbacks suppressed [ 1087.746291] binder: undelivered TRANSACTION_ERROR: 29201 [ 1087.757397] binder: 2093:2104 transaction failed 29189/-3, size 0-0 line 2973 [ 1087.776045] binder: undelivered TRANSACTION_ERROR: 29189 17:55:11 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndpcmp(&(0x7f00000000c0)='/dev/snd/pcmC#D#p\x00', 0xffffffffffffffe0, 0x129000) ioctl$BLKALIGNOFF(r0, 0x127a, &(0x7f0000000140)) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x200, 0x0) futimesat(r1, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)={{0x77359400}}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) close(r0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) 17:55:11 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696300c000"}}) [ 1087.805790] binder: send failed reply for transaction 5572 to 2093:2100 [ 1087.829281] binder: undelivered TRANSACTION_ERROR: 29189 [ 1087.834811] binder_release_work: 1 callbacks suppressed [ 1087.834816] binder: undelivered TRANSACTION_COMPLETE [ 1087.845970] binder: undelivered TRANSACTION_ERROR: 29189 17:55:11 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000000068000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:11 executing program 1: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000040)={0xffffffffffffffff, r0, 0x0, 0xf, &(0x7f0000000000)="766574000000000000000000bd6800", 0xffffffffffffffff}, 0x30) clock_gettime(0x0, &(0x7f0000001ec0)={0x0, 0x0}) recvmmsg(0xffffffffffffff9c, &(0x7f0000001dc0)=[{{&(0x7f0000000140)=@nfc_llcp, 0x80, &(0x7f00000001c0)=[{&(0x7f0000000280)=""/195, 0xc3}, {&(0x7f0000000380)=""/134, 0x86}], 0x2, 0x0, 0x0, 0xc1}, 0x10000}, {{&(0x7f0000000440)=@pppoe, 0x80, &(0x7f0000000700)=[{&(0x7f00000004c0)=""/184, 0xb8}, {&(0x7f0000000600)=""/214, 0xd6}, {&(0x7f0000000580)=""/61, 0x3d}], 0x3, &(0x7f0000000740)=""/103, 0x67, 0x1ff}, 0x7}, {{&(0x7f00000007c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback}}}, 0x80, &(0x7f0000000a00)=[{&(0x7f0000000840)=""/192, 0xc0}, {&(0x7f0000000900)=""/195, 0xc3}], 0x2, 0x0, 0x0, 0x5}, 0xffffffffffffff67}, {{&(0x7f0000000a40)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}}}, 0x80, &(0x7f0000000d40)=[{&(0x7f0000000ac0)}, {&(0x7f0000000b00)=""/39, 0x27}, {&(0x7f0000000b40)=""/95, 0x5f}, {&(0x7f0000000bc0)=""/3, 0x3}, {&(0x7f0000000c00)=""/240, 0xf0}, {&(0x7f0000000d00)}], 0x6, &(0x7f0000000dc0)=""/4096, 0x1000, 0x5}}], 0x4, 0x100, &(0x7f0000001f00)={r2, r3+10000000}) getsockopt$bt_l2cap_L2CAP_CONNINFO(r4, 0x6, 0x2, &(0x7f0000001f40), &(0x7f0000001f80)=0x6) fcntl$getownex(r0, 0x10, &(0x7f0000000080)={0x0, 0x0}) fcntl$setownex(r1, 0xf, &(0x7f00000000c0)={0x1, r5}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) [ 1088.139051] binder: 2139:2143 got transaction with invalid data ptr [ 1088.146240] binder: 2139:2143 transaction failed 29201/-14, size 255-0 line 2992 [ 1088.155708] binder_alloc: binder_alloc_mmap_handler: 2139 20001000-20004000 already mapped failed -16 [ 1088.156904] binder: BINDER_SET_CONTEXT_MGR already set [ 1088.170623] binder: 2139:2144 ioctl 40046207 0 returned -16 [ 1088.176969] binder_alloc: 2139: binder_alloc_buf, no vma [ 1088.182685] binder_alloc: 2139: binder_alloc_buf, no vma [ 1088.182697] binder: 2139:2143 transaction failed 29189/-3, size 0-0 line 2973 [ 1088.195821] binder: 2139:2145 transaction failed 29189/-3, size 255-0 line 2973 [ 1088.203549] binder: undelivered TRANSACTION_ERROR: 29201 [ 1088.209222] binder: undelivered TRANSACTION_ERROR: 29189 [ 1088.214817] binder: undelivered TRANSACTION_ERROR: 29189 [ 1088.220511] binder: send failed reply for transaction 5577 to 2139:2143 [ 1088.227454] binder: undelivered TRANSACTION_COMPLETE [ 1088.232644] binder: undelivered TRANSACTION_ERROR: 29189 17:55:12 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x6a000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:55:12 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x121000}], 0x1, 0x0) 17:55:12 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={"00000000fffffdfd00", 0x8400}) 17:55:12 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) 17:55:12 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) r1 = socket$nl_crypto(0x10, 0x3, 0x15) ioctl$sock_SIOCINQ(r1, 0x541b, &(0x7f0000000000)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) readv(r0, &(0x7f0000001600)=[{&(0x7f0000000280)=""/219, 0xdb}, {&(0x7f0000000040)=""/84, 0x54}, {&(0x7f0000000600)=""/4096, 0x1000}, {&(0x7f0000000140)=""/139, 0x8b}, {&(0x7f0000000380)=""/71, 0x47}, {&(0x7f0000000400)=""/135, 0x87}, {&(0x7f00000004c0)=""/180, 0xb4}], 0x7) 17:55:12 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000507000000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) [ 1088.634832] audit: type=1400 audit(1543168512.131:200): avc: denied { getattr } for pid=2156 comm="syz-executor1" path="socket:[167130]" dev="sockfs" ino=167130 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_crypto_socket permissive=1 [ 1088.666371] binder: 2157:2159 got transaction with invalid data ptr [ 1088.678062] binder: 2157:2159 transaction failed 29201/-14, size 255-0 line 2992 [ 1088.701775] binder_alloc: binder_alloc_mmap_handler: 2157 20001000-20004000 already mapped failed -16 [ 1088.704262] binder: BINDER_SET_CONTEXT_MGR already set [ 1088.723978] binder: 2157:2171 ioctl 40046207 0 returned -16 17:55:12 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000000)=0xffffffffad648d91, 0x4) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) [ 1088.724006] could not allocate digest TFM handle ghash-generic‘Ë [ 1088.731858] binder_alloc: 2157: binder_alloc_buf, no vma [ 1088.743145] binder_alloc: 2157: binder_alloc_buf, no vma [ 1088.749457] binder: 2157:2159 transaction failed 29189/-3, size 0-0 line 2973 [ 1088.757570] binder: undelivered TRANSACTION_ERROR: 29201 [ 1088.780574] binder: undelivered TRANSACTION_ERROR: 29189 17:55:12 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000060000000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) [ 1088.806057] binder: send failed reply for transaction 5582 to 2157:2159 [ 1088.812012] could not allocate digest TFM handle ghash-generic‘Ë 17:55:12 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e657269630200"}}) [ 1088.881896] binder: undelivered TRANSACTION_COMPLETE 17:55:12 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={"0000000100", 0x8400}) 17:55:12 executing program 1: r0 = syz_open_dev$midi(&(0x7f0000000040)='/dev/midi#\x00', 0x4, 0x200000) modify_ldt$write2(0x11, &(0x7f00000001c0)={0x456, 0x20100000, 0x2000, 0x7ff, 0xe0e, 0x101, 0x5, 0x7ff, 0x7fff, 0x1ac2}, 0x10) sendmsg$nl_route(r0, &(0x7f0000000300)={&(0x7f0000000100), 0xc, &(0x7f00000002c0)={&(0x7f0000000240)=@ipv4_delrule={0x70, 0x21, 0x10, 0x70bd29, 0x25dfdbfc, {0x2, 0x20, 0x14, 0x0, 0x514, 0x0, 0x0, 0x7, 0x4}, [@FRA_FLOW={0x8, 0xb, 0x2}, @FRA_SRC={0x8, 0x2, @remote}, @FRA_GENERIC_POLICY=@FRA_SUPPRESS_PREFIXLEN={0x8, 0xe, 0xfffffffffffffff8}, @FRA_FLOW={0x8, 0xb, 0xbc8}, @FRA_DST={0x8, 0x1, @multicast2}, @FRA_DST={0x8, 0x1, @broadcast}, @FRA_GENERIC_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e22, 0x4e23}}, @FRA_SRC={0x8}, @FRA_FLOW={0x8, 0xb, 0x1ff}, @FRA_DST={0x8, 0x1, @multicast2}]}, 0x70}, 0x1, 0x0, 0x0, 0x1}, 0x80) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(0xffffffffffffff9c, 0x84, 0x71, &(0x7f0000000080)={0x0}, &(0x7f00000000c0)=0x8) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f0000000140)={0x7, 0x8000, 0x80000000, 0x4ab0, r1}, &(0x7f0000000180)=0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200)='/dev/net/tun\x00', 0x2, 0x0) ioctl$RTC_VL_READ(0xffffffffffffffff, 0x80047013, &(0x7f0000000000)) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) 17:55:12 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$vivid(&(0x7f0000000000)='/dev/video#\x00', 0x0, 0x2) ioctl$VIDIOC_SUBDEV_ENUM_DV_TIMINGS(r0, 0xc0945662, &(0x7f0000000040)={0xfffffffffffffffd, 0x80000001, [], {0x0, @reserved}}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket(0x0, 0x80000, 0x67) getsockopt$bt_BT_RCVMTU(r2, 0x112, 0xd, &(0x7f0000000140)=0x7, &(0x7f0000000180)=0x2) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) [ 1089.002543] binder: 2191:2198 got transaction with invalid data ptr [ 1089.027141] binder_alloc: binder_alloc_mmap_handler: 2191 20001000-20004000 already mapped failed -16 [ 1089.063379] binder: BINDER_SET_CONTEXT_MGR already set [ 1089.069571] binder: 2191:2203 ioctl 40046207 0 returned -16 [ 1089.075875] could not allocate digest TFM handle ghash-generic [ 1089.077835] binder_alloc: 2191: binder_alloc_buf, no vma [ 1089.089467] binder_alloc: 2191: binder_alloc_buf, no vma [ 1089.096319] binder: release 2191:2198 transaction 5587 out, still active [ 1089.109550] binder: undelivered TRANSACTION_COMPLETE [ 1089.125089] binder: send failed reply for transaction 5587, target dead [ 1089.136198] could not allocate digest TFM handle ghash-generic 17:55:13 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0xfe000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:55:13 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000000000006c0000000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:13 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00\x00\x001\x00'}}) 17:55:13 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) 17:55:13 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={'\x00\x00\x00?\x00', 0x8400}) 17:55:13 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x87000}], 0x1, 0x0) 17:55:13 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e657269630001cb9100"}}) 17:55:13 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000000)=0x0) syz_open_procfs(r1, &(0x7f0000000040)='net/igmp6\x00') ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) [ 1089.778887] binder: 2235:2241 got transaction with invalid data ptr [ 1089.806669] binder_alloc: binder_alloc_mmap_handler: 2235 20001000-20004000 already mapped failed -16 17:55:13 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) iopl(0x9) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) openat$vimc2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video2\x00', 0x2, 0x0) r1 = syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x1, 0x2) ioctl$KVM_SET_LAPIC(r1, 0x4400ae8f, &(0x7f0000000600)={"81406c919046af6bef5995cc373fe4301c53f1bb43a1666a83e3d82367e137d8d277176630642f477a434012211c8ca637bff9e6f795630a3bd402f41e53e82565bc81633165f0e831a745fe6ffca1877777c86be02e74c5cf41f9941eae3c15495c656ffe2e4d556dd349672633ea0bbf1fdf26522e6748d951e6903a674080bc4be52b26d1fd5ef91816d5b1d51d9fb186e50c419bbd6d0e257d60f00750e4d18797c4688483b15f60d19cfd56a59488a4032cb204991e51efe86fde3957f7d35f1a88075640d74eaebfde6208cf8d0961f2bec9782d279c957d61c7497f123010e5d097b36810381e7318f8bc16d3a949e2a4ce3069dd00b123552fb4846e331a1d4b6c4fb3d2187b945d26cb6b375767bfa92dea9b4eab754b4552a9f2f0802cb627a31a8513b7e76f3d285ff96e479f414a00d7c1baafa33bc558803e973a0f2156f14a3c66c654d2e0d8ca1a64cc03207627d8307542501ddb59dde3f8f12db4eb9c58e4105bcc4ac5dee40f8f83831e437e2d8226632057a9ef535ab8073ffd13a820dadb984c5d5ac13eee937f9f5e978c4f4bf94f749c84ba40564c432ef02e36d610d6511544249ea3b501f5c82f490637288a1f9dc3b1b7d199aa86234a434c0138646e04758a630ff2bd07d1f7b8e8bf8260c4d9424e53d367aff719bf25c70b55417b153b07e80dd9f4e453e30b732b5d01f4b0484a64ae604877bf9942661417cff1ba1a8196b99e75d1bda8cb1233df148a4b1045410bf7781d8d57c2620de5756e89572e78667c87b7f219dbacc077df8dcbb3d4a33b4567070102f74747c73bc4e0c26f447b971d28a52108f0f5f0d0d1989775e4124f9ba53895b1bdd6441fcfd71d541b3d0dff4ce2e9f88c03c268f434efb1a615bce2079ae94ea8ae74fd69a43278c67cf992780025f4a90b2b16af9a407caeaa64545000038ffd7d377da094720c805cc8cec40b9ad15dab9be0184baa62d2dbb8ff5d5a372e78548d965e6804eae5a1dc59c9664a9d71b34a12b55594b0f2a38faf09ecfc1d89e51d7c78daaef42470721836dc2501c184786466f8752c0e39f2aa7b7c184c90f7dcbc62c54d46a10942e8ec7beb4c46003369bfda29f9bbedb172d5eb45b021520b2dc34a2a724d119800d90f4c213a9034820aeceb1f77f879ac979dc2b18e14d1b0fe01e4ac90b90eefb1eaa6d027b125c7ede735f223c8eacb3846f18d57a4c8084c66f6be405049a70365e2c39b5924ef951a1d6ffe0e2e8e2c020a8d1312167a5064711811a084048148e5ea256a6824a0a46a8bf9041333a29957173fe672f16a827b1946c80e315771762a672df379cebe70cbe96354b9fc78f6372941bcf7ac62108847e26a3c827b9eb55bfa7af0b6b511f43d3f5ae498c77af2be4b8ee25e13b055efe0370e4f6784886cd4de6df0155e69347bbdb5"}) [ 1089.856974] binder: BINDER_SET_CONTEXT_MGR already set [ 1089.862583] binder_alloc: 2235: binder_alloc_buf, no vma [ 1089.869498] binder: 2235:2248 ioctl 40046207 0 returned -16 [ 1089.886161] binder_alloc: 2235: binder_alloc_buf, no vma 17:55:13 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e65726963000f00"}}) 17:55:13 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000004000000000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) [ 1089.903804] binder: release 2235:2241 transaction 5592 out, still active [ 1089.916970] binder: undelivered TRANSACTION_COMPLETE [ 1089.940781] binder: send failed reply for transaction 5592, target dead 17:55:13 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={"fffffdfd00", 0x8400}) [ 1090.051105] binder: 2272:2273 got transaction with invalid data ptr [ 1090.078426] binder_alloc: binder_alloc_mmap_handler: 2272 20001000-20004000 already mapped failed -16 [ 1090.107998] binder: BINDER_SET_CONTEXT_MGR already set [ 1090.113529] binder: 2272:2280 ioctl 40046207 0 returned -16 [ 1090.127035] binder: release 2272:2273 transaction 5597 out, still active [ 1090.136883] binder: undelivered TRANSACTION_COMPLETE [ 1090.143427] binder: send failed reply for transaction 5597, target dead 17:55:14 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x33000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:55:14 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/mixer\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_POWER_STATE(r0, 0x800455d1, &(0x7f0000000040)) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x2, 0x0) ioctl$KVM_ASSIGN_SET_MSIX_NR(r0, 0x4008ae73, &(0x7f0000000080)={0x1, 0x5}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) 17:55:14 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic0\x00'}}) 17:55:14 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000740000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:14 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={'\x00\x00@\x00', 0x8400}) 17:55:14 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x96000}], 0x1, 0x0) 17:55:14 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) get_mempolicy(&(0x7f0000000000), &(0x7f0000000040), 0x2, &(0x7f0000ffe000/0x2000)=nil, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) [ 1090.898604] binder: 2295:2296 got transaction with invalid data ptr [ 1090.918581] binder_alloc: binder_alloc_mmap_handler: 2295 20001000-20004000 already mapped failed -16 [ 1090.928217] binder: BINDER_SET_CONTEXT_MGR already set [ 1090.933686] binder: 2295:2309 ioctl 40046207 0 returned -16 [ 1090.941256] binder: release 2295:2296 transaction 5602 out, still active 17:55:14 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="00634040000000000000000000000000007a000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) [ 1090.983656] binder: undelivered TRANSACTION_COMPLETE [ 1090.992575] could not allocate digest TFM handle ghash-generic0 [ 1091.019994] binder: send failed reply for transaction 5602, target dead [ 1091.047256] could not allocate digest TFM handle ghash-generic0 17:55:14 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x7, 0x82000) ioctl$NBD_DISCONNECT(r0, 0xab08) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) 17:55:14 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e65726963570100"}}) [ 1091.089971] binder: 2324:2328 got transaction with invalid data ptr [ 1091.102320] binder_alloc: binder_alloc_mmap_handler: 2324 20001000-20004000 already mapped failed -16 [ 1091.118171] binder: BINDER_SET_CONTEXT_MGR already set [ 1091.124026] binder: 2324:2329 ioctl 40046207 0 returned -16 [ 1091.132789] binder: release 2324:2328 transaction 5607 out, still active [ 1091.141756] binder: undelivered TRANSACTION_COMPLETE 17:55:14 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={"00fdfdffff00", 0x8400}) 17:55:14 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000050000000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) [ 1091.162116] binder: send failed reply for transaction 5607, target dead [ 1091.279042] binder: 2343:2346 got transaction with invalid data ptr [ 1091.285900] could not allocate digest TFM handle ghash-genericW [ 1091.293456] binder_alloc: binder_alloc_mmap_handler: 2343 20001000-20004000 already mapped failed -16 [ 1091.294845] binder: BINDER_SET_CONTEXT_MGR already set [ 1091.308933] binder: 2343:2347 ioctl 40046207 0 returned -16 [ 1091.318737] binder: release 2343:2346 transaction 5612 out, still active [ 1091.327100] binder: undelivered TRANSACTION_COMPLETE [ 1091.332680] binder: send failed reply for transaction 5612, target dead [ 1091.336308] could not allocate digest TFM handle ghash-genericW 17:55:15 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x94000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:55:15 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair(0x1a, 0x6, 0x6, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$KDSETMODE(r0, 0x4b3a, 0x9) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) 17:55:15 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e65726963000000000000000f00"}}) 17:55:15 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000930000000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:15 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={'\x00\x00\x00\x00\x00\x00\x00\x00@\x00', 0x8400}) 17:55:15 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x53000}], 0x1, 0x0) 17:55:15 executing program 1: perf_event_open(&(0x7f0000000200)={0x4, 0xfffffffffffffe17, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0xa) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) [ 1091.971915] binder: 2369:2370 got transaction with invalid data ptr [ 1091.988036] binder_alloc: binder_alloc_mmap_handler: 2369 20001000-20004000 already mapped failed -16 17:55:15 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00\x00\x00\x00kkk\x00'}}) [ 1092.022990] binder: BINDER_SET_CONTEXT_MGR already set [ 1092.029750] binder: 2369:2382 ioctl 40046207 0 returned -16 [ 1092.072515] binder: release 2369:2370 transaction 5617 out, still active [ 1092.085568] binder: undelivered TRANSACTION_COMPLETE 17:55:15 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000007000000000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:15 executing program 1: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) r2 = dup3(r0, r0, 0x80000) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x18, 0xfa00, {0x2, &(0x7f00000001c0)={0xffffffffffffffff}, 0x13f, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r2, &(0x7f00000002c0)={0x1, 0x10, 0xfa00, {&(0x7f0000000180), r3}}, 0x18) ioctl$TUNSETVNETBE(r1, 0x400454de, &(0x7f0000000000)) r4 = syz_open_dev$vbi(&(0x7f0000000040)='/dev/vbi#\x00', 0x1, 0x2) ioctl$sock_SIOCSIFBR(r4, 0x8941, &(0x7f0000000140)=@get={0x1, &(0x7f0000000080)=""/114, 0x4}) [ 1092.116032] binder: send failed reply for transaction 5617, target dead 17:55:15 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={"0000000000fffffdfd00", 0x8400}) 17:55:15 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00\x00\x000\x00'}}) [ 1092.266651] binder_transaction: 22 callbacks suppressed [ 1092.266668] binder: 2406:2408 transaction failed 29201/-14, size 255-0 line 2992 [ 1092.296078] binder: BINDER_SET_CONTEXT_MGR already set [ 1092.301832] binder: 2406:2412 ioctl 40046207 0 returned -16 [ 1092.309272] binder: 2406:2408 transaction failed 29189/-3, size 0-0 line 2973 [ 1092.324874] binder: 2406:2416 transaction failed 29189/-3, size 255-0 line 2973 [ 1092.335393] binder: send failed reply for transaction 5622 to 2406:2408 17:55:16 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x129000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:55:16 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000040)={0x0}) ioctl$DRM_IOCTL_RM_CTX(0xffffffffffffffff, 0xc0086421, &(0x7f0000000080)={r1, 0x3}) 17:55:16 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00kkk\x00'}}) 17:55:16 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000680000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:16 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={"000000000000000100", 0x8400}) 17:55:16 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0xfd000}], 0x1, 0x0) 17:55:16 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00\x00\x00\x00\x00\x00\x000\x00'}}) 17:55:16 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpuacct.usage_percpu\x00', 0x0, 0x0) ioctl$TUNSETNOCSUM(r0, 0x400454c8, 0x1) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={"697036746e6c300000000000150500", 0x2000}) ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000140)=""/156) [ 1092.944617] binder_transaction: 1 callbacks suppressed [ 1092.944625] binder: 2434:2442 got transaction with invalid data ptr [ 1092.957211] binder: 2434:2442 transaction failed 29201/-14, size 255-0 line 2992 [ 1092.967467] binder_alloc_mmap_handler: 1 callbacks suppressed [ 1092.967483] binder_alloc: binder_alloc_mmap_handler: 2434 20001000-20004000 already mapped failed -16 [ 1093.009029] binder: BINDER_SET_CONTEXT_MGR already set [ 1093.022851] binder: 2434:2444 ioctl 40046207 0 returned -16 17:55:16 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e657269630000000f00"}}) 17:55:16 executing program 1: r0 = epoll_create1(0x80000) fchmod(r0, 0x10) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x40000, 0x0) ioctl$GIO_SCRNMAP(r1, 0x4b40, &(0x7f0000000040)=""/95) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x8000}) [ 1093.061386] binder_alloc_new_buf_locked: 12 callbacks suppressed [ 1093.061393] binder_alloc: 2434: binder_alloc_buf, no vma [ 1093.079860] binder: 2434:2456 transaction failed 29189/-3, size 0-0 line 2973 [ 1093.088138] binder_alloc: 2434: binder_alloc_buf, no vma [ 1093.113171] binder: 2434:2444 transaction failed 29189/-3, size 255-0 line 2973 [ 1093.130101] binder_release_work: 27 callbacks suppressed [ 1093.130108] binder: undelivered TRANSACTION_ERROR: 29201 [ 1093.148795] binder: undelivered TRANSACTION_ERROR: 29189 [ 1093.162017] binder: undelivered TRANSACTION_ERROR: 29189 17:55:16 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000010000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:16 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00\x00\x00@\x00'}}) [ 1093.185810] binder: send failed reply for transaction 5627 to 2434:2442 [ 1093.199246] binder_release_work: 1 callbacks suppressed [ 1093.199252] binder: undelivered TRANSACTION_COMPLETE [ 1093.225353] binder: undelivered TRANSACTION_ERROR: 29189 [ 1093.267203] binder: 2477:2478 got transaction with invalid data ptr [ 1093.274084] binder: 2477:2478 transaction failed 29201/-14, size 255-0 line 2992 [ 1093.295735] binder_alloc: binder_alloc_mmap_handler: 2477 20001000-20004000 already mapped failed -16 [ 1093.300810] binder: BINDER_SET_CONTEXT_MGR already set [ 1093.311339] binder: 2477:2483 ioctl 40046207 0 returned -16 [ 1093.323321] binder_alloc: 2477: binder_alloc_buf, no vma [ 1093.329706] binder_alloc: 2477: binder_alloc_buf, no vma [ 1093.337341] binder: 2477:2478 transaction failed 29189/-3, size 0-0 line 2973 [ 1093.346644] binder: 2477:2485 transaction failed 29189/-3, size 255-0 line 2973 [ 1093.354560] binder: undelivered TRANSACTION_ERROR: 29201 [ 1093.361383] binder: undelivered TRANSACTION_ERROR: 29189 [ 1093.368184] binder: undelivered TRANSACTION_ERROR: 29189 [ 1093.373883] binder: send failed reply for transaction 5632 to 2477:2478 [ 1093.382582] binder: undelivered TRANSACTION_COMPLETE [ 1093.387929] binder: undelivered TRANSACTION_ERROR: 29189 17:55:17 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x2a000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:55:17 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={"0000000000ffffffff00", 0x8400}) 17:55:17 executing program 1: r0 = socket$alg(0x26, 0x5, 0x0) fdatasync(r0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x5, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x10000, 0x0) r2 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x42b, 0x10000) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r2, 0xc08c5336, &(0x7f00000000c0)={0x298c, 0x6, 0x3294, 'queue0\x00', 0x4}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000005c0)={'bond_slave_1\x00', 0x43732e5398416f1a}) 17:55:17 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e65726963015700"}}) 17:55:17 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000000004000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:17 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x17000}], 0x1, 0x0) [ 1094.018758] binder: 2501:2504 got transaction with invalid data ptr [ 1094.043884] binder: 2501:2504 transaction failed 29201/-14, size 255-0 line 2992 17:55:17 executing program 1: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) fcntl$setstatus(r0, 0x4, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0xa0001, 0x0) [ 1094.072553] could not allocate digest TFM handle ghash-genericW [ 1094.089575] binder_alloc: binder_alloc_mmap_handler: 2501 20001000-20004000 already mapped failed -16 [ 1094.089670] binder: BINDER_SET_CONTEXT_MGR already set [ 1094.129712] could not allocate digest TFM handle ghash-genericW [ 1094.144430] binder: 2501:2520 ioctl 40046207 0 returned -16 17:55:17 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e65726963f7900c00"}}) [ 1094.173660] binder_alloc: 2501: binder_alloc_buf, no vma [ 1094.208642] binder: undelivered TRANSACTION_ERROR: 29201 [ 1094.216837] binder_alloc: 2501: binder_alloc_buf, no vma [ 1094.222552] binder: undelivered TRANSACTION_ERROR: 29189 17:55:17 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={'\x00\x00\x00\x00?\x00', 0x8400}) 17:55:17 executing program 1: r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000240)='/dev/audio\x00', 0x3, 0x0) ioctl$SG_GET_LOW_DMA(0xffffffffffffffff, 0x227a, &(0x7f0000000000)) arch_prctl$ARCH_SET_GS(0x1001, 0x80000001) getsockopt$inet_sctp_SCTP_ADAPTATION_LAYER(r0, 0x84, 0x7, &(0x7f0000000140), &(0x7f0000000200)=0x4) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r0, 0xc0045516, &(0x7f0000000040)=0x562d81e5) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000000000000, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0x8112}, 0xc020}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={"766574000000000000000000bd6800", 0x8000}) 17:55:17 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="00634040000000000000000000000000006c000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) [ 1094.245588] binder: send failed reply for transaction 5637 to 2501:2504 [ 1094.272831] binder: undelivered TRANSACTION_COMPLETE 17:55:17 executing program 1: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$VIDIOC_G_FBUF(r0, 0x8030560a, &(0x7f0000000140)={0x10, 0x10, &(0x7f00000000c0)="53f53fa366864333387adde59581b25ea04cccec29e14a779cd8ad", {0x6, 0xb8, 0x7f777f5f, 0x0, 0x0, 0x0, 0x3, 0x100}}) fsetxattr$trusted_overlay_nlink(r0, &(0x7f0000000040)='trusted.overlay.nlink\x00', &(0x7f0000000080)={'L+', 0xea}, 0x28, 0x1) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x10}) ioctl$EXT4_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000000)=0x13) [ 1094.366812] could not allocate digest TFM handle ghash-generic÷ [ 1094.373801] binder: 2545:2549 got transaction with invalid data ptr [ 1094.392362] binder: BINDER_SET_CONTEXT_MGR already set [ 1094.392374] binder_alloc: binder_alloc_mmap_handler: 2545 20001000-20004000 already mapped failed -16 [ 1094.408109] could not allocate digest TFM handle ghash-generic÷ [ 1094.425332] binder: 2545:2555 ioctl 40046207 0 returned -16 [ 1094.431724] binder_alloc: 2545: binder_alloc_buf, no vma [ 1094.438626] binder_alloc: 2545: binder_alloc_buf, no vma [ 1094.445385] binder: release 2545:2549 transaction 5642 out, still active [ 1094.453401] binder: undelivered TRANSACTION_COMPLETE [ 1094.459466] binder: send failed reply for transaction 5642, target dead 17:55:18 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x126000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:55:18 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic1\x00'}}) 17:55:18 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x0, 0x0) setsockopt$SO_RDS_TRANSPORT(r0, 0x114, 0x8, &(0x7f00000000c0)=0xffffffffffffffff, 0x4) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) r2 = open(&(0x7f0000000000)='./file0\x00', 0x40000, 0x40) ioctl$SG_GET_NUM_WAITING(r2, 0x227d, &(0x7f0000000040)) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) 17:55:18 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000006000000000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:18 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={"000000000100", 0x8400}) 17:55:18 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x22000}], 0x1, 0x0) [ 1095.017262] binder: 2576:2586 got transaction with invalid data ptr [ 1095.038192] binder_alloc: binder_alloc_mmap_handler: 2576 20001000-20004000 already mapped failed -16 [ 1095.040979] binder: BINDER_SET_CONTEXT_MGR already set 17:55:18 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000280)={{{@in=@dev, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@local}}, &(0x7f00000001c0)=0xe8) syz_mount_image$msdos(&(0x7f0000000080)='msdos\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x6, &(0x7f00000006c0)=[{&(0x7f0000000140)="77e5a9628107370d6412b419a67526", 0xf, 0x320}, {&(0x7f0000000180), 0x0, 0x1}, {&(0x7f00000004c0)="fb56008be8970c3ddd51acb318f7102dda07cbc6a1450cc5e7ae8f4cb8cf4e53b81dc6755b06264dc7848d3955d0d71cf995d5dc993816e0ee26b49b166284371eb51dcbab1aa15bbab0bde699edc98c9208de5562fd599a224ad6e1b98c931a73a6804193aa2d89f3c8f741e0a32808331a4c7ea6269c6fbd77334a2d00b9299b7407f5f87b58828b81ff6ddd70cfbb32f692235f46dbdbe2d32a8789a01e372985cf4d3b294769f236e8de7a80682b30d9c810cc0d4af1ef03755fc85651c300db49914e1cce738581d63724d7afc36d8134b4d12be68c43eab2dcda", 0xdd, 0xffff}, {&(0x7f0000000600)="99e55f68a7cf5601c850a6b2e19920ff8ac3be7d6c6082", 0x17, 0x4}, {&(0x7f0000000640)="be5e9862be2121edef14740b3b8e2ca4ba387fea9c85e2", 0x17, 0x2}, {&(0x7f0000000680)="79306d3047673532716f1361610d3d48b9db3cae54c4aca821", 0x19, 0x8}], 0x20000, &(0x7f0000000780)={[], [{@obj_user={'obj_user'}}, {@subj_user={'subj_user', 0x3d, "776c616e30a3"}}, {@context={'context', 0x3d, 'root'}}, {@euid_eq={'euid', 0x3d, r2}}, {@euid_eq={'euid', 0x3d, r2}}, {@fsname={'fsname'}}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@euid_eq={'euid', 0x3d, r2}}]}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x8200, 0x100) getsockopt$inet_IP_IPSEC_POLICY(r3, 0x0, 0x10, &(0x7f00000003c0)={{{@in6=@loopback, @in=@loopback}}, {{@in=@rand_addr}, 0x0, @in6=@dev}}, &(0x7f0000000040)=0xe8) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f0000000380)=r1) [ 1095.062621] could not allocate digest TFM handle ghash-generic1 [ 1095.062874] binder: 2576:2594 ioctl 40046207 0 returned -16 [ 1095.075064] binder_alloc: 2576: binder_alloc_buf, no vma [ 1095.082759] binder_alloc: 2576: binder_alloc_buf, no vma [ 1095.095768] binder: release 2576:2586 transaction 5647 out, still active [ 1095.105962] binder: undelivered TRANSACTION_COMPLETE 17:55:18 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000000000005070000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) [ 1095.129563] binder: send failed reply for transaction 5647, target dead [ 1095.136594] could not allocate digest TFM handle ghash-generic1 17:55:18 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e65726963000000c000"}}) 17:55:18 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={'\x00\x00\x00\x00\x00\x00\x00\x00?\x00', 0x8400}) 17:55:18 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_PIT2(r1, 0x4070aea0, &(0x7f0000000000)={[{0x401, 0x7, 0x5c, 0x1ff, 0x3, 0x9, 0x81, 0xd0bc, 0x1, 0x101c, 0x0, 0x80000000, 0x8}, {0x20, 0x100000000, 0x2, 0x2, 0x100000001, 0xb482, 0x7, 0x2, 0xfffffffffffffffc, 0x5, 0x10001, 0x10001}, {0x6, 0x6, 0x5, 0x7, 0x27eb2792, 0x8, 0xffffffff7fffffff, 0xfffffffffffffffd, 0x5, 0x4, 0x5ba, 0x9, 0x1f5}], 0x8}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) [ 1095.259212] binder: 2612:2615 got transaction with invalid data ptr [ 1095.284665] binder_alloc: binder_alloc_mmap_handler: 2612 20001000-20004000 already mapped failed -16 17:55:18 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e65726963000c90f700"}}) [ 1095.320357] binder: BINDER_SET_CONTEXT_MGR already set [ 1095.336038] binder: 2612:2620 ioctl 40046207 0 returned -16 [ 1095.356790] binder: release 2612:2615 transaction 5652 out, still active [ 1095.367119] binder: undelivered TRANSACTION_COMPLETE [ 1095.379175] binder: send failed reply for transaction 5652, target dead 17:55:19 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x17b000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:55:19 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) syz_mount_image$btrfs(&(0x7f0000000080)='btrfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000500)="8da4363a00000000000000000000004d0100000000fffffff600000000000000ecf6f2a2299748aeb81e1b00920efd9a000001", 0x33, 0x10000}], 0x0, 0x0) r1 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x20000) getsockopt$bt_sco_SCO_CONNINFO(r1, 0x11, 0x2, &(0x7f0000000040)=""/48, &(0x7f00000000c0)=0x30) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) 17:55:19 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000000000fffffdfd0000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:19 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696300feffff00"}}) 17:55:19 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={"00000000000000000100", 0x8400}) 17:55:19 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x178000}], 0x1, 0x0) 17:55:19 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e65726963fffffe00"}}) 17:55:19 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x59, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000000000000, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x4802, 0x0) sendmsg$unix(r1, &(0x7f0000000600)={&(0x7f0000000080)=@abs={0x1, 0x0, 0x4e21}, 0x6e, &(0x7f0000000500)=[{&(0x7f0000000140)="3ec32247515418dbbac87a7530cca364b7a942ea86f5236c9f2a790846579ebfb5314f364498c1c3216203b431dfeb707e79edb318145b91f774b299837d541f301c473660226616f2ce992432dba38ee1f9037f5049e702f276b5f09616925ec2a72eac5f326d25ad4585a4c949bf825fc58e9ef66b3ac05e9f2a5227f97a14d7dab14d21a9d4b6077786db4230178bd480cb3b6d377a3643c143104c615a08b5", 0xa1}, {&(0x7f0000000280)="d392aef0fd8beeb171b31c95232f5a16d7290cc10862e3199f82fc93a82911a658f33f62f1355a111cbcb64f82dfe1d03bf56cabbc565a249ddbdd5d7abb20b25b3de270e086d91e94784add58e3d47d59b28c10777bcd9ceef8066be1c3003dc81fd3d76926566115f94fa6691fcc958367ed3ef6862dca2db116e5060b98a073e8c4c571c47e00b3f45c745e976eeb57", 0x91}, {&(0x7f0000000340)="ac826a50af35f81607006ef06e40786e153230a99d7e3bd6aecd40125b72e5edb1c5d65d947c46ce2aa5e389e5", 0x2d}, {&(0x7f0000000380)="4dfb04e4f3e2c5cfb57d9343e2a254624bf1a7a95d43341510cc01c717b43828e95704707ec15a4921e4f36bc201b4c3d4ab41364ef74800c1468624326bb49124dd0697a3ced96fe745bbd8787769bc51caa4730372de2d52963f390dadd5cf10bec16eeb1f71d524deb1d51ba653e692cbaf3a82f5af9cfbbdc1558cf4cccc6d83fc7a4e4520efb8adf74fa22a19816e7c8381ff9b6ed57d363b12ec94d9ccf81f155ae56827ff0f58d48c47f89e991f1ae105d91dc2534b8b06fd558702129f66236935dec8", 0xc7}, {&(0x7f0000000480)="999edfea7248028e4d57c07d567f17a9934ce333658a7f2ed03a293d41f096017fbd8d4cb2b36351f97eba13207a99d1159267734d9fb52c3b072937e1fd776d906a", 0x42}], 0x5, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000000000000100000001000000", @ANYRES32=r0, @ANYBLOB], 0x18, 0x800}, 0x8000) ioctl$VIDIOC_STREAMON(r1, 0x40045612, &(0x7f0000000040)=0x5) [ 1096.165580] binder: 2645:2652 got transaction with invalid data ptr [ 1096.198477] binder_alloc: binder_alloc_mmap_handler: 2645 20001000-20004000 already mapped failed -16 [ 1096.199153] binder: BINDER_SET_CONTEXT_MGR already set [ 1096.233256] binder: 2645:2662 ioctl 40046207 0 returned -16 [ 1096.245022] binder: release 2645:2652 transaction 5657 out, still active [ 1096.259734] binder: undelivered TRANSACTION_COMPLETE [ 1096.276597] binder: send failed reply for transaction 5657, target dead 17:55:19 executing program 1: r0 = getpgrp(0x0) r1 = getpgid(r0) getpgrp(r1) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) 17:55:19 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={'\x00\x00\x00\x00@\x00', 0x8400}) 17:55:19 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000000020000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:19 executing program 1: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000280)={{{@in=@rand_addr, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in6=@ipv4={[], [], @local}}}, &(0x7f00000000c0)=0xe8) fstat(r0, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$fuseblk(&(0x7f0000000000)='/dev/loop0\x00', &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='fuseblk\x00', 0x20000, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0xa000}, 0x2c, {'user_id', 0x3d, r1}, 0x2c, {'group_id', 0x3d, r2}, 0x2c, {[{@default_permissions='default_permissions'}, {@max_read={'max_read', 0x3d, 0x80}}, {@blksize={'blksize', 0x3d, 0x1000}}, {@blksize={'blksize', 0x3d, 0xc00}}, {@allow_other='allow_other'}, {@max_read={'max_read', 0x3d, 0x9}}, {@blksize={'blksize', 0x3d, 0x400}}], [{@euid_lt={'euid<', r3}}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/net/tun\x00'}}, {@pcr={'pcr', 0x3d, 0x7}}]}}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) [ 1096.437372] could not allocate digest TFM handle ghash-genericÿÿþ [ 1096.442086] binder: 2684:2688 got transaction with invalid data ptr [ 1096.472869] binder_alloc: binder_alloc_mmap_handler: 2684 20001000-20004000 already mapped failed -16 [ 1096.481179] binder: BINDER_SET_CONTEXT_MGR already set [ 1096.490186] binder: 2684:2693 ioctl 40046207 0 returned -16 [ 1096.494883] could not allocate digest TFM handle ghash-genericÿÿþ [ 1096.498053] binder: release 2684:2688 transaction 5662 out, still active [ 1096.515319] binder: undelivered TRANSACTION_COMPLETE [ 1096.548277] binder: send failed reply for transaction 5662, target dead 17:55:20 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0xd3000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:55:20 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e65726963000000000000015700"}}) 17:55:20 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000000000007100000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:20 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat(0xffffffffffffffff, &(0x7f00000000c0)='./file0\x00', 0x0, 0x40) ioctl$TUNSETSNDBUF(r0, 0x400454d4, &(0x7f0000000140)=0x1f) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) r2 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x40, 0x0) setsockopt$inet6_MRT6_ADD_MIF(r2, 0x29, 0xca, &(0x7f0000000040)={0xdd4, 0x1, 0x66, 0x2, 0x2ea8}, 0xc) syz_genetlink_get_family_id$team(&(0x7f0000000080)='team\x00') 17:55:20 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={"00fffffdfd00", 0x8400}) 17:55:20 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x29000}], 0x1, 0x0) 17:55:20 executing program 1: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fsetxattr$security_ima(r0, &(0x7f0000000000)='security.ima\x00', &(0x7f0000000040)=@ng={0x4, 0x11, "cd458e0629a98f58a67c"}, 0xc, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$ASHMEM_SET_PROT_MASK(r0, 0x40087705, &(0x7f0000000080)={0x100, 0x9}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) 17:55:20 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00\x00\x00\x00\x00\x00\x00@\x00'}}) [ 1097.199137] binder: 2717:2723 got transaction with invalid data ptr [ 1097.222111] binder_alloc: binder_alloc_mmap_handler: 2717 20001000-20004000 already mapped failed -16 [ 1097.238851] binder: BINDER_SET_CONTEXT_MGR already set [ 1097.258581] binder: 2717:2730 ioctl 40046207 0 returned -16 [ 1097.276166] binder_transaction: 18 callbacks suppressed [ 1097.276182] binder: 2717:2738 transaction failed 29189/-3, size 0-0 line 2973 17:55:20 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='memory.stat\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffff9c, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000040)={0xffffffffffffffff}, 0x13f, 0x100f}}, 0x20) ioctl$DRM_IOCTL_IRQ_BUSID(r0, 0xc0106403, &(0x7f00000000c0)={0x4, 0x8ef, 0x5d, 0xa82f}) write$RDMA_USER_CM_CMD_CONNECT(r0, &(0x7f0000000280)={0x6, 0x118, 0xfa00, {{0xb4f, 0x4, "ab8fa9c2ae552ea341edd433b331069e50f4e8b39a42cba4eb2b9a42984fed94483716b518351bd5aab7424b0d6ce1b1d0316813488328451159c111c866a0f14a23d44eb720aedaf61ad4d46dee5b7db3aef4712c6802f483e836be8ea0426473d9066503f5f0e9749820f642c9cf525eac7c3ee0d8e59efd1380d73d3cfc1ba6b0265b2fb87b892386417bfb4236bbbf8c2c3b5d06159f63bc20fc6751aa494c2c488276202ba2aeededc58cd0b266c8883596181eaaa4bbd43fba185041c869c8935072f5bd33bb7c3b0c0745ad5a4bffa227a343616e38e3e91313cbf6a76ff59bd155381d6047ceb5ce78d482a558fa5421ed06e6ce82357824d50d37af", 0x5c, 0x1, 0x101, 0x3, 0x9a3, 0x5, 0x2, 0x3}, r1}}, 0x120) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000003c0)={{{@in=@broadcast, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@rand_addr}, 0x0, @in6=@mcast2}}, &(0x7f00000001c0)=0xe8) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f00000004c0)={{{@in, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@rand_addr}, 0x0, @in6=@mcast2}}, &(0x7f00000005c0)=0xe8) r4 = getgid() getresgid(0xffffffffffffffff, &(0x7f0000000600)=0x0, &(0x7f0000000640)) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000001ac0)=@filter={'filter\x00', 0xe, 0x6, 0x1440, [0x0, 0x20000680, 0x200006b0, 0x20000b20], 0x0, &(0x7f0000000180), &(0x7f0000000680)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x2, [{{{0x3, 0x1, 0xf9, 'veth1_to_bond\x00', 'ip6gretap0\x00', 'ip6gretap0\x00', 'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, [0xff, 0x0, 0xff, 0x0, 0xff, 0xff], @random="97945c22ff75", [0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0x70, 0xf0, 0x220}, [@common=@AUDIT={'AUDIT\x00', 0x8, {{0x1}}}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x401, 'syz0\x00', 0xfffffffffffffffb}}}]}, @common=@SECMARK={'SECMARK\x00', 0x108, {{0x1, 0x8001, 'system_u:object_r:src_t:s0\x00'}}}}, {{{0x9, 0x28, 0x892f, 'ip6tnl0\x00', 'ifb0\x00', 'veth0\x00', 'lo\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, [0xff, 0x0, 0xff, 0x0, 0xff], @remote, [0xff, 0xff, 0xff, 0x0, 0xff], 0x70, 0x1d8, 0x220}, [@common=@SECMARK={'SECMARK\x00', 0x108, {{0x1, 0x4, 'system_u:object_r:dpkg_var_lib_t:s0\x00'}}}, @common=@mark={'mark\x00', 0x10, {{0x0, 0xb347e777de846bd4}}}]}, @common=@ERROR={'ERROR\x00', 0x20, {"f348018285b75b17140df4fe35be0f10f74379b552b9b8b881f211e6ad0b"}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffc, 0x2, [{{{0x1b, 0x10, 0xefdf, 'ip6gre0\x00', 'syzkaller1\x00', 'veth0_to_bond\x00', 'team_slave_1\x00', @broadcast, [0xff, 0x0, 0xff, 0xff, 0xff, 0xff], @random="7996a69f9ae1", [0x0, 0xff, 0xff, 0x0, 0x0, 0xff], 0x70, 0xb8, 0x100}, [@common=@ERROR={'ERROR\x00', 0x20, {"0eb925f266f6fc473006e2d3d357790c395cda59d3ebf3fd1b39cb333626"}}]}, @common=@ERROR={'ERROR\x00', 0x20, {"97a0207c4fa4e5a40ec14c1e100106de708402020d7bbaddc5af78be5269"}}}, {{{0x0, 0x40, 0x883e, 'bcsh0\x00', 'gre0\x00', 'vcan0\x00', 'eql\x00', @empty, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], @local, [0xff, 0x0, 0x0, 0x0, 0xff, 0xff], 0x8a8, 0xb08, 0xb58, [@u32={'u32\x00', 0x7c0, {{[{[{0x3, 0x2}, {0x81, 0x2}, {0x3f, 0x2}, {0x7fff, 0x2}, {0x3, 0x3}, {0x200, 0x3}, {0x4, 0x3}, {0x20, 0x1}, {0x8000, 0x1}, {0x100000001, 0x3}, {0x4, 0x2}], [{0x54, 0x6}, {0x7, 0x4}, {0xfff, 0x7fffffff}, {0x49ac, 0x6}, {0x101, 0x32e3db66}, {0x5, 0x2b39}, {0x2, 0xaad}, {0x7, 0x2841f08a}, {0x1, 0xf9}, {0x5, 0xc5d}, {0x7, 0x7}], 0xa, 0xa}, {[{0x101, 0x2}, {0xa26, 0x2}, {0x4, 0x3}, {0xf4a, 0x1}, {0x2, 0x3}, {}, {0x33a, 0x3}, {0x1, 0x1}, {0x5}, {0x40, 0x2}, {0x0, 0x2}], [{0xdb9, 0x4}, {0xcf75, 0x8}, {0x1, 0x1ff}, {0x8, 0x7}, {0x0, 0x8}, {0x8, 0x1}, {0xfffffffffffffc00}, {0x5, 0x2}, {0xffffffffffffffff, 0x7}, {0x1, 0x8000}, {0xe226, 0x1ff}], 0x6, 0x4}, {[{0x1, 0xc0cbeca54ce182c7}, {0x9, 0x2}, {0x3e59}, {0xf, 0x3}, {0x7f, 0x3}, {0xd6a, 0x3}, {0x1, 0x1}, {0x2, 0x1}, {0x6, 0x2}, {0x0, 0x3}, {0x2, 0x3}], [{0x7e0, 0x5fc}, {0x5, 0x100}, {0xfffffffffffffff8, 0x1000}, {0x4, 0x9}, {0x7, 0x4}, {0x0, 0x8001}, {0x6, 0x401}, {0x7, 0x101}, {0x7, 0x10001}, {0x4, 0x10001}, {0x0, 0x30000000000000}], 0xb, 0x4}, {[{0xcb, 0x3}, {0x1}, {0x1000, 0x3}, {0x0, 0x1}, {0xe981}, {0xfffffffffffffe15, 0x3}, {0x4, 0x3}, {0x3ff, 0x3}, {0xfffffffffffffc00, 0x1}, {0x100000001, 0x3}, {0x5}], [{0x9, 0xa6}, {0x8001, 0x3}, {0x101, 0x9}, {0x3f, 0x2}, {0x5f29, 0x7fffffff}, {0x0, 0x68}, {0x5, 0xf32}, {0x20, 0xfffffffffffffff9}, {0xffffffff}, {0x5, 0x7}, {0x1f, 0x9}], 0x1, 0x9}, {[{0x8, 0x3}, {0x7, 0x3}, {0x4, 0x3}, {0x9}, {0x5, 0x3}, {0x97}, {0xffffffff, 0x2}, {0xffffffff, 0x3}, {0x84}, {0x95f4}, {0x5, 0x3}], [{0x1000, 0x8}, {0x8, 0x8}, {0x10000, 0x8}, {0x7ff, 0x5}, {0xd9, 0x3}, {0x7f, 0x6}, {0xaed, 0x3}, {0x4, 0x49f}, {0x8, 0x5}, {0x0, 0x5}, {0x100000000, 0x7fffffff}], 0x3, 0x2}, {[{0x3}, {0x77, 0x2}, {0x3, 0x2}, {0x42, 0x3}, {0xffffffffffffff53}, {0x1}, {0x7, 0x1}, {0xfffffffffffffffc}, {0xfff, 0x3}, {0x8001, 0x3}, {0x4, 0x3}], [{0x3f, 0x1400000000000000}, {0x7f, 0xff}, {0x55a82c61, 0x101}, {0x2, 0x10000}, {0x9, 0x10000}, {0x0, 0x3ff}, {0x2, 0x1}, {0x5, 0x1000}, {0x57b6eeb5, 0xfffffffffffffff7}, {0x618, 0xffffffffffffff7f}, {0x3, 0x7a}], 0xa, 0x7}, {[{0x112ca00000000}, {0x0, 0x3}, {0x6, 0x587aa3a24cd23368}, {0x9b33}, {0x400, 0x2}, {0x2ad}, {0xb585, 0x1}, {0x0, 0x3}, {0x4, 0x1}, {0x100000000, 0x3}, {0x4, 0x2}], [{0x200, 0x9}, {0x1, 0x81}, {0x6b0e, 0x3}, {0x0, 0x3f}, {0x4, 0x3}, {0x1, 0x2}, {0x101, 0x2}, {0xff, 0x1}, {0x3, 0x9}, {0x7, 0x5}, {0xfffffffffffffffa, 0x6b}], 0x3, 0x1}, {[{0xe178}, {0x1, 0x2}, {0x100000001, 0x1}, {0x3f, 0x3}, {0xff, 0x2}, {0x3, 0x3}, {0x10001, 0x2}, {0xc2, 0x1}, {0x6}, {0x9014, 0x3}, {0x200, 0x3}], [{0xfffffffffffffffb, 0xed}, {0x8, 0x100000001}, {0x3, 0x5}, {0x10000, 0x3f}, {0x7, 0x2c}, {0x5}, {0x554}, {0x100, 0xa5}, {0x0, 0x7fff}, {0x4, 0x6}, {0x1, 0x10000}], 0xb, 0x6}, {[{0x5, 0x3}, {0x8, 0x2}, {0x2}, {0x1, 0x3}, {0x6}, {0xff, 0x3}, {0x0, 0x2}, {0x0, 0x3}, {0x9}, {0x100000001, 0x1}, {0xfffffffffffffffc, 0x1}], [{0x7, 0x1fffffffc0000}, {0xfff, 0x2648}, {0x1ff, 0x2}, {0xfec, 0xe6}, {0x7fffffff, 0x7}, {0x0, 0x20}, {0x8}, {0x9, 0xffff}, {0x7, 0x6}, {0x5, 0x909}, {0x800, 0x6}], 0x5}, {[{0x3, 0x3}, {0x9}, {0x8, 0x3}, {0x2ab6000000000000, 0x2}, {0x7, 0x1}, {0x100000001, 0x2}, {0x7, 0x2}, {0x3a61cc8e, 0x3}, {0x2, 0x3}, {0x7fff, 0x1}, {0x7ff}], [{0x3f, 0x80}, {0x400, 0x8}, {0x1ff, 0x401}, {0x7, 0xe58}, {0xba, 0x20}, {0xb8b, 0x80}, {0x2, 0x7}, {0x1, 0xdc17}, {0x7f, 0x1e1}, {0x4, 0x100000000}, {0xca5, 0x8}], 0xa, 0xb}, {[{0x7, 0x2}, {0x1}, {0x1, 0x2}, {0x3, 0x3}, {0x2, 0x2}, {0x2, 0x3}, {0x7, 0x3}, {0x100000001, 0x2}, {0x3a95, 0x2}, {0xfff, 0x1}, {0xffffffffffffff30, 0x3}], [{0xb8b, 0x3f7}, {0x20, 0x5}, {0x3f, 0x7fffffff}, {0x0, 0x9}, {0x33732f9b, 0x6}, {0x9867, 0x6}, {0x40}, {0x0, 0x4000000000}, {0x9, 0x7f}, {0x99c, 0x80}, {0x7756, 0x3}], 0x1}], 0xa}}}, @helper={'helper\x00', 0x28, {{0x0, 'RAS\x00'}}}]}, [@common=@SECMARK={'SECMARK\x00', 0x108, {{0x1, 0x4, 'system_u:object_r:auditctl_exec_t:s0\x00'}}}, @common=@SECMARK={'SECMARK\x00', 0x108, {{0x1, 0x7, '/usr/sbin/cups-browsed\x00'}}}]}, @common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x401, 'syz0\x00', 0x200}}}}]}, {0x0, '\x00', 0x4, 0xffffffffffffffff, 0x2, [{{{0x5, 0x1d, 0xf7, 'gre0\x00', 'dummy0\x00', 'lo\x00', 'ipddp0\x00', @local, [0x0, 0xff, 0xff, 0x0, 0x0, 0xff], @random="aba3ba6786c3", [0x0, 0xff, 0xff, 0x0, 0xff, 0xff], 0x110, 0x110, 0x240, [@arp={'arp\x00', 0x38, {{0x102, 0x8906, 0x9, @dev={0xac, 0x14, 0x14, 0x19}, 0xffffffff, @multicast1, 0xffffff00, @local, [0x0, 0xff, 0x0, 0xff, 0x0, 0xff], @remote, [0xff, 0xff, 0xff, 0xff, 0x0, 0xff], 0x40, 0x20}}}, @owner={'owner\x00', 0x18, {{r2, r3, r4, r5, 0x1, 0x2}}}]}}, @common=@SECMARK={'SECMARK\x00', 0x108, {{0x1, 0x3, 'system_u:object_r:sshd_var_run_t:s0\x00'}}}}, {{{0x5, 0x54, 0x3, 'veth0_to_bridge\x00', '\x00', 'teql0\x00', 'bcsf0\x00', @random="05da30c4bdd6", [0xff, 0xff, 0x0, 0xff, 0x0, 0xff], @random="2a9f9058bc6a", [0x0, 0xff, 0x0, 0xff], 0x70, 0x70, 0xa8}}, @common=@dnat={'dnat\x00', 0x10, {{@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, 0xffffffffffffffff}}}}]}]}, 0x14b8) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000140)={'ip6gre0\x00', 0x121e}) 17:55:20 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={'\x00\x00?\x00', 0x8400}) 17:55:20 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696300007ffffffff000"}}) [ 1097.321969] binder: 2717:2742 transaction failed 29189/-3, size 255-0 line 2973 [ 1097.339283] binder: release 2717:2723 transaction 5667 out, still active [ 1097.360293] binder: undelivered TRANSACTION_COMPLETE [ 1097.386138] binder: send failed reply for transaction 5667, target dead 17:55:20 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000020000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) [ 1097.509489] binder: 2757:2760 got transaction with invalid data ptr [ 1097.523194] binder: 2757:2760 transaction failed 29201/-14, size 255-0 line 2992 [ 1097.540902] binder_alloc: binder_alloc_mmap_handler: 2757 20001000-20004000 already mapped failed -16 [ 1097.550810] binder: BINDER_SET_CONTEXT_MGR already set [ 1097.556378] binder: 2757:2763 ioctl 40046207 0 returned -16 [ 1097.573101] binder: 2757:2760 transaction failed 29189/-3, size 0-0 line 2973 [ 1097.580811] binder: 2757:2764 transaction failed 29189/-3, size 255-0 line 2973 [ 1097.588860] binder: release 2757:2760 transaction 5672 out, still active [ 1097.597032] binder: undelivered TRANSACTION_COMPLETE [ 1097.602330] binder: send failed reply for transaction 5672, target dead 17:55:21 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x001\x00'}}) 17:55:21 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x110000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:55:21 executing program 1: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x10000, 0x0) write$P9_RLERRORu(r0, &(0x7f0000000040)={0x1e, 0x7, 0x2, {{0x11, 'vboxnet0(^selinux'}, 0xf3}}, 0x1e) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) 17:55:21 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={"000000000000ffffffff00", 0x8400}) 17:55:21 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000030000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:21 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x197000}], 0x1, 0x0) [ 1098.194811] binder: 2779:2782 got transaction with invalid data ptr [ 1098.214453] binder: 2779:2782 transaction failed 29201/-14, size 255-0 line 2992 [ 1098.228754] binder_alloc: binder_alloc_mmap_handler: 2779 20001000-20004000 already mapped failed -16 [ 1098.238843] binder: BINDER_SET_CONTEXT_MGR already set 17:55:21 executing program 1: perf_event_open(&(0x7f0000000200)={0xffffffffffffffff, 0xfffffffffffffffc, 0x20000000ce, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) 17:55:21 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e65726963c000"}}) [ 1098.245420] binder: 2779:2791 ioctl 40046207 0 returned -16 [ 1098.252523] binder_alloc_new_buf_locked: 10 callbacks suppressed [ 1098.252531] binder_alloc: 2779: binder_alloc_buf, no vma [ 1098.307551] binder: 2779:2782 transaction failed 29189/-3, size 0-0 line 2973 [ 1098.307625] binder_alloc: 2779: binder_alloc_buf, no vma 17:55:21 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={"0000fffffdfd00", 0x8400}) [ 1098.366948] binder: 2779:2798 transaction failed 29189/-3, size 255-0 line 2973 [ 1098.403458] binder_release_work: 23 callbacks suppressed [ 1098.403464] binder: undelivered TRANSACTION_ERROR: 29201 17:55:21 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000000007000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:21 executing program 1: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) [ 1098.425395] binder: undelivered TRANSACTION_ERROR: 29189 [ 1098.446097] binder: undelivered TRANSACTION_ERROR: 29189 [ 1098.464348] binder: send failed reply for transaction 5677 to 2779:2782 [ 1098.481576] could not allocate digest TFM handle ghash-genericÀ [ 1098.505730] binder: undelivered TRANSACTION_COMPLETE [ 1098.514787] binder: undelivered TRANSACTION_ERROR: 29189 17:55:22 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e65726963000000000001cb9100"}}) [ 1098.541052] could not allocate digest TFM handle ghash-genericÀ [ 1098.567246] binder: 2818:2825 got transaction with invalid data ptr [ 1098.583490] binder: 2818:2825 transaction failed 29201/-14, size 255-0 line 2992 17:55:22 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={'\x00\x00\x00\x00\x00?\x00', 0x8400}) [ 1098.606443] binder_alloc: binder_alloc_mmap_handler: 2818 20001000-20004000 already mapped failed -16 [ 1098.632692] binder: BINDER_SET_CONTEXT_MGR already set [ 1098.633597] could not allocate digest TFM handle ghash-generic‘Ë [ 1098.638381] binder: 2818:2831 ioctl 40046207 0 returned -16 [ 1098.680102] binder_alloc: 2818: binder_alloc_buf, no vma [ 1098.709864] binder_alloc: 2818: binder_alloc_buf, no vma [ 1098.726535] binder: 2818:2825 transaction failed 29189/-3, size 0-0 line 2973 [ 1098.727385] binder: undelivered TRANSACTION_ERROR: 29189 [ 1098.739715] binder: undelivered TRANSACTION_ERROR: 29189 [ 1098.745396] binder: send failed reply for transaction 5682 to 2818:2825 [ 1098.752837] binder: undelivered TRANSACTION_COMPLETE [ 1098.759541] binder: undelivered TRANSACTION_ERROR: 29189 [ 1098.766325] binder: undelivered TRANSACTION_ERROR: 29201 17:55:22 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x151000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:55:22 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x000\x00'}}) 17:55:22 executing program 1: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) 17:55:22 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000000000fdfdffff000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:22 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={'\x00\x00\x00\x00\x00@\x00', 0x8400}) 17:55:22 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x13b000}], 0x1, 0x0) [ 1099.222576] binder: 2854:2858 got transaction with invalid data ptr [ 1099.237266] binder_alloc: binder_alloc_mmap_handler: 2854 20001000-20004000 already mapped failed -16 17:55:22 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00\x00\x00\x00\x00kkk\x00'}}) [ 1099.268040] binder: BINDER_SET_CONTEXT_MGR already set [ 1099.268097] could not allocate digest TFM handle ghash-generic‘Ë [ 1099.273683] binder: 2854:2867 ioctl 40046207 0 returned -16 [ 1099.295869] binder_alloc: 2854: binder_alloc_buf, no vma 17:55:22 executing program 1: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) [ 1099.342980] binder: undelivered TRANSACTION_ERROR: 29201 [ 1099.350934] binder: undelivered TRANSACTION_ERROR: 29189 [ 1099.376304] binder: send failed reply for transaction 5687 to 2854:2858 17:55:22 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000705000000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) [ 1099.406253] binder: undelivered TRANSACTION_COMPLETE 17:55:22 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00\x00\x00\x00\x00\x00\x00\x001\x00'}}) 17:55:22 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={"0000fdfdffff00", 0x8400}) 17:55:23 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e657269630000000000000000c000"}}) [ 1099.527332] binder: 2887:2894 got transaction with invalid data ptr [ 1099.561387] binder_alloc: binder_alloc_mmap_handler: 2887 20001000-20004000 already mapped failed -16 [ 1099.574078] could not allocate digest TFM handle ghash-generic‘Ë [ 1099.581024] binder: BINDER_SET_CONTEXT_MGR already set [ 1099.602683] binder: 2887:2897 ioctl 40046207 0 returned -16 [ 1099.622470] binder_alloc: 2887: binder_alloc_buf, no vma [ 1099.634984] binder_alloc: 2887: binder_alloc_buf, no vma [ 1099.645721] binder: release 2887:2894 transaction 5691 out, still active [ 1099.652915] binder: undelivered TRANSACTION_COMPLETE [ 1099.658721] binder: send failed reply for transaction 5691, target dead 17:55:23 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x134000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:55:23 executing program 1: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, 0x0, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) 17:55:23 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696300fffffe00"}}) 17:55:23 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000000000009300000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:23 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={'\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x00', 0x8400}) 17:55:23 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x57000}], 0x1, 0x0) 17:55:23 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00\x00\x00\x00@\x00'}}) [ 1100.346591] binder: 2925:2927 got transaction with invalid data ptr [ 1100.379416] binder: BINDER_SET_CONTEXT_MGR already set [ 1100.384864] binder: 2925:2934 ioctl 40046207 0 returned -16 [ 1100.413387] binder_alloc: binder_alloc_mmap_handler: 2925 20001000-20004000 already mapped failed -16 [ 1100.430421] binder_alloc: 2925: binder_alloc_buf, no vma [ 1100.439716] binder_alloc: 2925: binder_alloc_buf, no vma [ 1100.446122] binder: release 2925:2927 transaction 5696 out, still active [ 1100.454406] binder: undelivered TRANSACTION_COMPLETE [ 1100.460335] could not allocate digest TFM handle ghash-generic‘Ë [ 1100.478329] binder: send failed reply for transaction 5696, target dead 17:55:24 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000000000000001000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:24 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) 17:55:24 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00\x00@\x00'}}) 17:55:24 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={"0000000000000000000100", 0x8400}) [ 1100.600071] binder: 2954:2957 got transaction with invalid data ptr [ 1100.632370] binder_alloc: binder_alloc_mmap_handler: 2954 20001000-20004000 already mapped failed -16 17:55:24 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696300570100"}}) [ 1100.652199] binder: BINDER_SET_CONTEXT_MGR already set [ 1100.671493] binder: 2954:2963 ioctl 40046207 0 returned -16 [ 1100.684843] could not allocate digest TFM handle ghash-generic‘Ë [ 1100.689366] binder_alloc: 2954: binder_alloc_buf, no vma [ 1100.700979] binder: release 2954:2957 transaction 5701 out, still active [ 1100.714948] binder: undelivered TRANSACTION_COMPLETE [ 1100.726542] binder: send failed reply for transaction 5701, target dead 17:55:24 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x111000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:55:24 executing program 1: keyctl$dh_compute(0x17, 0x0, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) 17:55:24 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000740000000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:24 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={"00000000000000000100", 0x8400}) 17:55:24 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696300000000000001cb9100"}}) 17:55:24 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x129000}], 0x1, 0x0) 17:55:24 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696300000000000000000100"}}) 17:55:24 executing program 1: keyctl$dh_compute(0x17, 0x0, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) [ 1101.438225] binder: 2988:3001 got transaction with invalid data ptr [ 1101.460898] binder_alloc: binder_alloc_mmap_handler: 2988 20001000-20004000 already mapped failed -16 [ 1101.463064] binder: BINDER_SET_CONTEXT_MGR already set [ 1101.526420] binder: 2988:3006 ioctl 40046207 0 returned -16 [ 1101.550015] binder: release 2988:3001 transaction 5706 out, still active [ 1101.558689] binder: undelivered TRANSACTION_COMPLETE 17:55:25 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={"00000000000100", 0x8400}) 17:55:25 executing program 1: keyctl$dh_compute(0x17, 0x0, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) [ 1101.573809] binder: send failed reply for transaction 5706, target dead 17:55:25 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000006c0000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:25 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) [ 1101.729089] binder: 3034:3037 got transaction with invalid data ptr [ 1101.739126] binder_alloc: binder_alloc_mmap_handler: 3034 20001000-20004000 already mapped failed -16 [ 1101.743110] binder: BINDER_SET_CONTEXT_MGR already set [ 1101.754581] binder: 3034:3039 ioctl 40046207 0 returned -16 [ 1101.763043] binder: release 3034:3037 transaction 5711 out, still active [ 1101.770683] binder: undelivered TRANSACTION_COMPLETE [ 1101.775959] binder: send failed reply for transaction 5711, target dead [ 1101.817200] could not allocate digest TFM handle ghash-generic‘Ë 17:55:25 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x14a000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:55:25 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e657269630000007ffffffff000"}}) 17:55:25 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000000005000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:25 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0x0, 0x0) 17:55:25 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={'\x00\x00\x00?\x00', 0x8400}) 17:55:25 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x104000}], 0x1, 0x0) 17:55:26 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0x0, 0x0) 17:55:26 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696300000000c000"}}) [ 1102.488909] binder: 3061:3066 got transaction with invalid data ptr [ 1102.503019] binder_transaction: 18 callbacks suppressed [ 1102.503037] binder: 3061:3066 transaction failed 29201/-14, size 255-0 line 2992 [ 1102.511306] binder_alloc: binder_alloc_mmap_handler: 3061 20001000-20004000 already mapped failed -16 [ 1102.529049] binder: BINDER_SET_CONTEXT_MGR already set [ 1102.542581] binder: 3061:3077 ioctl 40046207 0 returned -16 [ 1102.553753] binder: 3061:3077 transaction failed 29189/-3, size 0-0 line 2973 [ 1102.583024] binder: 3061:3080 transaction failed 29189/-3, size 255-0 line 2973 [ 1102.601375] binder: release 3061:3066 transaction 5716 out, still active [ 1102.611427] binder: undelivered TRANSACTION_COMPLETE 17:55:26 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0x0, 0x0) 17:55:26 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000048000000000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) [ 1102.628571] binder: send failed reply for transaction 5716, target dead 17:55:26 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e65726963000001cb9100"}}) 17:55:26 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={'\x00\x00\x00@\x00', 0x8400}) [ 1102.791322] binder: 3102:3107 got transaction with invalid data ptr [ 1102.800195] binder: 3102:3107 transaction failed 29201/-14, size 255-0 line 2992 [ 1102.810388] binder_alloc: binder_alloc_mmap_handler: 3102 20001000-20004000 already mapped failed -16 [ 1102.820122] binder: BINDER_SET_CONTEXT_MGR already set [ 1102.831021] binder: 3102:3113 ioctl 40046207 0 returned -16 [ 1102.837510] binder: 3102:3107 transaction failed 29189/-3, size 0-0 line 2973 [ 1102.838471] binder: 3102:3116 transaction failed 29189/-3, size 255-0 line 2973 [ 1102.852725] binder: release 3102:3107 transaction 5721 out, still active [ 1102.864117] binder: undelivered TRANSACTION_COMPLETE [ 1102.869784] binder: send failed reply for transaction 5721, target dead 17:55:27 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3c000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:55:27 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000340)={0x0}) 17:55:27 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00\x00\x00\x00\x00\x00\x00\x00@\x00'}}) 17:55:27 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000007300000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:27 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={'\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00', 0x8400}) 17:55:27 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0xab000}], 0x1, 0x0) 17:55:27 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000340)={0x0}) 17:55:27 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e657269630000000000000c90f700"}}) [ 1103.585253] binder: 3132:3147 got transaction with invalid data ptr [ 1103.593199] binder: 3132:3147 transaction failed 29201/-14, size 255-0 line 2992 17:55:27 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={"000000000000fffffdfd00", 0x8400}) [ 1103.636058] binder_alloc: binder_alloc_mmap_handler: 3132 20001000-20004000 already mapped failed -16 [ 1103.639067] binder: BINDER_SET_CONTEXT_MGR already set 17:55:27 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000340)={0x0}) [ 1103.715994] binder: 3132:3158 ioctl 40046207 0 returned -16 [ 1103.732610] binder_alloc_new_buf_locked: 9 callbacks suppressed [ 1103.732618] binder_alloc: 3132: binder_alloc_buf, no vma 17:55:27 executing program 1: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0xb3000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) [ 1103.773167] binder_release_work: 22 callbacks suppressed [ 1103.773173] binder: undelivered TRANSACTION_ERROR: 29201 [ 1103.780856] binder: 3132:3167 transaction failed 29189/-3, size 0-0 line 2973 [ 1103.787927] binder_alloc: 3132: binder_alloc_buf, no vma [ 1103.802184] binder: send failed reply for transaction 5726 to 3132:3147 [ 1103.817476] binder: undelivered TRANSACTION_ERROR: 29189 17:55:27 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696300000c90f700"}}) [ 1103.823027] binder: 3132:3168 transaction failed 29189/-3, size 255-0 line 2973 [ 1103.879054] binder: undelivered TRANSACTION_ERROR: 29189 [ 1103.902678] binder: undelivered TRANSACTION_COMPLETE [ 1103.908970] binder: undelivered TRANSACTION_ERROR: 29189 17:55:27 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x9a000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:55:27 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000707000000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:27 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e65726963000000015700"}}) 17:55:27 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={'\x00\x00\x00\x00?\x00', 0x8400}) 17:55:27 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x74000}], 0x1, 0x0) 17:55:28 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00\x000\x00'}}) [ 1104.544696] binder: 3204:3213 got transaction with invalid data ptr [ 1104.552847] binder: 3204:3213 transaction failed 29201/-14, size 255-0 line 2992 [ 1104.582775] binder_alloc: binder_alloc_mmap_handler: 3204 20001000-20004000 already mapped failed -16 17:55:28 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696300000000000000000f00"}}) [ 1104.620787] binder: BINDER_SET_CONTEXT_MGR already set [ 1104.635811] binder: 3204:3223 ioctl 40046207 0 returned -16 [ 1104.655544] binder_alloc: 3204: binder_alloc_buf, no vma [ 1104.704008] binder_alloc: 3204: binder_alloc_buf, no vma [ 1104.740317] binder: undelivered TRANSACTION_ERROR: 29201 17:55:28 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={"000000fdfdffff00", 0x8400}) 17:55:28 executing program 1: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0xac000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) [ 1104.753453] binder: undelivered TRANSACTION_ERROR: 29189 17:55:28 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e657269630000feffff00"}}) [ 1104.805101] binder: undelivered TRANSACTION_ERROR: 29189 17:55:28 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000600000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) [ 1104.853376] binder: send failed reply for transaction 5731 to 3204:3213 [ 1104.874042] binder: undelivered TRANSACTION_COMPLETE [ 1104.890982] binder: undelivered TRANSACTION_ERROR: 29189 17:55:28 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e657269630091cb0100"}}) [ 1104.956759] binder: 3249:3259 got transaction with invalid data ptr [ 1104.990220] binder_alloc: binder_alloc_mmap_handler: 3249 20001000-20004000 already mapped failed -16 [ 1105.002964] binder: BINDER_SET_CONTEXT_MGR already set [ 1105.008550] binder: 3249:3269 ioctl 40046207 0 returned -16 [ 1105.014689] binder_alloc: 3249: binder_alloc_buf, no vma [ 1105.022045] binder_alloc: 3249: binder_alloc_buf, no vma [ 1105.038677] binder: undelivered TRANSACTION_ERROR: 29201 [ 1105.056346] binder: undelivered TRANSACTION_ERROR: 29189 [ 1105.073040] binder: send failed reply for transaction 5736 to 3249:3259 [ 1105.090576] binder: undelivered TRANSACTION_COMPLETE 17:55:29 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x1e000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:55:29 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00kkk\x00'}}) 17:55:29 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={"0000000000000000000100", 0x8400}) 17:55:29 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000000000ffefffffff7f00000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:29 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0xd7000}], 0x1, 0x0) 17:55:29 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e65726963000000000f00"}}) [ 1105.528493] binder: 3288:3290 got transaction with invalid data ptr [ 1105.576813] binder: BINDER_SET_CONTEXT_MGR already set [ 1105.582238] binder_alloc: binder_alloc_mmap_handler: 3288 20001000-20004000 already mapped failed -16 17:55:29 executing program 1: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x74000}], 0x1, 0x0) [ 1105.626028] binder: 3288:3291 ioctl 40046207 0 returned -16 [ 1105.693572] binder_alloc: 3288: binder_alloc_buf, no vma [ 1105.719415] binder: release 3288:3290 transaction 5741 out, still active [ 1105.722239] binder_alloc: 3288: binder_alloc_buf, no vma [ 1105.737399] binder: undelivered TRANSACTION_COMPLETE 17:55:29 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e65726963000200"}}) 17:55:29 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000007fffffffefff0000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:29 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x00', 0x8400}) [ 1105.764353] binder: send failed reply for transaction 5741, target dead 17:55:29 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x001\x00'}}) [ 1105.902367] binder: 3323:3326 got transaction with invalid data ptr [ 1105.928210] binder_alloc: binder_alloc_mmap_handler: 3323 20001000-20004000 already mapped failed -16 [ 1105.938753] binder: BINDER_SET_CONTEXT_MGR already set [ 1105.944328] binder: 3323:3330 ioctl 40046207 0 returned -16 17:55:29 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00\x00\x00\x001\x00'}}) [ 1105.950725] binder_alloc: 3323: binder_alloc_buf, no vma [ 1105.957861] binder_alloc: 3323: binder_alloc_buf, no vma [ 1105.963672] binder: release 3323:3326 transaction 5746 out, still active [ 1105.981871] binder: undelivered TRANSACTION_COMPLETE [ 1105.991415] binder: send failed reply for transaction 5746, target dead 17:55:30 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0xf6000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:55:30 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000000000ff600000000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:30 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00', 0x8400}) 17:55:30 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00\x001\x00'}}) 17:55:30 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x4c000}], 0x1, 0x0) 17:55:30 executing program 1: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x10e000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:55:30 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e65726963000f00"}}) [ 1106.742516] binder: 3353:3361 got transaction with invalid data ptr [ 1106.756510] binder_alloc: binder_alloc_mmap_handler: 3353 20001000-20004000 already mapped failed -16 [ 1106.756652] binder: BINDER_SET_CONTEXT_MGR already set [ 1106.777367] binder: 3353:3366 ioctl 40046207 0 returned -16 [ 1106.806849] binder: release 3353:3361 transaction 5751 out, still active [ 1106.825792] binder: undelivered TRANSACTION_COMPLETE 17:55:30 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={"00000000000000fffffdfd00", 0x8400}) 17:55:30 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000400000000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) [ 1106.857840] binder: send failed reply for transaction 5751, target dead 17:55:30 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696300c000"}}) [ 1106.985568] binder: 3381:3385 got transaction with invalid data ptr [ 1106.998461] binder_alloc: binder_alloc_mmap_handler: 3381 20001000-20004000 already mapped failed -16 [ 1107.010907] binder: BINDER_SET_CONTEXT_MGR already set [ 1107.017406] binder: 3381:3387 ioctl 40046207 0 returned -16 [ 1107.026368] binder: release 3381:3385 transaction 5756 out, still active [ 1107.036110] binder: undelivered TRANSACTION_COMPLETE 17:55:30 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000007100000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:30 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00\x00\x00\x000\x00'}}) [ 1107.059635] binder: send failed reply for transaction 5756, target dead [ 1107.130657] binder: 3396:3398 got transaction with invalid data ptr [ 1107.139612] binder_alloc: binder_alloc_mmap_handler: 3396 20001000-20004000 already mapped failed -16 [ 1107.150382] binder: BINDER_SET_CONTEXT_MGR already set [ 1107.164202] binder: 3396:3399 ioctl 40046207 0 returned -16 [ 1107.172113] binder: release 3396:3398 transaction 5761 out, still active [ 1107.180629] binder: undelivered TRANSACTION_COMPLETE [ 1107.190632] binder: send failed reply for transaction 5761, target dead 17:55:31 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x11000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:55:31 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={"000000fffffdfd00", 0x8400}) 17:55:31 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e65726963000000000100"}}) 17:55:31 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000006800000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:31 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0xe7000}], 0x1, 0x0) 17:55:31 executing program 1: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x7b000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:55:31 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e65726963000000000200"}}) [ 1107.750963] binder: 3417:3423 got transaction with invalid data ptr [ 1107.768038] binder_transaction: 20 callbacks suppressed [ 1107.768054] binder: 3417:3423 transaction failed 29201/-14, size 255-0 line 2992 [ 1107.782612] binder_alloc: binder_alloc_mmap_handler: 3417 20001000-20004000 already mapped failed -16 [ 1107.828679] binder: BINDER_SET_CONTEXT_MGR already set [ 1107.852378] binder: 3417:3429 ioctl 40046207 0 returned -16 [ 1107.863821] binder: 3417:3438 transaction failed 29189/-3, size 0-0 line 2973 [ 1107.873564] binder: 3417:3429 transaction failed 29189/-3, size 255-0 line 2973 [ 1107.894843] binder: release 3417:3423 transaction 5766 out, still active 17:55:31 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696300015700"}}) 17:55:31 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={"000000000000000000000100", 0x8400}) [ 1107.901834] binder: undelivered TRANSACTION_COMPLETE 17:55:31 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000007400000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) [ 1107.965857] binder: send failed reply for transaction 5766, target dead 17:55:31 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e657269630000f0ffffff7f00"}}) [ 1108.090306] binder: 3452:3456 got transaction with invalid data ptr [ 1108.103903] binder: 3452:3456 transaction failed 29201/-14, size 255-0 line 2992 [ 1108.120083] binder_alloc: binder_alloc_mmap_handler: 3452 20001000-20004000 already mapped failed -16 [ 1108.129846] binder: BINDER_SET_CONTEXT_MGR already set 17:55:31 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696300f7900c00"}}) [ 1108.135843] binder: 3452:3461 ioctl 40046207 0 returned -16 [ 1108.142963] binder: 3452:3456 transaction failed 29189/-3, size 0-0 line 2973 [ 1108.160497] binder: 3452:3463 transaction failed 29189/-3, size 255-0 line 2973 [ 1108.184009] binder: release 3452:3456 transaction 5771 out, still active [ 1108.192691] binder: undelivered TRANSACTION_COMPLETE [ 1108.205749] binder: send failed reply for transaction 5771, target dead 17:55:32 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0xc5000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:55:32 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={"00000000000000ffffffff00", 0x8400}) 17:55:32 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000070000000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:32 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e657269630000000000fffffe00"}}) 17:55:32 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3a000}], 0x1, 0x0) 17:55:32 executing program 1: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x149000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:55:32 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696300000000000000015700"}}) [ 1108.920455] binder: 3481:3489 got transaction with invalid data ptr [ 1108.945158] binder: 3481:3489 transaction failed 29201/-14, size 255-0 line 2992 [ 1108.955316] binder_alloc: binder_alloc_mmap_handler: 3481 20001000-20004000 already mapped failed -16 [ 1109.002800] binder: BINDER_SET_CONTEXT_MGR already set [ 1109.016032] binder: 3481:3502 ioctl 40046207 0 returned -16 [ 1109.023086] binder_alloc_new_buf_locked: 10 callbacks suppressed [ 1109.023094] binder_alloc: 3481: binder_alloc_buf, no vma [ 1109.053296] binder_alloc: 3481: binder_alloc_buf, no vma 17:55:32 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696300000000000000000200"}}) 17:55:32 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={"0000000000000100", 0x8400}) [ 1109.080550] binder: 3481:3502 transaction failed 29189/-3, size 255-0 line 2973 [ 1109.082550] binder_release_work: 23 callbacks suppressed [ 1109.082557] binder: undelivered TRANSACTION_ERROR: 29201 [ 1109.094983] binder: 3481:3489 transaction failed 29189/-3, size 0-0 line 2973 17:55:32 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000ffefffffff7f000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:32 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00\x00\x00\x00\x00\x00\x00\x000\x00'}}) [ 1109.157508] binder: undelivered TRANSACTION_ERROR: 29189 [ 1109.169996] binder: undelivered TRANSACTION_ERROR: 29189 [ 1109.182579] binder: send failed reply for transaction 5776 to 3481:3489 [ 1109.210115] binder: undelivered TRANSACTION_COMPLETE [ 1109.226897] binder: undelivered TRANSACTION_ERROR: 29189 [ 1109.245053] binder: 3519:3529 got transaction with invalid data ptr [ 1109.252090] binder: 3519:3529 transaction failed 29201/-14, size 255-0 line 2992 [ 1109.261849] binder_alloc: binder_alloc_mmap_handler: 3519 20001000-20004000 already mapped failed -16 [ 1109.271809] binder: BINDER_SET_CONTEXT_MGR already set [ 1109.277402] binder: 3519:3530 ioctl 40046207 0 returned -16 [ 1109.283490] binder_alloc: 3519: binder_alloc_buf, no vma [ 1109.296461] binder_alloc: 3519: binder_alloc_buf, no vma [ 1109.302346] binder: undelivered TRANSACTION_ERROR: 29201 17:55:32 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e657269630000c000"}}) [ 1109.309241] binder: undelivered TRANSACTION_ERROR: 29189 [ 1109.324496] binder: undelivered TRANSACTION_ERROR: 29189 [ 1109.333672] binder: send failed reply for transaction 5781 to 3519:3529 [ 1109.345382] binder: undelivered TRANSACTION_COMPLETE [ 1109.351974] binder: undelivered TRANSACTION_ERROR: 29189 17:55:33 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x189000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:55:33 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000740000000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:33 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696300000f00"}}) 17:55:33 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={'\x00\x00\x00\x00\x00\x00?\x00', 0x8400}) 17:55:33 executing program 1: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x11000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:55:33 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x1a1000}], 0x1, 0x0) 17:55:33 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00\x00kkk\x00'}}) [ 1109.896537] binder: 3553:3555 got transaction with invalid data ptr [ 1109.905846] binder_alloc: binder_alloc_mmap_handler: 3553 20001000-20004000 already mapped failed -16 [ 1109.907492] binder: BINDER_SET_CONTEXT_MGR already set [ 1109.922418] binder: 3553:3567 ioctl 40046207 0 returned -16 [ 1109.930090] binder_alloc: 3553: binder_alloc_buf, no vma [ 1109.936111] binder_alloc: 3553: binder_alloc_buf, no vma 17:55:33 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={'\x00\x00\x00\x00\x00\x00@\x00', 0x8400}) [ 1109.961247] binder: undelivered TRANSACTION_ERROR: 29201 [ 1109.967964] binder: undelivered TRANSACTION_ERROR: 29189 [ 1109.994540] binder: send failed reply for transaction 5786 to 3553:3555 17:55:33 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000300000000000000000000000000ff"], 0x0, 0x800020, 0x0}) [ 1110.046334] binder: undelivered TRANSACTION_COMPLETE 17:55:33 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e65726963000000f0ffffff7f00"}}) [ 1110.145954] binder: 3585:3586 got transaction with invalid data ptr [ 1110.164613] binder: BINDER_SET_CONTEXT_MGR already set [ 1110.170240] binder_alloc: binder_alloc_mmap_handler: 3585 20001000-20004000 already mapped failed -16 [ 1110.173434] binder: 3585:3588 ioctl 40046207 0 returned -16 17:55:33 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={'\x00\x00\x00\x00@\x00', 0x8400}) 17:55:33 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e657269630000000000000000015700"}}) [ 1110.205976] binder_alloc: 3585: binder_alloc_buf, no vma [ 1110.217003] binder_alloc: 3585: binder_alloc_buf, no vma [ 1110.222920] binder: release 3585:3586 transaction 5791 out, still active [ 1110.238805] binder: undelivered TRANSACTION_COMPLETE [ 1110.244082] binder: send failed reply for transaction 5791, target dead 17:55:34 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x179000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:55:34 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000001200000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:34 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00'}}) 17:55:34 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={'\x00\x00\x00\x00\x00?\x00', 0x8400}) 17:55:34 executing program 1: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x160000}], 0x1, 0x0) 17:55:34 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0xc0000}], 0x1, 0x0) [ 1111.010400] binder: 3620:3623 got transaction with invalid data ptr [ 1111.034942] binder: BINDER_SET_CONTEXT_MGR already set [ 1111.047023] binder_alloc: binder_alloc_mmap_handler: 3620 20001000-20004000 already mapped failed -16 17:55:34 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00\x00\x000\x00'}}) [ 1111.053803] binder: 3620:3627 ioctl 40046207 0 returned -16 [ 1111.064508] binder_alloc: 3620: binder_alloc_buf, no vma [ 1111.079277] binder_alloc: 3620: binder_alloc_buf, no vma 17:55:34 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000000600000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) [ 1111.100979] binder: release 3620:3623 transaction 5796 out, still active [ 1111.111742] binder: undelivered TRANSACTION_COMPLETE [ 1111.132287] binder: send failed reply for transaction 5796, target dead 17:55:34 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e657269630000f7900c00"}}) 17:55:34 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={"0000000000000000fffffdfd00", 0x8400}) [ 1111.284488] binder: 3644:3648 got transaction with invalid data ptr [ 1111.317926] binder_alloc: binder_alloc_mmap_handler: 3644 20001000-20004000 already mapped failed -16 17:55:34 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696300000200"}}) 17:55:34 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000000500000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) [ 1111.344680] binder: BINDER_SET_CONTEXT_MGR already set [ 1111.350481] binder: 3644:3653 ioctl 40046207 0 returned -16 [ 1111.361454] binder: release 3644:3648 transaction 5801 out, still active [ 1111.374967] binder: undelivered TRANSACTION_COMPLETE [ 1111.394286] binder: send failed reply for transaction 5801, target dead [ 1111.464442] binder: 3663:3664 got transaction with invalid data ptr [ 1111.486242] binder: BINDER_SET_CONTEXT_MGR already set [ 1111.486279] binder_alloc: binder_alloc_mmap_handler: 3663 20001000-20004000 already mapped failed -16 [ 1111.491735] binder: 3663:3666 ioctl 40046207 0 returned -16 [ 1111.514596] binder: release 3663:3664 transaction 5806 out, still active [ 1111.525832] binder: undelivered TRANSACTION_COMPLETE [ 1111.533518] binder: send failed reply for transaction 5806, target dead 17:55:35 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0xdd000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:55:35 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696300000000000100"}}) 17:55:35 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={"00000000000000000000000100", 0x8400}) 17:55:35 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000007050000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:35 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x6c000}], 0x1, 0x0) 17:55:35 executing program 1 (fault-call:0 fault-nth:0): keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) 17:55:35 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) [ 1112.212997] binder: 3680:3683 got transaction with invalid data ptr [ 1112.274980] binder_alloc: binder_alloc_mmap_handler: 3680 20001000-20004000 already mapped failed -16 [ 1112.311989] binder: BINDER_SET_CONTEXT_MGR already set 17:55:35 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00\x00kkk\x00'}}) [ 1112.325468] binder: 3680:3692 ioctl 40046207 0 returned -16 17:55:35 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={"0000000000000000ffffffff00", 0x8400}) [ 1112.384605] binder: send failed reply for transaction 5811 to 3680:3683 [ 1112.420709] binder: undelivered TRANSACTION_COMPLETE 17:55:35 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000000000000093000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) [ 1112.499880] could not allocate digest TFM handle ghash-generic‘Ë 17:55:36 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e657269630000fffffe00"}}) 17:55:36 executing program 1: keyctl$dh_compute(0xd, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) [ 1112.568691] binder: 3717:3720 got transaction with invalid data ptr [ 1112.611271] binder: BINDER_SET_CONTEXT_MGR already set [ 1112.642089] binder: 3717:3724 ioctl 40046207 0 returned -16 [ 1112.648448] binder_alloc: binder_alloc_mmap_handler: 3717 20001000-20004000 already mapped failed -16 [ 1112.708063] binder: release 3717:3720 transaction 5816 out, still active [ 1112.716162] binder: undelivered TRANSACTION_COMPLETE [ 1112.744039] binder: send failed reply for transaction 5816, target dead 17:55:36 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x130000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:55:36 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={'\x00\x00\x00\x00\x00\x00\x00@\x00', 0x8400}) 17:55:36 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e657269630000015700"}}) 17:55:36 executing program 1: keyctl$dh_compute(0x16, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) 17:55:36 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000000000000000006c0000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:36 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x153000}], 0x1, 0x0) 17:55:36 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e65726963000091cb0100"}}) 17:55:36 executing program 1: keyctl$dh_compute(0x8, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) [ 1113.273801] binder: 3743:3750 got transaction with invalid data ptr [ 1113.303018] binder_transaction: 23 callbacks suppressed [ 1113.303036] binder: 3743:3750 transaction failed 29201/-14, size 255-0 line 2992 [ 1113.346936] binder_alloc: binder_alloc_mmap_handler: 3743 20001000-20004000 already mapped failed -16 [ 1113.386013] binder: BINDER_SET_CONTEXT_MGR already set 17:55:36 executing program 1: keyctl$dh_compute(0x1b, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) [ 1113.408631] binder: 3743:3759 ioctl 40046207 0 returned -16 17:55:36 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={"00000000fffffdfd00", 0x8400}) 17:55:36 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e65726963000000000000fffffe00"}}) 17:55:37 executing program 1: keyctl$dh_compute(0xb, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) [ 1113.456188] binder: 3743:3771 transaction failed 29189/-3, size 0-0 line 2973 [ 1113.495999] binder: 3743:3759 transaction failed 29189/-3, size 255-0 line 2973 [ 1113.561048] binder: release 3743:3750 transaction 5821 out, still active [ 1113.572327] binder: undelivered TRANSACTION_COMPLETE [ 1113.591357] binder: send failed reply for transaction 5821, target dead 17:55:37 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x4d000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:55:37 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000000000000000004c0000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:37 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696300000000000f00"}}) 17:55:37 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={'\x00\x00\x00\x00\x00\x00\x00?\x00', 0x8400}) 17:55:37 executing program 1: keyctl$dh_compute(0xa, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) 17:55:37 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x8d000}], 0x1, 0x0) 17:55:37 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00\x00\x00\x00\x00@\x00'}}) [ 1114.276515] binder: 3795:3800 got transaction with invalid data ptr [ 1114.294784] binder: 3795:3800 transaction failed 29201/-14, size 255-0 line 2992 [ 1114.309124] binder_alloc: binder_alloc_mmap_handler: 3795 20001000-20004000 already mapped failed -16 [ 1114.319247] binder: BINDER_SET_CONTEXT_MGR already set 17:55:37 executing program 1: keyctl$dh_compute(0x4, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) [ 1114.347170] binder: 3795:3809 ioctl 40046207 0 returned -16 [ 1114.347318] binder_alloc_new_buf_locked: 10 callbacks suppressed [ 1114.347325] binder_alloc: 3795: binder_alloc_buf, no vma [ 1114.387827] binder_alloc: 3795: binder_alloc_buf, no vma [ 1114.400521] binder: 3795:3815 transaction failed 29189/-3, size 255-0 line 2973 [ 1114.408789] binder_release_work: 24 callbacks suppressed [ 1114.408812] binder: undelivered TRANSACTION_ERROR: 29201 [ 1114.409636] binder: 3795:3809 transaction failed 29189/-3, size 0-0 line 2973 [ 1114.420353] binder: undelivered TRANSACTION_ERROR: 29189 17:55:37 executing program 1: keyctl$dh_compute(0x5, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) [ 1114.437979] binder: send failed reply for transaction 5826 to 3795:3800 [ 1114.456447] binder: undelivered TRANSACTION_COMPLETE [ 1114.472480] binder: undelivered TRANSACTION_ERROR: 29189 17:55:38 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000fffffdfd0000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:38 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00\x00\x00kkk\x00'}}) [ 1114.507921] binder: undelivered TRANSACTION_ERROR: 29189 17:55:38 executing program 1: keyctl$dh_compute(0xe, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) [ 1114.645927] binder: 3829:3832 got transaction with invalid data ptr [ 1114.657173] binder: 3829:3832 transaction failed 29201/-14, size 255-0 line 2992 [ 1114.670115] binder_alloc: binder_alloc_mmap_handler: 3829 20001000-20004000 already mapped failed -16 [ 1114.670700] binder: BINDER_SET_CONTEXT_MGR already set [ 1114.689003] binder: 3829:3838 ioctl 40046207 0 returned -16 [ 1114.697055] binder_alloc: 3829: binder_alloc_buf, no vma [ 1114.707160] binder: 3829:3832 transaction failed 29189/-3, size 0-0 line 2973 [ 1114.716130] binder_alloc: 3829: binder_alloc_buf, no vma [ 1114.721718] binder: 3829:3838 transaction failed 29189/-3, size 255-0 line 2973 [ 1114.729856] binder: undelivered TRANSACTION_ERROR: 29201 [ 1114.735917] binder: undelivered TRANSACTION_ERROR: 29189 [ 1114.741573] binder: undelivered TRANSACTION_ERROR: 29189 [ 1114.747996] binder: send failed reply for transaction 5831 to 3829:3832 [ 1114.761172] binder: undelivered TRANSACTION_COMPLETE [ 1114.766372] binder: undelivered TRANSACTION_ERROR: 29189 17:55:38 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x183000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:55:38 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={'\x00\x00\x00\x00\x00@\x00', 0x8400}) 17:55:38 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e657269630000000000000001cb9100"}}) 17:55:38 executing program 1: keyctl$dh_compute(0x45, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) 17:55:38 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000000000007fffffff0000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:38 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0xb7000}], 0x1, 0x0) [ 1115.410392] binder: 3856:3858 got transaction with invalid data ptr [ 1115.417429] binder: 3856:3858 transaction failed 29201/-14, size 255-0 line 2992 [ 1115.427097] binder_alloc: binder_alloc_mmap_handler: 3856 20001000-20004000 already mapped failed -16 [ 1115.446498] binder: BINDER_SET_CONTEXT_MGR already set [ 1115.451926] binder: 3856:3860 ioctl 40046207 0 returned -16 17:55:38 executing program 1: keyctl$dh_compute(0x13, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) [ 1115.458399] binder_alloc: 3856: binder_alloc_buf, no vma [ 1115.470919] binder_alloc: 3856: binder_alloc_buf, no vma 17:55:39 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696300000001cb9100"}}) 17:55:39 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000000000680000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:39 executing program 1: keyctl$dh_compute(0x15, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) [ 1115.509429] binder: undelivered TRANSACTION_ERROR: 29189 [ 1115.516179] binder: undelivered TRANSACTION_ERROR: 29189 [ 1115.527800] binder: send failed reply for transaction 5836 to 3856:3858 [ 1115.568928] binder: undelivered TRANSACTION_COMPLETE 17:55:39 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e657269630000000000000000000200"}}) 17:55:39 executing program 1: keyctl$dh_compute(0x1c, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) [ 1115.648615] binder: 3879:3884 got transaction with invalid data ptr [ 1115.661136] binder_alloc: binder_alloc_mmap_handler: 3879 20001000-20004000 already mapped failed -16 [ 1115.673710] binder: BINDER_SET_CONTEXT_MGR already set [ 1115.697315] binder: 3879:3886 ioctl 40046207 0 returned -16 [ 1115.725189] binder_alloc: 3879: binder_alloc_buf, no vma [ 1115.747383] binder_alloc: 3879: binder_alloc_buf, no vma [ 1115.762558] binder: release 3879:3884 transaction 5841 out, still active [ 1115.773112] binder: undelivered TRANSACTION_COMPLETE [ 1115.783955] binder: send failed reply for transaction 5841, target dead 17:55:39 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x169000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:55:39 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={"00000000fdfdffff00", 0x8400}) 17:55:39 executing program 1: keyctl$dh_compute(0x37, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) 17:55:39 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00\x00\x00\x00\x00\x00kkk\x00'}}) 17:55:39 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000ff6000000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:39 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x7d000}], 0x1, 0x0) 17:55:39 executing program 1: keyctl$dh_compute(0xc, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) 17:55:39 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696300000000000200"}}) [ 1116.459493] binder: 3909:3914 got transaction with invalid data ptr [ 1116.489790] binder_alloc: binder_alloc_mmap_handler: 3909 20001000-20004000 already mapped failed -16 [ 1116.500253] binder: BINDER_SET_CONTEXT_MGR already set [ 1116.505843] binder: 3909:3922 ioctl 40046207 0 returned -16 [ 1116.511847] binder_alloc: 3909: binder_alloc_buf, no vma [ 1116.531811] binder_alloc: 3909: binder_alloc_buf, no vma [ 1116.551700] binder: release 3909:3914 transaction 5846 out, still active 17:55:40 executing program 1: keyctl$dh_compute(0x2, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) [ 1116.563562] binder: undelivered TRANSACTION_COMPLETE [ 1116.580159] binder: send failed reply for transaction 5846, target dead 17:55:40 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000000000006c0000000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:40 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00', 0x8400}) [ 1116.690096] binder: 3940:3941 got transaction with invalid data ptr [ 1116.723917] binder_alloc: binder_alloc_mmap_handler: 3940 20001000-20004000 already mapped failed -16 17:55:40 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e657269630000000f00"}}) [ 1116.744527] binder: BINDER_SET_CONTEXT_MGR already set [ 1116.754641] binder: 3940:3947 ioctl 40046207 0 returned -16 [ 1116.762020] binder: release 3940:3941 transaction 5851 out, still active [ 1116.774698] binder: undelivered TRANSACTION_COMPLETE [ 1116.786151] binder: send failed reply for transaction 5851, target dead 17:55:41 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x184000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:55:41 executing program 1: keyctl$dh_compute(0x11, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) 17:55:41 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000fdfdffff0000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:41 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e65726963000000c000"}}) 17:55:41 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={"000000000000000000000100", 0x8400}) 17:55:41 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x120000}], 0x1, 0x0) 17:55:41 executing program 1: keyctl$dh_compute(0x1d, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) [ 1117.614138] binder: 3965:3971 got transaction with invalid data ptr [ 1117.646040] binder: BINDER_SET_CONTEXT_MGR already set [ 1117.646080] binder_alloc: binder_alloc_mmap_handler: 3965 20001000-20004000 already mapped failed -16 17:55:41 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e657269630000000000000000000100"}}) [ 1117.680118] binder: 3965:3978 ioctl 40046207 0 returned -16 [ 1117.695637] binder: release 3965:3971 transaction 5856 out, still active [ 1117.704992] binder: undelivered TRANSACTION_COMPLETE 17:55:41 executing program 1: keyctl$dh_compute(0x7, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) [ 1117.733936] binder: send failed reply for transaction 5856, target dead 17:55:41 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000050000000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:41 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e657269630000570100"}}) 17:55:41 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x00', 0x8400}) [ 1117.900442] binder: 3995:3999 got transaction with invalid data ptr [ 1117.950094] binder_alloc: binder_alloc_mmap_handler: 3995 20001000-20004000 already mapped failed -16 [ 1117.960524] binder: BINDER_SET_CONTEXT_MGR already set [ 1117.967459] binder: 3995:4006 ioctl 40046207 0 returned -16 [ 1117.978067] binder: release 3995:3999 transaction 5861 out, still active [ 1117.988338] binder: undelivered TRANSACTION_COMPLETE [ 1118.002252] binder: send failed reply for transaction 5861, target dead 17:55:42 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x14b000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:55:42 executing program 1: keyctl$dh_compute(0x9, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) 17:55:42 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00\x00\x00\x00\x00\x00\x00\x00\x001\x00'}}) 17:55:42 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000500000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:42 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={"000000000000000100", 0x8400}) 17:55:42 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x6b000}], 0x1, 0x0) [ 1118.755839] binder: 4024:4028 got transaction with invalid data ptr [ 1118.773197] binder_transaction: 17 callbacks suppressed [ 1118.773213] binder: 4024:4028 transaction failed 29201/-14, size 255-0 line 2992 [ 1118.800439] binder: BINDER_SET_CONTEXT_MGR already set 17:55:42 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00\x00\x00\x00\x00\x00\x00\x00\x000\x00'}}) 17:55:42 executing program 1: keyctl$dh_compute(0x14, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) [ 1118.800464] binder_alloc: binder_alloc_mmap_handler: 4024 20001000-20004000 already mapped failed -16 [ 1118.811575] binder: 4024:4035 ioctl 40046207 0 returned -16 [ 1118.827427] binder: 4024:4035 transaction failed 29189/-3, size 0-0 line 2973 [ 1118.869914] binder: 4024:4043 transaction failed 29189/-3, size 255-0 line 2973 17:55:42 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e65726963000000000000000000c000"}}) 17:55:42 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={"0000000000fdfdffff00", 0x8400}) [ 1118.920478] binder: send failed reply for transaction 5866 to 4024:4028 [ 1118.931723] binder: undelivered TRANSACTION_COMPLETE 17:55:42 executing program 1: keyctl$dh_compute(0x3, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) 17:55:42 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000007a00000000000000000000000000ff"], 0x0, 0x800020, 0x0}) [ 1119.089106] binder: 4061:4063 got transaction with invalid data ptr [ 1119.096252] binder: 4061:4063 transaction failed 29201/-14, size 255-0 line 2992 [ 1119.107062] binder: BINDER_SET_CONTEXT_MGR already set [ 1119.112584] binder_alloc: binder_alloc_mmap_handler: 4061 20001000-20004000 already mapped failed -16 [ 1119.112595] binder: 4061:4068 ioctl 40046207 0 returned -16 [ 1119.112750] binder: 4061:4063 transaction failed 29189/-3, size 0-0 line 2973 [ 1119.140279] binder: 4061:4068 transaction failed 29189/-3, size 255-0 line 2973 [ 1119.148489] binder: release 4061:4063 transaction 5871 out, still active [ 1119.156437] binder: undelivered TRANSACTION_COMPLETE [ 1119.173722] binder: send failed reply for transaction 5871, target dead 17:55:43 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x170000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:55:43 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e65726963000000000000000c90f700"}}) 17:55:43 executing program 1: keyctl$dh_compute(0x10, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) 17:55:43 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={"0000000000000000000000000100", 0x8400}) 17:55:43 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000002000000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:43 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x11f000}], 0x1, 0x0) 17:55:43 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e657269630000000000c000"}}) 17:55:43 executing program 1: keyctl$dh_compute(0x12, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) [ 1119.944926] binder: 4085:4092 got transaction with invalid data ptr [ 1119.960820] binder: 4085:4092 transaction failed 29201/-14, size 255-0 line 2992 [ 1119.989665] binder_alloc: binder_alloc_mmap_handler: 4085 20001000-20004000 already mapped failed -16 [ 1120.016815] binder: BINDER_SET_CONTEXT_MGR already set 17:55:43 executing program 1: keyctl$dh_compute(0xf, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) [ 1120.041374] binder: 4085:4099 ioctl 40046207 0 returned -16 17:55:43 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={"000000000000000000ffffffff00", 0x8400}) 17:55:43 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e657269630000000c90f700"}}) [ 1120.085740] binder_alloc_new_buf_locked: 10 callbacks suppressed [ 1120.085747] binder_alloc: 4085: binder_alloc_buf, no vma [ 1120.130622] binder: 4085:4108 transaction failed 29189/-3, size 0-0 line 2973 [ 1120.170237] binder_alloc: 4085: binder_alloc_buf, no vma 17:55:43 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00\x000\x00'}}) [ 1120.192892] binder: 4085:4099 transaction failed 29189/-3, size 255-0 line 2973 [ 1120.224997] binder_release_work: 24 callbacks suppressed [ 1120.225004] binder: undelivered TRANSACTION_ERROR: 29201 [ 1120.238459] binder: undelivered TRANSACTION_ERROR: 29189 [ 1120.244099] binder: undelivered TRANSACTION_ERROR: 29189 [ 1120.249853] binder: send failed reply for transaction 5876 to 4085:4092 [ 1120.265939] binder: undelivered TRANSACTION_COMPLETE [ 1120.277338] binder: undelivered TRANSACTION_ERROR: 29189 17:55:44 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x13a000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:55:44 executing program 1: keyctl$dh_compute(0x18, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) 17:55:44 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000000700000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:44 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x00', 0x8400}) 17:55:44 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00\x00\x00\x00\x001\x00'}}) 17:55:44 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x1ac000}], 0x1, 0x0) 17:55:44 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e65726963000000feffff00"}}) [ 1120.911460] binder: 4143:4145 got transaction with invalid data ptr [ 1120.918594] binder: 4143:4145 transaction failed 29201/-14, size 255-0 line 2992 [ 1120.932656] binder_alloc: binder_alloc_mmap_handler: 4143 20001000-20004000 already mapped failed -16 [ 1120.942930] binder: BINDER_SET_CONTEXT_MGR already set [ 1120.948568] binder: 4143:4154 ioctl 40046207 0 returned -16 17:55:44 executing program 1: keyctl$dh_compute(0x19, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) [ 1121.000155] binder_alloc: 4143: binder_alloc_buf, no vma [ 1121.022321] binder_alloc: 4143: binder_alloc_buf, no vma [ 1121.038583] binder: undelivered TRANSACTION_ERROR: 29201 [ 1121.045110] binder: undelivered TRANSACTION_ERROR: 29189 17:55:44 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00\x001\x00'}}) 17:55:44 executing program 1: keyctl$dh_compute(0x6, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) 17:55:44 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={"0000000000fffffdfd00", 0x8400}) 17:55:44 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000000000007a0000000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) [ 1121.064984] binder: undelivered TRANSACTION_ERROR: 29189 [ 1121.099388] binder: send failed reply for transaction 5881 to 4143:4145 [ 1121.150088] binder: undelivered TRANSACTION_COMPLETE [ 1121.179256] binder: undelivered TRANSACTION_ERROR: 29189 [ 1121.215908] binder: 4179:4181 got transaction with invalid data ptr [ 1121.228650] binder_alloc: binder_alloc_mmap_handler: 4179 20001000-20004000 already mapped failed -16 [ 1121.238297] binder: BINDER_SET_CONTEXT_MGR already set [ 1121.243719] binder: 4179:4185 ioctl 40046207 0 returned -16 [ 1121.250705] binder_alloc: 4179: binder_alloc_buf, no vma [ 1121.257645] binder_alloc: 4179: binder_alloc_buf, no vma [ 1121.265861] binder: undelivered TRANSACTION_ERROR: 29201 [ 1121.272378] binder: undelivered TRANSACTION_ERROR: 29189 [ 1121.287006] binder: send failed reply for transaction 5886 to 4179:4181 [ 1121.295177] binder: undelivered TRANSACTION_COMPLETE 17:55:45 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0xc6000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:55:45 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e65726963000000007ffffffff000"}}) 17:55:45 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0x700, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) 17:55:45 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={"00000000000000000100", 0x8400}) 17:55:45 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000000000004c0000000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:45 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x9a000}], 0x1, 0x0) 17:55:45 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00\x00\x001\x00'}}) 17:55:45 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0x180, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) [ 1121.860963] binder: 4201:4207 got transaction with invalid data ptr [ 1121.886068] binder_alloc: binder_alloc_mmap_handler: 4201 20001000-20004000 already mapped failed -16 17:55:45 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={'\x00\x00\x00\x00\x00\x00@\x00', 0x8400}) [ 1121.926127] binder: BINDER_SET_CONTEXT_MGR already set [ 1121.933301] binder: 4201:4213 ioctl 40046207 0 returned -16 [ 1121.944546] binder_alloc: 4201: binder_alloc_buf, no vma 17:55:45 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e657269630000c000"}}) [ 1121.995808] binder_alloc: 4201: binder_alloc_buf, no vma [ 1122.019153] binder: release 4201:4207 transaction 5891 out, still active 17:55:45 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0x3, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) 17:55:45 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000004c00000000000000000000000000ff"], 0x0, 0x800020, 0x0}) [ 1122.042158] binder: undelivered TRANSACTION_COMPLETE [ 1122.058800] binder: send failed reply for transaction 5891, target dead [ 1122.151185] binder: 4240:4242 got transaction with invalid data ptr [ 1122.164109] binder_alloc: binder_alloc_mmap_handler: 4240 20001000-20004000 already mapped failed -16 [ 1122.168549] binder: BINDER_SET_CONTEXT_MGR already set [ 1122.179662] binder: 4240:4243 ioctl 40046207 0 returned -16 [ 1122.187647] binder_alloc: 4240: binder_alloc_buf, no vma [ 1122.195582] binder_alloc: 4240: binder_alloc_buf, no vma [ 1122.201336] binder: release 4240:4242 transaction 5896 out, still active [ 1122.208235] binder: undelivered TRANSACTION_COMPLETE [ 1122.209069] binder: send failed reply for transaction 5896, target dead 17:55:46 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x152000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:55:46 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e657269630000000000000000000f00"}}) 17:55:46 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0x6, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) 17:55:46 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={"00000000000000000000000100", 0x8400}) 17:55:46 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000005070000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:46 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x159000}], 0x1, 0x0) [ 1122.866039] binder: 4255:4261 got transaction with invalid data ptr [ 1122.879612] binder_alloc: binder_alloc_mmap_handler: 4255 20001000-20004000 already mapped failed -16 [ 1122.889659] binder: BINDER_SET_CONTEXT_MGR already set [ 1122.899874] binder: 4255:4268 ioctl 40046207 0 returned -16 17:55:46 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00\x00\x00\x00\x000\x00'}}) [ 1122.914363] binder: release 4255:4261 transaction 5901 out, still active [ 1122.922328] binder: undelivered TRANSACTION_COMPLETE [ 1122.929691] binder: send failed reply for transaction 5901, target dead 17:55:46 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000000300000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:46 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00', 0x8400}) 17:55:46 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0x4, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) [ 1123.087819] binder: 4280:4284 got transaction with invalid data ptr [ 1123.118609] binder_alloc: binder_alloc_mmap_handler: 4280 20001000-20004000 already mapped failed -16 [ 1123.126227] binder: BINDER_SET_CONTEXT_MGR already set 17:55:46 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696300000000015700"}}) 17:55:46 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0x400000000000000, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) [ 1123.133428] binder: 4280:4290 ioctl 40046207 0 returned -16 [ 1123.172320] binder: release 4280:4284 transaction 5906 out, still active [ 1123.195675] binder: undelivered TRANSACTION_COMPLETE [ 1123.200983] binder: send failed reply for transaction 5906, target dead 17:55:47 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0xb5000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:55:47 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000000093000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:47 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00\x00\x00@\x00'}}) 17:55:47 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0x20000, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) 17:55:47 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={"000000000000000000fffffdfd00", 0x8400}) 17:55:47 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x5b000}], 0x1, 0x0) 17:55:47 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0x40000000, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) 17:55:47 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696300000f00"}}) [ 1123.856329] binder: 4313:4314 got transaction with invalid data ptr [ 1123.862850] binder_transaction: 17 callbacks suppressed [ 1123.862877] binder: 4313:4314 transaction failed 29201/-14, size 255-0 line 2992 [ 1123.901942] binder_alloc: binder_alloc_mmap_handler: 4313 20001000-20004000 already mapped failed -16 [ 1123.936826] binder: BINDER_SET_CONTEXT_MGR already set 17:55:47 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0x3f00, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) 17:55:47 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="00634040000000000000000000000000007fffffffefff00000000000000000000000000ff"], 0x0, 0x800020, 0x0}) [ 1123.964737] binder: 4313:4330 ioctl 40046207 0 returned -16 [ 1123.972113] binder: 4313:4314 transaction failed 29189/-3, size 0-0 line 2973 [ 1123.981459] binder: 4313:4336 transaction failed 29189/-3, size 255-0 line 2973 [ 1123.993115] binder: send failed reply for transaction 5911 to 4313:4314 [ 1124.006218] binder: undelivered TRANSACTION_COMPLETE 17:55:47 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={'\x00\x00\x00\x00\x00\x00\x00\x00?\x00', 0x8400}) 17:55:47 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e65726963000000c000"}}) [ 1124.119806] binder: 4346:4352 got transaction with invalid data ptr [ 1124.142734] binder: 4346:4352 transaction failed 29201/-14, size 255-0 line 2992 [ 1124.158429] binder_alloc: binder_alloc_mmap_handler: 4346 20001000-20004000 already mapped failed -16 [ 1124.168545] binder: BINDER_SET_CONTEXT_MGR already set [ 1124.174094] binder: 4346:4358 ioctl 40046207 0 returned -16 [ 1124.181517] binder: 4346:4358 transaction failed 29189/-3, size 255-0 line 2973 [ 1124.181614] binder: 4346:4352 transaction failed 29189/-3, size 0-0 line 2973 [ 1124.190925] binder: release 4346:4352 transaction 5916 out, still active [ 1124.205182] binder: undelivered TRANSACTION_COMPLETE [ 1124.220246] binder: send failed reply for transaction 5916, target dead 17:55:48 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x9b000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:55:48 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0x3f00000000000000, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) 17:55:48 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00\x00\x00\x00\x00\x00\x00kkk\x00'}}) 17:55:48 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000000000000040000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:48 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={'\x00\x00\x00\x00\x00\x00\x00\x00@\x00', 0x8400}) 17:55:48 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x13d000}], 0x1, 0x0) 17:55:48 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0x4000000000000000, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) 17:55:48 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e657269630000000001cb9100"}}) [ 1124.957785] binder: 4375:4384 got transaction with invalid data ptr [ 1124.964295] binder: 4375:4384 transaction failed 29201/-14, size 255-0 line 2992 [ 1125.066999] binder_alloc: binder_alloc_mmap_handler: 4375 20001000-20004000 already mapped failed -16 17:55:48 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0x2000000000000000, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) 17:55:48 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00\x00\x00\x00\x00\x001\x00'}}) 17:55:48 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={'\x00\x00\x00\x00\x00\x00?\x00', 0x8400}) [ 1125.108726] binder: BINDER_SET_CONTEXT_MGR already set [ 1125.114399] binder: 4375:4400 ioctl 40046207 0 returned -16 [ 1125.121246] binder_alloc_new_buf_locked: 8 callbacks suppressed [ 1125.121253] binder_alloc: 4375: binder_alloc_buf, no vma [ 1125.176397] binder: release 4375:4384 transaction 5921 out, still active [ 1125.183348] binder: undelivered TRANSACTION_COMPLETE [ 1125.189320] binder: 4375:4400 transaction failed 29189/-3, size 255-0 line 2973 [ 1125.189361] binder_alloc: 4375: binder_alloc_buf, no vma [ 1125.215631] binder: send failed reply for transaction 5921, target dead 17:55:48 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00\x00\x00\x00kkk\x00'}}) [ 1125.236192] binder: 4375:4384 transaction failed 29189/-3, size 0-0 line 2973 [ 1125.236499] binder_release_work: 22 callbacks suppressed [ 1125.236506] binder: undelivered TRANSACTION_ERROR: 29189 [ 1125.266353] binder: undelivered TRANSACTION_ERROR: 29189 17:55:49 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x9d000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:55:49 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0x1800000, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) 17:55:49 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000002000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:49 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={"00000000000000000000fffffdfd00", 0x8400}) 17:55:49 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696300000000feffff00"}}) 17:55:49 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x14f000}], 0x1, 0x0) 17:55:49 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0x60000000, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) 17:55:49 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e65726963000000000000000000000200"}}) [ 1125.956449] binder: 4431:4433 got transaction with invalid data ptr [ 1125.972025] binder: 4431:4433 transaction failed 29201/-14, size 255-0 line 2992 [ 1125.985086] binder_alloc: binder_alloc_mmap_handler: 4431 20001000-20004000 already mapped failed -16 [ 1125.994750] binder: BINDER_SET_CONTEXT_MGR already set 17:55:49 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e65726963000000000000000000000100"}}) [ 1126.026311] binder: 4431:4441 ioctl 40046207 0 returned -16 17:55:49 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0x300, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) [ 1126.078801] binder_alloc: 4431: binder_alloc_buf, no vma [ 1126.095289] binder_alloc: 4431: binder_alloc_buf, no vma [ 1126.121171] binder: undelivered TRANSACTION_ERROR: 29201 [ 1126.128031] binder: send failed reply for transaction 5926 to 4431:4433 17:55:49 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={"000000000000000000000000000100", 0x8400}) 17:55:49 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696300000000007ffffffff000"}}) [ 1126.166823] binder: undelivered TRANSACTION_ERROR: 29189 [ 1126.205653] binder: undelivered TRANSACTION_ERROR: 29189 [ 1126.242839] binder: undelivered TRANSACTION_COMPLETE [ 1126.257205] binder: undelivered TRANSACTION_ERROR: 29189 17:55:50 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0x600000000000000, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) 17:55:50 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000000000000073000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:50 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e65726963000000000c90f700"}}) 17:55:50 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={"00000000000000000000ffffffff00", 0x8400}) 17:55:50 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x171000}], 0x1, 0x0) 17:55:50 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x11d000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:55:50 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0x2000000000000, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) [ 1127.162870] binder: 4491:4497 got transaction with invalid data ptr [ 1127.186722] binder_alloc: binder_alloc_mmap_handler: 4491 20001000-20004000 already mapped failed -16 [ 1127.207627] binder: BINDER_SET_CONTEXT_MGR already set 17:55:50 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00\x00\x00\x001\x00'}}) [ 1127.213537] binder: 4491:4502 ioctl 40046207 0 returned -16 [ 1127.241863] binder_alloc: 4491: binder_alloc_buf, no vma 17:55:50 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0x3000000, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) 17:55:50 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={"0000000000000000000100", 0x8400}) [ 1127.269281] binder_alloc: 4491: binder_alloc_buf, no vma [ 1127.292449] binder: undelivered TRANSACTION_ERROR: 29201 [ 1127.299448] binder: undelivered TRANSACTION_ERROR: 29189 17:55:50 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000006800000000000000000000000000ff"], 0x0, 0x800020, 0x0}) [ 1127.341061] binder: undelivered TRANSACTION_ERROR: 29189 [ 1127.375558] binder: send failed reply for transaction 5931 to 4491:4497 17:55:50 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0x1000000, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) [ 1127.422814] binder: undelivered TRANSACTION_COMPLETE 17:55:50 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696300000000000000fffffe00"}}) [ 1127.448279] binder: undelivered TRANSACTION_ERROR: 29189 [ 1127.473294] binder: 4524:4526 got transaction with invalid data ptr 17:55:51 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={'\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x00', 0x8400}) 17:55:51 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0x3f000000, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) [ 1127.516109] binder_alloc: binder_alloc_mmap_handler: 4524 20001000-20004000 already mapped failed -16 17:55:51 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00\x00\x00\x00\x00\x000\x00'}}) [ 1127.604889] binder: BINDER_SET_CONTEXT_MGR already set [ 1127.616239] binder: 4524:4539 ioctl 40046207 0 returned -16 [ 1127.632394] binder_alloc: 4524: binder_alloc_buf, no vma [ 1127.638938] binder_alloc: 4524: binder_alloc_buf, no vma [ 1127.645058] binder: release 4524:4526 transaction 5936 out, still active [ 1127.653391] binder: undelivered TRANSACTION_COMPLETE [ 1127.675632] binder: send failed reply for transaction 5936, target dead 17:55:51 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x85000}], 0x1, 0x0) 17:55:51 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x39000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:55:51 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0x4000, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) 17:55:51 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000007400000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:51 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e65726963000000000000c000"}}) 17:55:51 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={'\x00\x00\x00\x00\x00\x00\x00?\x00', 0x8400}) 17:55:51 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0x7, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) [ 1128.299822] binder: 4565:4567 got transaction with invalid data ptr [ 1128.333513] binder_alloc: binder_alloc_mmap_handler: 4565 20001000-20004000 already mapped failed -16 [ 1128.344302] binder: BINDER_SET_CONTEXT_MGR already set 17:55:51 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00\x00\x00\x00\x00\x00@\x00'}}) [ 1128.349810] binder: 4565:4575 ioctl 40046207 0 returned -16 [ 1128.356201] binder_alloc: 4565: binder_alloc_buf, no vma [ 1128.362848] binder_alloc: 4565: binder_alloc_buf, no vma 17:55:51 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000000000740000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:51 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0x100000000000000, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) [ 1128.391827] binder: release 4565:4567 transaction 5941 out, still active [ 1128.402922] binder: undelivered TRANSACTION_COMPLETE [ 1128.419997] binder: send failed reply for transaction 5941, target dead 17:55:52 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x00', 0x8400}) 17:55:52 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e65726963000000000000000000000f00"}}) [ 1128.545061] binder: 4590:4594 got transaction with invalid data ptr [ 1128.573925] binder_alloc: binder_alloc_mmap_handler: 4590 20001000-20004000 already mapped failed -16 [ 1128.614647] binder: BINDER_SET_CONTEXT_MGR already set [ 1128.631450] binder: 4590:4597 ioctl 40046207 0 returned -16 [ 1128.643491] binder: send failed reply for transaction 5946 to 4590:4594 [ 1128.658589] binder: undelivered TRANSACTION_COMPLETE 17:55:52 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x63000}], 0x1, 0x0) 17:55:52 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x74000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:55:52 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0x500000000000000, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) 17:55:52 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e65726963000000000f00"}}) 17:55:52 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000000000000000000a0000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:52 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00', 0x8400}) 17:55:52 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e657269630000000200"}}) 17:55:52 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0x2000, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) [ 1129.310343] binder: 4625:4630 got transaction with invalid data ptr [ 1129.319482] binder_transaction: 14 callbacks suppressed [ 1129.319495] binder: 4625:4630 transaction failed 29201/-14, size 255-0 line 2992 [ 1129.335759] binder_alloc: binder_alloc_mmap_handler: 4625 20001000-20004000 already mapped failed -16 [ 1129.345319] binder: BINDER_SET_CONTEXT_MGR already set [ 1129.375886] binder: 4625:4636 ioctl 40046207 0 returned -16 [ 1129.396592] binder: 4625:4630 transaction failed 29189/-3, size 0-0 line 2973 [ 1129.408044] binder: 4625:4643 transaction failed 29189/-3, size 255-0 line 2973 17:55:52 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0xffffff7f00000000, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) 17:55:52 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={"0000000000000000000000000100", 0x8400}) [ 1129.432018] binder: release 4625:4630 transaction 5951 out, still active [ 1129.449316] binder: undelivered TRANSACTION_COMPLETE 17:55:53 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00\x00\x001\x00'}}) 17:55:53 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000000000070000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) [ 1129.486159] binder: send failed reply for transaction 5951, target dead [ 1129.646422] binder: 4659:4662 got transaction with invalid data ptr [ 1129.655644] binder: 4659:4662 transaction failed 29201/-14, size 255-0 line 2992 [ 1129.674315] binder_alloc: binder_alloc_mmap_handler: 4659 20001000-20004000 already mapped failed -16 [ 1129.685812] binder: BINDER_SET_CONTEXT_MGR already set [ 1129.691308] binder: 4659:4666 ioctl 40046207 0 returned -16 [ 1129.697698] binder: 4659:4662 transaction failed 29189/-3, size 0-0 line 2973 [ 1129.705629] binder: 4659:4662 transaction failed 29189/-3, size 255-0 line 2973 [ 1129.713772] binder: send failed reply for transaction 5956 to 4659:4662 [ 1129.721191] binder: undelivered TRANSACTION_COMPLETE 17:55:53 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0xd4000}], 0x1, 0x0) 17:55:53 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x59000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:55:53 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0xffffffff00000000, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) 17:55:53 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00'}}) 17:55:53 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={'\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00', 0x8400}) 17:55:53 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000030000000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:53 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0x7000000, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) 17:55:53 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696300000000000000000c90f700"}}) [ 1130.321666] binder: 4682:4691 got transaction with invalid data ptr [ 1130.333332] binder: 4682:4691 transaction failed 29201/-14, size 255-0 line 2992 [ 1130.348203] binder_alloc: binder_alloc_mmap_handler: 4682 20001000-20004000 already mapped failed -16 [ 1130.352689] binder: BINDER_SET_CONTEXT_MGR already set [ 1130.414512] binder: 4682:4693 ioctl 40046207 0 returned -16 17:55:53 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e657269630000000000000200"}}) 17:55:53 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0x20000000, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) 17:55:53 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={"000000000000fffffdfd00", 0x8400}) [ 1130.467221] binder_alloc_new_buf_locked: 6 callbacks suppressed [ 1130.467229] binder_alloc: 4682: binder_alloc_buf, no vma [ 1130.514504] binder_alloc: 4682: binder_alloc_buf, no vma [ 1130.514515] binder: 4682:4702 transaction failed 29189/-3, size 0-0 line 2973 [ 1130.551611] binder: 4682:4693 transaction failed 29189/-3, size 255-0 line 2973 [ 1130.559392] binder_release_work: 17 callbacks suppressed 17:55:54 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0x2, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) [ 1130.559399] binder: undelivered TRANSACTION_ERROR: 29189 [ 1130.581146] binder: undelivered TRANSACTION_ERROR: 29189 [ 1130.593285] binder: send failed reply for transaction 5961 to 4682:4691 [ 1130.605728] binder: undelivered TRANSACTION_COMPLETE [ 1130.625808] binder: undelivered TRANSACTION_ERROR: 29189 [ 1130.634934] binder: undelivered TRANSACTION_ERROR: 29201 17:55:54 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x10b000}], 0x1, 0x0) 17:55:54 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0xde000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:55:54 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e657269630000000000000f00"}}) 17:55:54 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000400000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:54 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0x60, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) 17:55:54 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={'\x00\x00\x00\x00\x00\x00\x00@\x00', 0x8400}) 17:55:54 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0x6000000000000000, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) [ 1131.280532] binder: 4738:4744 got transaction with invalid data ptr [ 1131.290900] binder: 4738:4744 transaction failed 29201/-14, size 255-0 line 2992 [ 1131.312534] binder_alloc: binder_alloc_mmap_handler: 4738 20001000-20004000 already mapped failed -16 [ 1131.325565] binder: BINDER_SET_CONTEXT_MGR already set 17:55:54 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00\x00\x00\x000\x00'}}) [ 1131.331111] binder: 4738:4749 ioctl 40046207 0 returned -16 [ 1131.351641] binder_alloc: 4738: binder_alloc_buf, no vma [ 1131.372275] binder_alloc: 4738: binder_alloc_buf, no vma 17:55:54 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0x700000000000000, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) [ 1131.388724] binder: undelivered TRANSACTION_ERROR: 29201 [ 1131.395588] binder: release 4738:4744 transaction 5966 out, still active [ 1131.418320] binder: undelivered TRANSACTION_COMPLETE [ 1131.423492] binder: undelivered TRANSACTION_ERROR: 29189 [ 1131.429919] binder: undelivered TRANSACTION_ERROR: 29189 17:55:54 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000000000007fffffff00000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:54 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696300000000c000"}}) [ 1131.442060] binder: send failed reply for transaction 5966, target dead 17:55:55 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={"000000000000fdfdffff00", 0x8400}) [ 1131.560936] binder: 4765:4771 got transaction with invalid data ptr [ 1131.596718] binder_alloc: binder_alloc_mmap_handler: 4765 20001000-20004000 already mapped failed -16 [ 1131.615690] binder: BINDER_SET_CONTEXT_MGR already set [ 1131.628760] binder: 4765:4776 ioctl 40046207 0 returned -16 [ 1131.635239] binder_alloc: 4765: binder_alloc_buf, no vma [ 1131.648159] binder_alloc: 4765: binder_alloc_buf, no vma [ 1131.654094] binder: undelivered TRANSACTION_ERROR: 29201 [ 1131.663588] binder: undelivered TRANSACTION_ERROR: 29189 [ 1131.674687] binder: undelivered TRANSACTION_ERROR: 29189 [ 1131.686238] binder: send failed reply for transaction 5971 to 4765:4771 [ 1131.693125] binder: undelivered TRANSACTION_COMPLETE 17:55:55 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x90000}], 0x1, 0x0) 17:55:55 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x136000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:55:55 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0x180000000000000, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) 17:55:55 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696300000000f0ffffff7f00"}}) 17:55:55 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000000000480000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:55 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00', 0x8400}) 17:55:55 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e65726963000000000000000000015700"}}) [ 1132.255137] binder: 4798:4802 got transaction with invalid data ptr 17:55:55 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0x6000000, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) [ 1132.297762] binder_alloc: binder_alloc_mmap_handler: 4798 20001000-20004000 already mapped failed -16 [ 1132.315525] binder: BINDER_SET_CONTEXT_MGR already set [ 1132.320848] binder: 4798:4809 ioctl 40046207 0 returned -16 [ 1132.327368] binder_alloc: 4798: binder_alloc_buf, no vma [ 1132.334071] binder_alloc: 4798: binder_alloc_buf, no vma 17:55:55 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00\x00\x00\x00\x00\x00\x00\x00\x00\x000\x00'}}) [ 1132.350953] binder: release 4798:4802 transaction 5976 out, still active [ 1132.359099] binder: undelivered TRANSACTION_COMPLETE [ 1132.364779] binder: send failed reply for transaction 5976, target dead 17:55:55 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0x600, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) 17:55:55 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000000000010000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:55 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x00', 0x8400}) [ 1132.549089] binder: 4826:4831 got transaction with invalid data ptr [ 1132.568847] binder_alloc: binder_alloc_mmap_handler: 4826 20001000-20004000 already mapped failed -16 [ 1132.579016] binder: BINDER_SET_CONTEXT_MGR already set [ 1132.584767] binder: 4826:4835 ioctl 40046207 0 returned -16 [ 1132.591564] binder_alloc: 4826: binder_alloc_buf, no vma [ 1132.601769] binder_alloc: 4826: binder_alloc_buf, no vma [ 1132.609427] binder: release 4826:4831 transaction 5981 out, still active [ 1132.616877] binder: undelivered TRANSACTION_COMPLETE [ 1132.628951] binder: send failed reply for transaction 5981, target dead 17:55:56 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x109000}], 0x1, 0x0) 17:55:56 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00\x00\x00kkk\x00'}}) 17:55:56 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0x4000000000000, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) 17:55:56 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000000073000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:56 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x63000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:55:56 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={'\x00\x00\x00\x00\x00\x00\x00\x00@\x00', 0x8400}) 17:55:56 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0x2000000, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) 17:55:56 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e65726963000000fffffe00"}}) [ 1133.265835] binder: 4857:4862 got transaction with invalid data ptr [ 1133.274358] binder: BINDER_SET_CONTEXT_MGR already set [ 1133.281304] binder_alloc: binder_alloc_mmap_handler: 4857 20001000-20004000 already mapped failed -16 [ 1133.289222] binder: 4857:4867 ioctl 40046207 0 returned -16 [ 1133.305775] binder: release 4857:4862 transaction 5986 out, still active [ 1133.327442] binder: undelivered TRANSACTION_COMPLETE 17:55:56 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x00', 0x8400}) 17:55:56 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0x5000000, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) 17:55:56 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000480000000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) [ 1133.371597] binder: send failed reply for transaction 5986, target dead 17:55:56 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e657269630000000000000100"}}) [ 1133.528008] binder: 4885:4889 got transaction with invalid data ptr [ 1133.544937] binder: BINDER_SET_CONTEXT_MGR already set [ 1133.551743] binder_alloc: binder_alloc_mmap_handler: 4885 20001000-20004000 already mapped failed -16 [ 1133.559563] binder: 4885:4892 ioctl 40046207 0 returned -16 [ 1133.593174] binder: send failed reply for transaction 5991 to 4885:4889 [ 1133.603944] binder: undelivered TRANSACTION_COMPLETE 17:55:57 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x14e000}], 0x1, 0x0) 17:55:57 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0x4000000, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) 17:55:57 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00\x00\x00\x00@\x00'}}) 17:55:57 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={"000000000000000000000100", 0x8400}) 17:55:57 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0xfa000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:55:57 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000000000000070700000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:57 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0xffffff7f, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) 17:55:57 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00\x00\x000\x00'}}) 17:55:57 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00', 0x8400}) 17:55:57 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0x500, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) 17:55:57 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e65726963000000570100"}}) [ 1134.230817] binder: 4926:4931 got transaction with invalid data ptr [ 1134.251087] binder_alloc: binder_alloc_mmap_handler: 4926 20001000-20004000 already mapped failed -16 [ 1134.261846] binder: BINDER_SET_CONTEXT_MGR already set [ 1134.268478] binder: 4926:4934 ioctl 40046207 0 returned -16 17:55:57 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00\x00\x00\x00\x00\x00\x00\x00\x00\x001\x00'}}) [ 1134.304268] binder: release 4926:4931 transaction 5996 out, still active [ 1134.315189] binder: undelivered TRANSACTION_COMPLETE [ 1134.343625] binder: send failed reply for transaction 5996, target dead [ 1134.590333] [ 1134.591994] ====================================================== [ 1134.598324] WARNING: possible circular locking dependency detected [ 1134.604714] 4.20.0-rc3+ #128 Not tainted [ 1134.608757] ------------------------------------------------------ [ 1134.615059] syz-executor0/4914 is trying to acquire lock: [ 1134.620582] 00000000004ef7e6 (cpu_hotplug_lock.rw_sem){++++}, at: static_key_slow_dec+0x57/0xa0 [ 1134.629659] [ 1134.629659] but task is already holding lock: [ 1134.635610] 00000000c068b558 (&mm->mmap_sem){++++}, at: vm_mmap_pgoff+0x1b5/0x2c0 [ 1134.643310] [ 1134.643310] which lock already depends on the new lock. [ 1134.643310] [ 1134.651606] [ 1134.651606] the existing dependency chain (in reverse order) is: [ 1134.659323] [ 1134.659323] -> #3 (&mm->mmap_sem){++++}: [ 1134.664864] __might_fault+0x15e/0x1e0 [ 1134.669255] _copy_to_user+0x30/0x110 [ 1134.673671] perf_read+0x710/0xa60 [ 1134.677716] __vfs_read+0x117/0x9b0 [ 1134.681848] vfs_read+0x17f/0x3c0 [ 1134.685816] ksys_read+0x101/0x260 [ 1134.689867] __x64_sys_read+0x73/0xb0 [ 1134.694192] do_syscall_64+0x1b9/0x820 [ 1134.698597] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1134.704283] [ 1134.704283] -> #2 (&cpuctx_mutex){+.+.}: [ 1134.709812] __mutex_lock+0x166/0x16f0 [ 1134.714202] mutex_lock_nested+0x16/0x20 [ 1134.718767] perf_event_init_cpu+0xd2/0x180 [ 1134.723652] perf_event_init+0x519/0x595 [ 1134.728232] start_kernel+0x646/0xa2b [ 1134.732542] x86_64_start_reservations+0x2e/0x30 [ 1134.737803] x86_64_start_kernel+0x76/0x79 [ 1134.742542] secondary_startup_64+0xa4/0xb0 [ 1134.747460] [ 1134.747460] -> #1 (pmus_lock){+.+.}: [ 1134.752647] __mutex_lock+0x166/0x16f0 [ 1134.757038] mutex_lock_nested+0x16/0x20 [ 1134.761600] perf_event_init_cpu+0x2f/0x180 [ 1134.766468] cpuhp_invoke_callback+0x35d/0x2100 [ 1134.771641] _cpu_up+0x290/0x560 [ 1134.775510] do_cpu_up+0x1ca/0x210 [ 1134.779555] cpu_up+0x18/0x20 [ 1134.783164] smp_init+0x1a3/0x1be [ 1134.787118] kernel_init_freeable+0x431/0x6b9 [ 1134.792133] kernel_init+0x11/0x1ae [ 1134.796264] ret_from_fork+0x3a/0x50 [ 1134.800474] [ 1134.800474] -> #0 (cpu_hotplug_lock.rw_sem){++++}: [ 1134.806883] lock_acquire+0x1ed/0x520 [ 1134.811189] cpus_read_lock+0x3e/0xd0 [ 1134.815498] static_key_slow_dec+0x57/0xa0 [ 1134.820345] sw_perf_event_destroy+0x8b/0x140 [ 1134.825346] _free_event+0x414/0x1660 [ 1134.829694] put_event+0x48/0x60 [ 1134.833566] perf_mmap_close+0x62f/0x1220 [ 1134.838222] remove_vma+0xb1/0x180 [ 1134.842267] __do_munmap+0x751/0xf80 [ 1134.846484] mmap_region+0x6a7/0x1cd0 [ 1134.850783] do_mmap+0xa22/0x1230 [ 1134.854738] vm_mmap_pgoff+0x213/0x2c0 [ 1134.859130] ksys_mmap_pgoff+0x4da/0x660 [ 1134.863732] __x64_sys_mmap+0xe9/0x1b0 [ 1134.868129] do_syscall_64+0x1b9/0x820 [ 1134.872523] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1134.878211] [ 1134.878211] other info that might help us debug this: [ 1134.878211] [ 1134.886335] Chain exists of: [ 1134.886335] cpu_hotplug_lock.rw_sem --> &cpuctx_mutex --> &mm->mmap_sem [ 1134.886335] [ 1134.897596] Possible unsafe locking scenario: [ 1134.897596] [ 1134.903645] CPU0 CPU1 [ 1134.908292] ---- ---- [ 1134.912938] lock(&mm->mmap_sem); [ 1134.916467] lock(&cpuctx_mutex); [ 1134.922505] lock(&mm->mmap_sem); [ 1134.928541] lock(cpu_hotplug_lock.rw_sem); [ 1134.932929] [ 1134.932929] *** DEADLOCK *** [ 1134.932929] [ 1134.938975] 1 lock held by syz-executor0/4914: [ 1134.943534] #0: 00000000c068b558 (&mm->mmap_sem){++++}, at: vm_mmap_pgoff+0x1b5/0x2c0 [ 1134.951590] [ 1134.951590] stack backtrace: [ 1134.956073] CPU: 1 PID: 4914 Comm: syz-executor0 Not tainted 4.20.0-rc3+ #128 [ 1134.963325] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1134.972661] Call Trace: [ 1134.975242] dump_stack+0x244/0x39d [ 1134.978862] ? dump_stack_print_info.cold.1+0x20/0x20 [ 1134.984035] ? vprintk_func+0x85/0x181 [ 1134.987911] print_circular_bug.isra.35.cold.54+0x1bd/0x27d [ 1134.993607] ? save_trace+0xe0/0x290 [ 1134.997306] __lock_acquire+0x3399/0x4c20 [ 1135.001446] ? mark_held_locks+0x130/0x130 [ 1135.005666] ? __lock_acquire+0x62f/0x4c20 [ 1135.009890] ? print_usage_bug+0xc0/0xc0 [ 1135.013936] ? mark_held_locks+0x130/0x130 [ 1135.018157] ? lock_release+0xa00/0xa00 [ 1135.022117] ? perf_trace_sched_process_exec+0x860/0x860 [ 1135.027551] ? print_usage_bug+0xc0/0xc0 [ 1135.031600] ? mark_held_locks+0xc7/0x130 [ 1135.035733] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 1135.040484] ? retint_kernel+0x2d/0x2d [ 1135.044355] ? trace_hardirqs_on_caller+0xc0/0x310 [ 1135.049269] ? mark_held_locks+0xc7/0x130 [ 1135.053406] ? __lock_is_held+0xb5/0x140 [ 1135.057455] lock_acquire+0x1ed/0x520 [ 1135.061243] ? static_key_slow_dec+0x57/0xa0 [ 1135.065638] ? lock_release+0xa00/0xa00 [ 1135.069597] ? perf_trace_sched_process_exec+0x860/0x860 [ 1135.075038] ? swevent_hlist_put_cpu+0x2c0/0x2c0 [ 1135.079777] cpus_read_lock+0x3e/0xd0 [ 1135.083562] ? static_key_slow_dec+0x57/0xa0 [ 1135.087954] static_key_slow_dec+0x57/0xa0 [ 1135.092173] sw_perf_event_destroy+0x8b/0x140 [ 1135.096670] ? swevent_hlist_put_cpu+0x2c0/0x2c0 [ 1135.101409] _free_event+0x414/0x1660 [ 1135.105199] ? ring_buffer_attach+0x840/0x840 [ 1135.109742] ? __wake_up+0xe/0x10 [ 1135.113186] ? check_preemption_disabled+0x48/0x280 [ 1135.118448] ? rcu_read_unlock_special+0x1c0/0x1c0 [ 1135.123362] ? kasan_check_read+0x11/0x20 [ 1135.127493] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 1135.132754] ? rcu_softirq_qs+0x20/0x20 [ 1135.136717] ? lockdep_hardirqs_on+0x3bb/0x5b0 [ 1135.141292] put_event+0x48/0x60 [ 1135.144663] perf_mmap_close+0x62f/0x1220 [ 1135.148798] ? perf_compat_ioctl+0xb0/0xb0 [ 1135.153026] ? kasan_check_write+0x14/0x20 [ 1135.157244] ? tlb_finish_mmu+0x166/0x1f0 [ 1135.161370] ? retint_kernel+0x2d/0x2d [ 1135.165246] ? tlb_gather_mmu+0x440/0x440 [ 1135.169381] ? zap_class+0x640/0x640 [ 1135.173079] ? unmap_region+0x3e5/0x560 [ 1135.177037] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 1135.181780] ? __lock_is_held+0xb5/0x140 [ 1135.185834] ? perf_trace_sched_process_exec+0x860/0x860 [ 1135.191269] ? __might_sleep+0x95/0x190 [ 1135.195227] ? perf_compat_ioctl+0xb0/0xb0 [ 1135.199454] remove_vma+0xb1/0x180 [ 1135.202980] __do_munmap+0x751/0xf80 [ 1135.206679] mmap_region+0x6a7/0x1cd0 [ 1135.210466] ? __x64_sys_brk+0x8b0/0x8b0 [ 1135.214512] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1135.220035] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1135.225559] ? creds_are_invalid+0x58/0x140 [ 1135.229884] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1135.235409] ? inode_has_perm.isra.59+0x17a/0x210 [ 1135.240248] ? mpx_unmapped_area_check+0xd8/0x108 [ 1135.245084] ? arch_get_unmapped_area_topdown+0xc2/0x940 [ 1135.250520] ? selinux_file_open+0x5c0/0x5c0 [ 1135.254917] ? arch_get_unmapped_area+0x750/0x750 [ 1135.259744] ? lock_acquire+0x1ed/0x520 [ 1135.263705] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1135.269226] ? selinux_mmap_addr+0x2d/0x110 [ 1135.273531] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1135.279055] ? security_mmap_addr+0x80/0xa0 [ 1135.283365] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1135.288890] ? get_unmapped_area+0x292/0x3b0 [ 1135.293303] do_mmap+0xa22/0x1230 [ 1135.296743] ? mmap_region+0x1cd0/0x1cd0 [ 1135.300807] ? vm_mmap_pgoff+0x1b5/0x2c0 [ 1135.304869] ? down_read_killable+0x150/0x150 [ 1135.309440] ? security_mmap_file+0x174/0x1b0 [ 1135.313924] vm_mmap_pgoff+0x213/0x2c0 [ 1135.317809] ? vma_is_stack_for_current+0xd0/0xd0 [ 1135.322647] ? _copy_to_user+0xc8/0x110 [ 1135.326616] ? _copy_to_user+0xd9/0x110 [ 1135.330578] ksys_mmap_pgoff+0x4da/0x660 [ 1135.334628] ? do_syscall_64+0x9a/0x820 [ 1135.338589] ? find_mergeable_anon_vma+0xd0/0xd0 [ 1135.343332] ? trace_hardirqs_on+0xbd/0x310 [ 1135.347643] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1135.353179] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1135.358539] ? trace_hardirqs_off_caller+0x310/0x310 [ 1135.363628] __x64_sys_mmap+0xe9/0x1b0 [ 1135.367500] do_syscall_64+0x1b9/0x820 [ 1135.371376] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 1135.376727] ? syscall_return_slowpath+0x5e0/0x5e0 [ 1135.381641] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1135.386470] ? trace_hardirqs_on_caller+0x310/0x310 [ 1135.391475] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 1135.396478] ? prepare_exit_to_usermode+0x291/0x3b0 [ 1135.401483] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1135.406313] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1135.411488] RIP: 0033:0x457569 [ 1135.414698] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1135.433584] RSP: 002b:00007f1ee3413c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 17:55:58 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={"00000000000000fdfdffff00", 0x8400}) 17:55:58 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000ffffffffff60000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:55:58 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0x5, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) 17:55:58 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0xd6000}], 0x1, 0x0) [ 1135.441278] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000000457569 [ 1135.448533] RDX: 0000000000000000 RSI: 0000000000003000 RDI: 0000000020ffd000 [ 1135.455793] RBP: 000000000072bfa0 R08: 000000000000000a R09: 0000000000000000 [ 1135.463049] R10: 0000000000000011 R11: 0000000000000246 R12: 00007f1ee34146d4 [ 1135.470304] R13: 00000000004c2b5d R14: 00000000004d4828 R15: 00000000ffffffff [ 1135.503676] kobject: 'loop0' (0000000022e299dc): kobject_uevent_env [ 1135.512436] kobject: 'loop0' (0000000022e299dc): fill_kobj_path: path = '/devices/virtual/block/loop0' [ 1135.516754] binder: 4958:4962 got transaction with invalid data ptr [ 1135.529305] binder_transaction: 20 callbacks suppressed [ 1135.529321] binder: 4958:4962 transaction failed 29201/-14, size 255-0 line 2992 [ 1135.548728] kobject: 'vet' (00000000fac50e68): kobject_add_internal: parent: 'net', set: 'devices' [ 1135.566688] kobject: 'loop4' (0000000091bb31bb): kobject_uevent_env [ 1135.567058] kobject: 'vet' (00000000fac50e68): kobject_uevent_env [ 1135.573364] kobject: 'loop4' (0000000091bb31bb): fill_kobj_path: path = '/devices/virtual/block/loop4' [ 1135.579584] kobject: 'vet' (00000000fac50e68): fill_kobj_path: path = '/devices/virtual/net/vet' [ 1135.598269] binder: BINDER_SET_CONTEXT_MGR already set [ 1135.603633] binder: 4958:4969 ioctl 40046207 0 returned -16 [ 1135.603689] binder_alloc: binder_alloc_mmap_handler: 4958 20001000-20004000 already mapped failed -16 [ 1135.611033] kobject: 'queues' (00000000704d681f): kobject_add_internal: parent: 'vet', set: '' [ 1135.620571] binder_alloc_new_buf_locked: 6 callbacks suppressed [ 1135.620577] binder_alloc: 4958: binder_alloc_buf, no vma [ 1135.630302] kobject: 'loop4' (0000000091bb31bb): kobject_uevent_env [ 1135.635262] binder: 4958:4962 transaction failed 29189/-3, size 0-0 line 2973 [ 1135.654238] binder_alloc: 4958: binder_alloc_buf, no vma [ 1135.654525] kobject: 'queues' (00000000704d681f): kobject_uevent_env [ 1135.666950] kobject: 'queues' (00000000704d681f): kobject_uevent_env: filter function caused the event to drop! [ 1135.677551] kobject: 'rx-0' (0000000001e007d1): kobject_add_internal: parent: 'queues', set: 'queues' [ 1135.687571] binder_release_work: 17 callbacks suppressed [ 1135.687577] binder: undelivered TRANSACTION_ERROR: 29189 [ 1135.694437] kobject: 'loop4' (0000000091bb31bb): fill_kobj_path: path = '/devices/virtual/block/loop4' [ 1135.698957] kobject: 'rx-0' (0000000001e007d1): kobject_uevent_env [ 1135.714454] binder: 4958:4972 transaction failed 29189/-3, size 255-0 line 2973 [ 1135.722156] binder: send failed reply for transaction 6001 to 4958:4962 [ 1135.729408] binder: undelivered TRANSACTION_ERROR: 29189 [ 1135.734878] binder: undelivered TRANSACTION_COMPLETE [ 1135.740176] kobject: 'rx-0' (0000000001e007d1): fill_kobj_path: path = '/devices/virtual/net/vet/queues/rx-0' [ 1135.750585] binder: undelivered TRANSACTION_ERROR: 29189 [ 1135.760883] binder: undelivered TRANSACTION_ERROR: 29201 [ 1135.768264] kobject: 'tx-0' (000000001d1efd29): kobject_add_internal: parent: 'queues', set: 'queues' [ 1135.778034] kobject: 'tx-0' (000000001d1efd29): kobject_uevent_env [ 1135.784725] kobject: 'tx-0' (000000001d1efd29): fill_kobj_path: path = '/devices/virtual/net/vet/queues/tx-0' [ 1135.813797] kobject: 'rx-0' (0000000001e007d1): kobject_cleanup, parent 00000000704d681f [ 1135.822796] kobject: 'rx-0' (0000000001e007d1): auto cleanup 'remove' event [ 1135.831943] kobject: 'loop3' (0000000043049f60): kobject_uevent_env [ 1135.834704] kobject: 'rx-0' (0000000001e007d1): kobject_uevent_env [ 1135.845066] kobject: 'rx-0' (0000000001e007d1): fill_kobj_path: path = '/devices/virtual/net/vet/queues/rx-0' 17:55:59 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x1c000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:55:59 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696300000000000000000000c000"}}) 17:55:59 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0x300000000000000, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) 17:55:59 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000000000120000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) [ 1135.855569] kobject: 'loop3' (0000000043049f60): fill_kobj_path: path = '/devices/virtual/block/loop3' [ 1135.860303] kobject: 'rx-0' (0000000001e007d1): auto cleanup kobject_del [ 1135.877434] kobject: 'rx-0' (0000000001e007d1): calling ktype release [ 1135.884315] kobject: 'rx-0': free name [ 1135.888399] kobject: 'tx-0' (000000001d1efd29): kobject_cleanup, parent 00000000704d681f [ 1135.896792] kobject: 'tx-0' (000000001d1efd29): auto cleanup 'remove' event [ 1135.904246] kobject: 'tx-0' (000000001d1efd29): kobject_uevent_env 17:55:59 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696300000091cb0100"}}) 17:55:59 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0x200000000000000, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) [ 1135.911277] kobject: 'tx-0' (000000001d1efd29): fill_kobj_path: path = '/devices/virtual/net/vet/queues/tx-0' [ 1135.925765] kobject: 'loop4' (0000000091bb31bb): kobject_uevent_env [ 1135.933819] kobject: 'tx-0' (000000001d1efd29): auto cleanup kobject_del [ 1135.943010] kobject: 'loop2' (0000000064a32e4c): kobject_uevent_env [ 1135.952661] kobject: 'loop4' (0000000091bb31bb): fill_kobj_path: path = '/devices/virtual/block/loop4' 17:55:59 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e65726963000000f7900c00"}}) [ 1135.962856] binder: 4977:4985 got transaction with invalid data ptr [ 1135.967947] kobject: 'tx-0' (000000001d1efd29): calling ktype release [ 1135.977043] kobject: 'loop2' (0000000064a32e4c): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 1135.982658] binder: 4977:4985 transaction failed 29201/-14, size 255-0 line 2992 [ 1135.989778] kobject: 'tx-0': free name 17:55:59 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0x40000, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) [ 1136.010357] kobject: 'loop2' (0000000064a32e4c): kobject_uevent_env [ 1136.017560] kobject: 'queues' (00000000704d681f): kobject_cleanup, parent (null) [ 1136.029383] kobject: 'loop2' (0000000064a32e4c): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 1136.050455] kobject: 'queues' (00000000704d681f): calling ktype release [ 1136.068259] kobject: 'queues' (00000000704d681f): kset_release [ 1136.083913] kobject: 'queues': free name [ 1136.089553] kobject: 'loop4' (0000000091bb31bb): kobject_uevent_env [ 1136.095202] kobject: 'vet' (00000000fac50e68): kobject_uevent_env [ 1136.103085] kobject: 'loop4' (0000000091bb31bb): fill_kobj_path: path = '/devices/virtual/block/loop4' [ 1136.106171] kobject: 'vet' (00000000fac50e68): fill_kobj_path: path = '/devices/virtual/net/vet' [ 1136.123352] binder_alloc: binder_alloc_mmap_handler: 4977 20001000-20004000 already mapped failed -16 [ 1136.143096] binder: BINDER_SET_CONTEXT_MGR already set [ 1136.148740] binder: 4977:4985 ioctl 40046207 0 returned -16 [ 1136.155254] binder_alloc: 4977: binder_alloc_buf, no vma [ 1136.160826] binder: 4977:5004 transaction failed 29189/-3, size 255-0 line 2973 [ 1136.160831] binder_alloc: 4977: binder_alloc_buf, no vma [ 1136.160857] binder: 4977:4980 transaction failed 29189/-3, size 0-0 line 2973 [ 1136.168501] binder: undelivered TRANSACTION_ERROR: 29201 [ 1136.174339] kobject: 'vet' (00000000fac50e68): kobject_cleanup, parent (null) [ 1136.181726] binder: undelivered TRANSACTION_ERROR: 29189 [ 1136.194312] kobject: 'vet' (00000000fac50e68): calling ktype release [ 1136.194903] binder: undelivered TRANSACTION_ERROR: 29189 [ 1136.201237] kobject: 'loop4' (0000000091bb31bb): kobject_uevent_env 17:55:59 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={"0000000000000000000000fffffdfd00", 0x8400}) 17:55:59 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e657269630000000f00"}}) 17:55:59 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0x6000, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696391cb0100"}}) [ 1136.207797] binder: send failed reply for transaction 6006 to 4977:4980 [ 1136.214344] kobject: 'loop4' (0000000091bb31bb): fill_kobj_path: path = '/devices/virtual/block/loop4' [ 1136.225896] binder: undelivered TRANSACTION_COMPLETE [ 1136.225908] binder: undelivered TRANSACTION_ERROR: 29189 [ 1136.235700] kobject: 'vet': free name [ 1136.249834] kobject: 'loop3' (0000000043049f60): kobject_uevent_env [ 1136.256516] kobject: 'loop3' (0000000043049f60): fill_kobj_path: path = '/devices/virtual/block/loop3' [ 1136.282600] kobject: 'loop5' (00000000acd4563f): kobject_uevent_env [ 1136.297529] kobject: 'loop5' (00000000acd4563f): fill_kobj_path: path = '/devices/virtual/block/loop5' [ 1136.310406] kobject: 'vet' (000000003623a952): kobject_add_internal: parent: 'net', set: 'devices' [ 1136.321754] kobject: 'vet' (000000003623a952): kobject_uevent_env [ 1136.332047] kobject: 'vet' (000000003623a952): fill_kobj_path: path = '/devices/virtual/net/vet' [ 1136.341510] kobject: 'loop2' (0000000064a32e4c): kobject_uevent_env [ 1136.348619] kobject: 'queues' (000000001e54a0d7): kobject_add_internal: parent: 'vet', set: '' [ 1136.350295] kobject: 'loop2' (0000000064a32e4c): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 1136.358515] kobject: 'queues' (000000001e54a0d7): kobject_uevent_env [ 1136.377329] kobject: 'queues' (000000001e54a0d7): kobject_uevent_env: filter function caused the event to drop! [ 1136.387901] kobject: 'rx-0' (00000000c434ce90): kobject_add_internal: parent: 'queues', set: 'queues' [ 1136.397467] kobject: 'rx-0' (00000000c434ce90): kobject_uevent_env [ 1136.403837] kobject: 'rx-0' (00000000c434ce90): fill_kobj_path: path = '/devices/virtual/net/vet/queues/rx-0' [ 1136.414417] kobject: 'tx-0' (000000008c8158d9): kobject_add_internal: parent: 'queues', set: 'queues' [ 1136.424340] kobject: 'tx-0' (000000008c8158d9): kobject_uevent_env 17:55:59 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x10f000}], 0x1, 0x0) [ 1136.435535] kobject: 'tx-0' (000000008c8158d9): fill_kobj_path: path = '/devices/virtual/net/vet/queues/tx-0' [ 1136.450069] kobject: 'loop0' (0000000022e299dc): kobject_uevent_env [ 1136.456871] kobject: 'loop0' (0000000022e299dc): fill_kobj_path: path = '/devices/virtual/block/loop0' [ 1136.467844] kobject: 'rx-0' (00000000c434ce90): kobject_cleanup, parent 000000001e54a0d7 [ 1136.476207] kobject: 'rx-0' (00000000c434ce90): auto cleanup 'remove' event [ 1136.483370] kobject: 'rx-0' (00000000c434ce90): kobject_uevent_env [ 1136.489832] kobject: 'rx-0' (00000000c434ce90): fill_kobj_path: path = '/devices/virtual/net/vet/queues/rx-0' [ 1136.500095] kobject: 'rx-0' (00000000c434ce90): auto cleanup kobject_del [ 1136.507155] kobject: 'rx-0' (00000000c434ce90): calling ktype release [ 1136.513849] kobject: 'rx-0': free name [ 1136.517815] kobject: 'tx-0' (000000008c8158d9): kobject_cleanup, parent 000000001e54a0d7 [ 1136.526128] kobject: 'tx-0' (000000008c8158d9): auto cleanup 'remove' event [ 1136.533278] kobject: 'tx-0' (000000008c8158d9): kobject_uevent_env [ 1136.539719] kobject: 'tx-0' (000000008c8158d9): fill_kobj_path: path = '/devices/virtual/net/vet/queues/tx-0' [ 1136.550204] kobject: 'tx-0' (000000008c8158d9): auto cleanup kobject_del [ 1136.557124] kobject: 'tx-0' (000000008c8158d9): calling ktype release [ 1136.563710] kobject: 'tx-0': free name [ 1136.567692] kobject: 'queues' (000000001e54a0d7): kobject_cleanup, parent (null) [ 1136.576118] kobject: 'queues' (000000001e54a0d7): calling ktype release [ 1136.582926] kobject: 'queues' (000000001e54a0d7): kset_release [ 1136.588948] kobject: 'queues': free name [ 1136.593226] kobject: 'vet' (000000003623a952): kobject_uevent_env [ 1136.599535] kobject: 'vet' (000000003623a952): fill_kobj_path: path = '/devices/virtual/net/vet' [ 1136.609355] kobject: 'vet' (000000003c8c4cd8): kobject_add_internal: parent: 'net', set: 'devices' [ 1136.619124] kobject: 'vet' (000000003c8c4cd8): kobject_uevent_env [ 1136.625365] kobject: 'vet' (000000003c8c4cd8): fill_kobj_path: path = '/devices/virtual/net/vet' [ 1136.634466] kobject: 'queues' (0000000096284e6a): kobject_add_internal: parent: 'vet', set: '' [ 1136.643848] kobject: 'queues' (0000000096284e6a): kobject_uevent_env [ 1136.650587] kobject: 'queues' (0000000096284e6a): kobject_uevent_env: filter function caused the event to drop! [ 1136.660900] kobject: 'rx-0' (00000000bcdd5750): kobject_add_internal: parent: 'queues', set: 'queues' [ 1136.670359] kobject: 'rx-0' (00000000bcdd5750): kobject_uevent_env [ 1136.676776] kobject: 'rx-0' (00000000bcdd5750): fill_kobj_path: path = '/devices/virtual/net/vet/queues/rx-0' [ 1136.686942] kobject: 'tx-0' (00000000c4bc5c2a): kobject_add_internal: parent: 'queues', set: 'queues' [ 1136.696397] kobject: 'tx-0' (00000000c4bc5c2a): kobject_uevent_env [ 1136.702970] kobject: 'tx-0' (00000000c4bc5c2a): fill_kobj_path: path = '/devices/virtual/net/vet/queues/tx-0' [ 1136.714568] kobject: 'rx-0' (00000000bcdd5750): kobject_cleanup, parent 0000000096284e6a [ 1136.722869] kobject: 'rx-0' (00000000bcdd5750): auto cleanup 'remove' event [ 1136.730029] kobject: 'rx-0' (00000000bcdd5750): kobject_uevent_env [ 1136.736403] kobject: 'rx-0' (00000000bcdd5750): fill_kobj_path: path = '/devices/virtual/net/vet/queues/rx-0' [ 1136.746805] kobject: 'rx-0' (00000000bcdd5750): auto cleanup kobject_del [ 1136.753677] kobject: 'rx-0' (00000000bcdd5750): calling ktype release [ 1136.760291] kobject: 'rx-0': free name [ 1136.764203] kobject: 'tx-0' (00000000c4bc5c2a): kobject_cleanup, parent 0000000096284e6a [ 1136.772448] kobject: 'tx-0' (00000000c4bc5c2a): auto cleanup 'remove' event [ 1136.779572] kobject: 'tx-0' (00000000c4bc5c2a): kobject_uevent_env [ 1136.786373] kobject: 'tx-0' (00000000c4bc5c2a): fill_kobj_path: path = '/devices/virtual/net/vet/queues/tx-0' [ 1136.796529] kobject: 'tx-0' (00000000c4bc5c2a): auto cleanup kobject_del [ 1136.803387] kobject: 'tx-0' (00000000c4bc5c2a): calling ktype release [ 1136.810118] kobject: 'tx-0': free name [ 1136.814113] kobject: 'queues' (0000000096284e6a): kobject_cleanup, parent (null) [ 1136.822541] kobject: 'queues' (0000000096284e6a): calling ktype release [ 1136.829307] kobject: 'queues' (0000000096284e6a): kset_release [ 1136.835284] kobject: 'queues': free name [ 1136.839729] kobject: 'vet' (000000003c8c4cd8): kobject_uevent_env [ 1136.846024] kobject: 'vet' (000000003c8c4cd8): fill_kobj_path: path = '/devices/virtual/net/vet' [ 1136.855130] kobject: 'vet' (000000003623a952): kobject_cleanup, parent (null) [ 1136.863334] kobject: 'vet' (000000003623a952): calling ktype release [ 1136.870024] kobject: 'vet': free name [ 1136.870995] kobject: 'loop4' (0000000091bb31bb): kobject_uevent_env [ 1136.880939] kobject: 'loop4' (0000000091bb31bb): fill_kobj_path: path = '/devices/virtual/block/loop4' [ 1136.891031] kobject: 'vet' (000000003c8c4cd8): kobject_cleanup, parent (null) [ 1136.900079] kobject: 'vet' (000000003c8c4cd8): calling ktype release [ 1136.906795] kobject: 'vet': free name [ 1136.919894] kobject: 'loop5' (00000000acd4563f): kobject_uevent_env [ 1136.926380] kobject: 'loop5' (00000000acd4563f): fill_kobj_path: path = '/devices/virtual/block/loop5' [ 1136.936694] kobject: 'loop4' (0000000091bb31bb): kobject_uevent_env [ 1136.943452] kobject: 'loop4' (0000000091bb31bb): fill_kobj_path: path = '/devices/virtual/block/loop4' 17:56:00 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x86000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:56:00 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000000000000050700000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:56:00 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)={"0a686173682d67656e6572696391cb0100"}}) 17:56:00 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e65726963000000000000000001cb9100"}}) 17:56:00 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={"00000000000000000000000000000100", 0x8400}) [ 1137.080692] kobject: 'loop4' (0000000091bb31bb): kobject_uevent_env [ 1137.091169] kobject: 'loop4' (0000000091bb31bb): fill_kobj_path: path = '/devices/virtual/block/loop4' [ 1137.092485] kobject: 'vet' (00000000c32bf8e4): kobject_add_internal: parent: 'net', set: 'devices' 17:56:00 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e657269630000000000015700"}}) [ 1137.143026] could not allocate digest TFM handle [ 1137.143026] hash-generic‘Ë [ 1137.151160] kobject: 'loop2' (0000000064a32e4c): kobject_uevent_env [ 1137.153575] kobject: 'vet' (00000000c32bf8e4): kobject_uevent_env [ 1137.158873] kobject: 'loop2' (0000000064a32e4c): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 1137.164360] binder: 5032:5048 got transaction with invalid data ptr 17:56:00 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e65726963000000015700"}}) [ 1137.191647] kobject: 'vet' (00000000c32bf8e4): fill_kobj_path: path = '/devices/virtual/net/vet' [ 1137.197452] binder: 5032:5048 transaction failed 29201/-14, size 255-0 line 2992 [ 1137.201649] kobject: 'queues' (0000000052d54b43): kobject_add_internal: parent: 'vet', set: '' [ 1137.218293] kobject: 'queues' (0000000052d54b43): kobject_uevent_env [ 1137.226691] could not allocate digest TFM handle [ 1137.226691] hash-generic‘Ë 17:56:00 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)={"25686173682d67656e6572696391cb0100"}}) [ 1137.236772] kobject: 'queues' (0000000052d54b43): kobject_uevent_env: filter function caused the event to drop! [ 1137.241242] kobject: 'loop2' (0000000064a32e4c): kobject_uevent_env [ 1137.256250] kobject: 'loop4' (0000000091bb31bb): kobject_uevent_env [ 1137.263125] kobject: 'loop4' (0000000091bb31bb): fill_kobj_path: path = '/devices/virtual/block/loop4' [ 1137.269779] kobject: 'loop2' (0000000064a32e4c): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 1137.273532] kobject: 'rx-0' (000000007185a8e1): kobject_add_internal: parent: 'queues', set: 'queues' 17:56:00 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696300000000c000"}}) [ 1137.322907] kobject: 'rx-0' (000000007185a8e1): kobject_uevent_env [ 1137.347678] kobject: 'rx-0' (000000007185a8e1): fill_kobj_path: path = '/devices/virtual/net/vet/queues/rx-0' [ 1137.362387] kobject: 'loop2' (0000000064a32e4c): kobject_uevent_env 17:56:00 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x168000}], 0x1, 0x0) [ 1137.369139] kobject: 'tx-0' (00000000311e0f14): kobject_add_internal: parent: 'queues', set: 'queues' [ 1137.374010] kobject: 'loop2' (0000000064a32e4c): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 1137.379538] kobject: 'tx-0' (00000000311e0f14): kobject_uevent_env [ 1137.394739] kobject: 'tx-0' (00000000311e0f14): fill_kobj_path: path = '/devices/virtual/net/vet/queues/tx-0' [ 1137.413239] kobject: 'loop0' (0000000022e299dc): kobject_uevent_env [ 1137.422612] binder: BINDER_SET_CONTEXT_MGR already set [ 1137.428508] kobject: 'loop4' (0000000091bb31bb): kobject_uevent_env [ 1137.432529] binder: 5032:5048 ioctl 40046207 0 returned -16 [ 1137.435927] binder_alloc: binder_alloc_mmap_handler: 5032 20001000-20004000 already mapped failed -16 [ 1137.448320] kobject: 'loop0' (0000000022e299dc): fill_kobj_path: path = '/devices/virtual/block/loop0' [ 1137.456938] kobject: 'loop4' (0000000091bb31bb): fill_kobj_path: path = '/devices/virtual/block/loop4' 17:56:00 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696300000000000000000000000200"}}) [ 1137.464041] binder_alloc: 5032: binder_alloc_buf, no vma [ 1137.477020] kobject: 'rx-0' (000000007185a8e1): kobject_cleanup, parent 0000000052d54b43 [ 1137.485231] binder: 5032:5048 transaction failed 29189/-3, size 0-0 line 2973 [ 1137.494213] binder_alloc: 5032: binder_alloc_buf, no vma [ 1137.502100] kobject: 'loop2' (0000000064a32e4c): kobject_uevent_env [ 1137.502201] binder: 5032:5077 transaction failed 29189/-3, size 255-0 line 2973 [ 1137.519719] kobject: 'loop2' (0000000064a32e4c): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 1137.530630] could not allocate digest TFM handle %hash-generic‘Ë [ 1137.534169] kobject: 'rx-0' (000000007185a8e1): auto cleanup 'remove' event [ 1137.560541] kobject: 'rx-0' (000000007185a8e1): kobject_uevent_env [ 1137.571134] binder: undelivered TRANSACTION_ERROR: 29201 [ 1137.577928] binder: send failed reply for transaction 6011 to 5032:5038 [ 1137.585370] binder: undelivered TRANSACTION_ERROR: 29189 [ 1137.589005] kobject: 'rx-0' (000000007185a8e1): fill_kobj_path: path = '/devices/virtual/net/vet/queues/rx-0' [ 1137.591338] binder: undelivered TRANSACTION_COMPLETE [ 1137.604347] kobject: 'rx-0' (000000007185a8e1): auto cleanup kobject_del [ 1137.606665] could not allocate digest TFM handle %hash-generic‘Ë 17:56:01 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x001\x00'}}) [ 1137.613669] kobject: 'rx-0' (000000007185a8e1): calling ktype release [ 1137.629390] kobject: 'loop2' (0000000064a32e4c): kobject_uevent_env [ 1137.638002] kobject: 'loop2' (0000000064a32e4c): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 1137.639187] kobject: 'rx-0': free name [ 1137.651955] kobject: 'tx-0' (00000000311e0f14): kobject_cleanup, parent 0000000052d54b43 [ 1137.667006] kobject: 'tx-0' (00000000311e0f14): auto cleanup 'remove' event [ 1137.674434] kobject: 'tx-0' (00000000311e0f14): kobject_uevent_env [ 1137.681183] kobject: 'tx-0' (00000000311e0f14): fill_kobj_path: path = '/devices/virtual/net/vet/queues/tx-0' [ 1137.690126] kobject: 'loop2' (0000000064a32e4c): kobject_uevent_env [ 1137.691754] kobject: 'tx-0' (00000000311e0f14): auto cleanup kobject_del [ 1137.698097] kobject: 'loop2' (0000000064a32e4c): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 1137.706829] kobject: 'tx-0' (00000000311e0f14): calling ktype release [ 1137.720954] kobject: 'tx-0': free name [ 1137.724985] kobject: 'queues' (0000000052d54b43): kobject_cleanup, parent (null) [ 1137.733659] kobject: 'queues' (0000000052d54b43): calling ktype release [ 1137.740535] kobject: 'queues' (0000000052d54b43): kset_release [ 1137.746661] kobject: 'queues': free name [ 1137.751024] kobject: 'vet' (00000000c32bf8e4): kobject_uevent_env [ 1137.757342] kobject: 'vet' (00000000c32bf8e4): fill_kobj_path: path = '/devices/virtual/net/vet' [ 1137.775735] kobject: 'loop3' (0000000043049f60): kobject_uevent_env [ 1137.782386] kobject: 'loop3' (0000000043049f60): fill_kobj_path: path = '/devices/virtual/block/loop3' [ 1137.815726] kobject: 'vet' (00000000c32bf8e4): kobject_cleanup, parent (null) [ 1137.823916] kobject: 'vet' (00000000c32bf8e4): calling ktype release [ 1137.830621] kobject: 'vet': free name [ 1137.843587] kobject: 'loop5' (00000000acd4563f): kobject_uevent_env [ 1137.850275] kobject: 'loop5' (00000000acd4563f): fill_kobj_path: path = '/devices/virtual/block/loop5' [ 1138.000136] kobject: 'loop4' (0000000091bb31bb): kobject_uevent_env [ 1138.006838] kobject: 'loop4' (0000000091bb31bb): fill_kobj_path: path = '/devices/virtual/block/loop4' [ 1138.076504] kobject: 'loop4' (0000000091bb31bb): kobject_uevent_env [ 1138.083135] kobject: 'loop4' (0000000091bb31bb): fill_kobj_path: path = '/devices/virtual/block/loop4' 17:56:01 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0xe000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:56:01 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)={"670a6173682d67656e6572696391cb0100"}}) 17:56:01 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e657269630000000000000000000000c000"}}) 17:56:01 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000700000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:56:01 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={"000000000000000000000000000100", 0x8400}) [ 1138.198451] kobject: 'loop4' (0000000091bb31bb): kobject_uevent_env [ 1138.206075] kobject: 'loop4' (0000000091bb31bb): fill_kobj_path: path = '/devices/virtual/block/loop4' [ 1138.237909] kobject: 'vet' (00000000b77b6be9): kobject_add_internal: parent: 'net', set: 'devices' 17:56:01 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696300000000570100"}}) [ 1138.254318] kobject: 'loop4' (0000000091bb31bb): kobject_uevent_env [ 1138.271484] kobject: 'vet' (00000000b77b6be9): kobject_uevent_env [ 1138.278068] kobject: 'loop4' (0000000091bb31bb): fill_kobj_path: path = '/devices/virtual/block/loop4' [ 1138.289675] binder: 5104:5119 got transaction with invalid data ptr [ 1138.293391] kobject: 'vet' (00000000b77b6be9): fill_kobj_path: path = '/devices/virtual/net/vet' [ 1138.298539] binder: 5104:5119 transaction failed 29201/-14, size 255-0 line 2992 [ 1138.313532] could not allocate digest TFM handle g [ 1138.313532] ash-generic‘Ë [ 1138.327981] kobject: 'loop2' (0000000064a32e4c): kobject_uevent_env [ 1138.332550] kobject: 'loop4' (0000000091bb31bb): kobject_uevent_env [ 1138.341949] kobject: 'loop4' (0000000091bb31bb): fill_kobj_path: path = '/devices/virtual/block/loop4' [ 1138.376908] kobject: 'loop2' (0000000064a32e4c): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 1138.388925] could not allocate digest TFM handle g [ 1138.388925] ash-generic‘Ë [ 1138.415716] kobject: 'queues' (0000000084deb078): kobject_add_internal: parent: 'vet', set: '' 17:56:01 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e65726963000000000200"}}) 17:56:01 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)={"67256173682d67656e6572696391cb0100"}}) [ 1138.466607] kobject: 'queues' (0000000084deb078): kobject_uevent_env [ 1138.485642] kobject: 'queues' (0000000084deb078): kobject_uevent_env: filter function caused the event to drop! 17:56:02 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x108000}], 0x1, 0x0) [ 1138.512911] kobject: 'rx-0' (00000000fd9fb434): kobject_add_internal: parent: 'queues', set: 'queues' [ 1138.532807] kobject: 'rx-0' (00000000fd9fb434): kobject_uevent_env [ 1138.543819] kobject: 'rx-0' (00000000fd9fb434): fill_kobj_path: path = '/devices/virtual/net/vet/queues/rx-0' [ 1138.556609] kobject: 'loop4' (0000000091bb31bb): kobject_uevent_env 17:56:02 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e657269630000000091cb0100"}}) [ 1138.559029] kobject: 'tx-0' (0000000007f0740f): kobject_add_internal: parent: 'queues', set: 'queues' [ 1138.572851] kobject: 'loop0' (0000000022e299dc): kobject_uevent_env [ 1138.576734] kobject: 'loop4' (0000000091bb31bb): fill_kobj_path: path = '/devices/virtual/block/loop4' [ 1138.579625] kobject: 'loop0' (0000000022e299dc): fill_kobj_path: path = '/devices/virtual/block/loop0' [ 1138.598979] kobject: 'tx-0' (0000000007f0740f): kobject_uevent_env [ 1138.605771] kobject: 'tx-0' (0000000007f0740f): fill_kobj_path: path = '/devices/virtual/net/vet/queues/tx-0' [ 1138.619044] kobject: 'loop2' (0000000064a32e4c): kobject_uevent_env [ 1138.627086] kobject: 'loop2' (0000000064a32e4c): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 1138.637206] binder: BINDER_SET_CONTEXT_MGR already set [ 1138.644198] binder: 5104:5111 ioctl 40046207 0 returned -16 [ 1138.653229] kobject: 'rx-0' (00000000fd9fb434): kobject_cleanup, parent 0000000084deb078 [ 1138.666002] kobject: 'rx-0' (00000000fd9fb434): auto cleanup 'remove' event [ 1138.671989] binder_alloc: 5104: binder_alloc_buf, no vma [ 1138.688974] could not allocate digest TFM handle g%ash-generic‘Ë [ 1138.697956] binder_alloc: 5104: binder_alloc_buf, no vma [ 1138.700666] kobject: 'rx-0' (00000000fd9fb434): kobject_uevent_env [ 1138.706104] binder: release 5104:5111 transaction 6016 out, still active 17:56:02 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e657269630000000000000000fffffe00"}}) [ 1138.714497] kobject: 'rx-0' (00000000fd9fb434): fill_kobj_path: path = '/devices/virtual/net/vet/queues/rx-0' [ 1138.724662] binder: undelivered TRANSACTION_COMPLETE [ 1138.727965] kobject: 'loop2' (0000000064a32e4c): kobject_uevent_env [ 1138.733604] binder: send failed reply for transaction 6016, target dead [ 1138.739015] kobject: 'loop2' (0000000064a32e4c): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 1138.761094] kobject: 'rx-0' (00000000fd9fb434): auto cleanup kobject_del 17:56:02 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)={"67682573682d67656e6572696391cb0100"}}) [ 1138.768656] could not allocate digest TFM handle g%ash-generic‘Ë [ 1138.775734] kobject: 'rx-0' (00000000fd9fb434): calling ktype release [ 1138.784433] kobject: 'rx-0': free name [ 1138.789146] kobject: 'tx-0' (0000000007f0740f): kobject_cleanup, parent 0000000084deb078 [ 1138.800214] kobject: 'tx-0' (0000000007f0740f): auto cleanup 'remove' event [ 1138.812376] kobject: 'tx-0' (0000000007f0740f): kobject_uevent_env [ 1138.819099] kobject: 'loop2' (0000000064a32e4c): kobject_uevent_env [ 1138.825945] kobject: 'loop2' (0000000064a32e4c): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 1138.829322] kobject: 'tx-0' (0000000007f0740f): fill_kobj_path: path = '/devices/virtual/net/vet/queues/tx-0' [ 1138.846312] kobject: 'tx-0' (0000000007f0740f): auto cleanup kobject_del [ 1138.857750] kobject: 'tx-0' (0000000007f0740f): calling ktype release [ 1138.864443] kobject: 'tx-0': free name [ 1138.865337] could not allocate digest TFM handle gh%sh-generic‘Ë [ 1138.868734] kobject: 'queues' (0000000084deb078): kobject_cleanup, parent (null) [ 1138.883189] kobject: 'queues' (0000000084deb078): calling ktype release [ 1138.890039] kobject: 'queues' (0000000084deb078): kset_release [ 1138.896334] kobject: 'queues': free name [ 1138.897947] could not allocate digest TFM handle gh%sh-generic‘Ë [ 1138.900753] kobject: 'vet' (00000000b77b6be9): kobject_uevent_env [ 1138.913015] kobject: 'vet' (00000000b77b6be9): fill_kobj_path: path = '/devices/virtual/net/vet' [ 1138.924791] kobject: 'vet' (000000003dace75f): kobject_add_internal: parent: 'net', set: 'devices' [ 1138.934923] kobject: 'vet' (000000003dace75f): kobject_uevent_env [ 1138.940309] kobject: 'loop3' (0000000043049f60): kobject_uevent_env [ 1138.941214] kobject: 'vet' (000000003dace75f): fill_kobj_path: path = '/devices/virtual/net/vet' [ 1138.948008] kobject: 'loop3' (0000000043049f60): fill_kobj_path: path = '/devices/virtual/block/loop3' [ 1138.956695] kobject: 'queues' (0000000083d929d5): kobject_add_internal: parent: 'vet', set: '' [ 1138.956724] kobject: 'queues' (0000000083d929d5): kobject_uevent_env [ 1138.956733] kobject: 'queues' (0000000083d929d5): kobject_uevent_env: filter function caused the event to drop! [ 1138.956753] kobject: 'rx-0' (00000000517525db): kobject_add_internal: parent: 'queues', set: 'queues' [ 1139.001757] kobject: 'rx-0' (00000000517525db): kobject_uevent_env [ 1139.008121] kobject: 'rx-0' (00000000517525db): fill_kobj_path: path = '/devices/virtual/net/vet/queues/rx-0' [ 1139.018238] kobject: 'tx-0' (000000001d0be977): kobject_add_internal: parent: 'queues', set: 'queues' [ 1139.027762] kobject: 'tx-0' (000000001d0be977): kobject_uevent_env [ 1139.034088] kobject: 'tx-0' (000000001d0be977): fill_kobj_path: path = '/devices/virtual/net/vet/queues/tx-0' [ 1139.045992] kobject: 'rx-0' (00000000517525db): kobject_cleanup, parent 0000000083d929d5 [ 1139.054243] kobject: 'rx-0' (00000000517525db): auto cleanup 'remove' event [ 1139.061366] kobject: 'rx-0' (00000000517525db): kobject_uevent_env [ 1139.067745] kobject: 'rx-0' (00000000517525db): fill_kobj_path: path = '/devices/virtual/net/vet/queues/rx-0' [ 1139.077886] kobject: 'rx-0' (00000000517525db): auto cleanup kobject_del [ 1139.084736] kobject: 'rx-0' (00000000517525db): calling ktype release [ 1139.091343] kobject: 'rx-0': free name [ 1139.095275] kobject: 'tx-0' (000000001d0be977): kobject_cleanup, parent 0000000083d929d5 [ 1139.103569] kobject: 'tx-0' (000000001d0be977): auto cleanup 'remove' event [ 1139.110724] kobject: 'tx-0' (000000001d0be977): kobject_uevent_env [ 1139.117097] kobject: 'tx-0' (000000001d0be977): fill_kobj_path: path = '/devices/virtual/net/vet/queues/tx-0' [ 1139.122348] kobject: 'loop4' (0000000091bb31bb): kobject_uevent_env [ 1139.127327] kobject: 'tx-0' (000000001d0be977): auto cleanup kobject_del [ 1139.134488] kobject: 'loop4' (0000000091bb31bb): fill_kobj_path: path = '/devices/virtual/block/loop4' [ 1139.141010] kobject: 'tx-0' (000000001d0be977): calling ktype release [ 1139.141017] kobject: 'tx-0': free name [ 1139.141039] kobject: 'queues' (0000000083d929d5): kobject_cleanup, parent (null) 17:56:02 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x132000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:56:02 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696300000000000000000001cb9100"}}) 17:56:02 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)={"67680a73682d67656e6572696391cb0100"}}) 17:56:02 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000000000040000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) [ 1139.141047] kobject: 'queues' (0000000083d929d5): calling ktype release [ 1139.141055] kobject: 'queues' (0000000083d929d5): kset_release [ 1139.141072] kobject: 'queues': free name [ 1139.186581] kobject: 'vet' (000000003dace75f): kobject_uevent_env [ 1139.192814] kobject: 'vet' (000000003dace75f): fill_kobj_path: path = '/devices/virtual/net/vet' [ 1139.202195] kobject: 'vet' (00000000b77b6be9): kobject_cleanup, parent (null) [ 1139.210458] kobject: 'vet' (00000000b77b6be9): calling ktype release [ 1139.217081] kobject: 'vet': free name [ 1139.252132] kobject: 'vet' (000000003dace75f): kobject_cleanup, parent (null) [ 1139.263621] kobject: 'vet' (000000003dace75f): calling ktype release [ 1139.270838] kobject: 'vet': free name [ 1139.277057] could not allocate digest TFM handle gh [ 1139.277057] sh-generic‘Ë [ 1139.277766] binder: 5176:5178 got transaction with invalid data ptr [ 1139.295940] kobject: 'loop4' (0000000091bb31bb): kobject_uevent_env 17:56:02 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={"0000000000000000000000ffffffff00", 0x8400}) 17:56:02 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e65726963000000000000000100"}}) [ 1139.302409] kobject: 'loop4' (0000000091bb31bb): fill_kobj_path: path = '/devices/virtual/block/loop4' [ 1139.318812] kobject: 'loop5' (00000000acd4563f): kobject_uevent_env [ 1139.325280] kobject: 'loop5' (00000000acd4563f): fill_kobj_path: path = '/devices/virtual/block/loop5' [ 1139.335981] could not allocate digest TFM handle gh [ 1139.335981] sh-generic‘Ë [ 1139.346672] binder_alloc: binder_alloc_mmap_handler: 5176 20001000-20004000 already mapped failed -16 17:56:02 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)={"6768616c682d67656e6572696391cb0100"}}) [ 1139.373418] kobject: 'vet' (0000000031ea7e45): kobject_add_internal: parent: 'net', set: 'devices' [ 1139.373668] kobject: 'loop2' (0000000064a32e4c): kobject_uevent_env [ 1139.383843] binder: BINDER_SET_CONTEXT_MGR already set [ 1139.392929] kobject: 'loop2' (0000000064a32e4c): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 1139.412837] kobject: 'vet' (0000000031ea7e45): kobject_uevent_env [ 1139.424566] binder: 5176:5190 ioctl 40046207 0 returned -16 [ 1139.431065] kobject: 'vet' (0000000031ea7e45): fill_kobj_path: path = '/devices/virtual/net/vet' [ 1139.440901] binder_alloc: 5176: binder_alloc_buf, no vma [ 1139.446604] binder_alloc: 5176: binder_alloc_buf, no vma [ 1139.452271] kobject: 'queues' (00000000c62e8ab3): kobject_add_internal: parent: 'vet', set: '' [ 1139.462044] binder: release 5176:5178 transaction 6021 out, still active 17:56:03 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00\x00\x00\x001\x00'}}) [ 1139.485390] binder: undelivered TRANSACTION_COMPLETE [ 1139.497985] kobject: 'loop2' (0000000064a32e4c): kobject_uevent_env [ 1139.505610] kobject: 'loop2' (0000000064a32e4c): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 1139.533734] kobject: 'loop4' (0000000091bb31bb): kobject_uevent_env [ 1139.545347] kobject: 'loop4' (0000000091bb31bb): fill_kobj_path: path = '/devices/virtual/block/loop4' [ 1139.561491] binder: send failed reply for transaction 6021, target dead [ 1139.567902] could not allocate digest TFM handle ghalh-generic‘Ë [ 1139.587809] kobject: 'loop2' (0000000064a32e4c): kobject_uevent_env [ 1139.594343] kobject: 'loop2' (0000000064a32e4c): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 1139.598545] kobject: 'queues' (00000000c62e8ab3): kobject_uevent_env [ 1139.610497] kobject: 'queues' (00000000c62e8ab3): kobject_uevent_env: filter function caused the event to drop! [ 1139.620819] kobject: 'rx-0' (00000000ed017615): kobject_add_internal: parent: 'queues', set: 'queues' [ 1139.630334] kobject: 'rx-0' (00000000ed017615): kobject_uevent_env [ 1139.637033] kobject: 'rx-0' (00000000ed017615): fill_kobj_path: path = '/devices/virtual/net/vet/queues/rx-0' [ 1139.652701] kobject: 'tx-0' (0000000084c5dd43): kobject_add_internal: parent: 'queues', set: 'queues' [ 1139.657677] could not allocate digest TFM handle ghalh-generic‘Ë [ 1139.662437] kobject: 'tx-0' (0000000084c5dd43): kobject_uevent_env [ 1139.675230] kobject: 'tx-0' (0000000084c5dd43): fill_kobj_path: path = '/devices/virtual/net/vet/queues/tx-0' 17:56:03 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e657269630000000000f0ffffff7f00"}}) 17:56:03 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x19a000}], 0x1, 0x0) 17:56:03 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)={"67686125682d67656e6572696391cb0100"}}) [ 1139.730358] kobject: 'loop0' (0000000022e299dc): kobject_uevent_env [ 1139.756526] kobject: 'loop0' (0000000022e299dc): fill_kobj_path: path = '/devices/virtual/block/loop0' 17:56:03 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000000000060000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) [ 1139.774006] kobject: 'rx-0' (00000000ed017615): kobject_cleanup, parent 00000000c62e8ab3 [ 1139.788138] kobject: 'loop4' (0000000091bb31bb): kobject_uevent_env [ 1139.794646] kobject: 'loop3' (0000000043049f60): kobject_uevent_env [ 1139.794672] kobject: 'loop3' (0000000043049f60): fill_kobj_path: path = '/devices/virtual/block/loop3' [ 1139.810073] kobject: 'rx-0' (00000000ed017615): auto cleanup 'remove' event [ 1139.818526] kobject: 'loop4' (0000000091bb31bb): fill_kobj_path: path = '/devices/virtual/block/loop4' [ 1139.832592] kobject: 'rx-0' (00000000ed017615): kobject_uevent_env [ 1139.845707] kobject: 'rx-0' (00000000ed017615): fill_kobj_path: path = '/devices/virtual/net/vet/queues/rx-0' [ 1139.858128] kobject: 'rx-0' (00000000ed017615): auto cleanup kobject_del [ 1139.860021] kobject: 'loop2' (0000000064a32e4c): kobject_uevent_env [ 1139.865884] kobject: 'rx-0' (00000000ed017615): calling ktype release [ 1139.878291] kobject: 'rx-0': free name [ 1139.882947] kobject: 'tx-0' (0000000084c5dd43): kobject_cleanup, parent 00000000c62e8ab3 [ 1139.895496] kobject: 'loop2' (0000000064a32e4c): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 1139.903882] kobject: 'tx-0' (0000000084c5dd43): auto cleanup 'remove' event [ 1139.915573] kobject: 'tx-0' (0000000084c5dd43): kobject_uevent_env [ 1139.922029] kobject: 'tx-0' (0000000084c5dd43): fill_kobj_path: path = '/devices/virtual/net/vet/queues/tx-0' [ 1139.949687] kobject: 'tx-0' (0000000084c5dd43): auto cleanup kobject_del [ 1139.960025] kobject: 'tx-0' (0000000084c5dd43): calling ktype release [ 1139.967100] kobject: 'tx-0': free name [ 1139.967106] binder: 5227:5238 got transaction with invalid data ptr [ 1139.972619] could not allocate digest TFM handle gha%h-generic‘Ë [ 1139.984118] kobject: 'queues' (00000000c62e8ab3): kobject_cleanup, parent (null) [ 1139.995320] kobject: 'queues' (00000000c62e8ab3): calling ktype release [ 1140.004561] kobject: 'queues' (00000000c62e8ab3): kset_release [ 1140.010866] kobject: 'queues': free name [ 1140.015651] kobject: 'vet' (0000000031ea7e45): kobject_uevent_env [ 1140.022061] kobject: 'vet' (0000000031ea7e45): fill_kobj_path: path = '/devices/virtual/net/vet' [ 1140.024225] could not allocate digest TFM handle gha%h-generic‘Ë [ 1140.038432] kobject: 'vet' (000000000261fbde): kobject_add_internal: parent: 'net', set: 'devices' [ 1140.048394] kobject: 'vet' (000000000261fbde): kobject_uevent_env [ 1140.057523] kobject: 'vet' (000000000261fbde): fill_kobj_path: path = '/devices/virtual/net/vet' [ 1140.066701] kobject: 'queues' (00000000c6fc8efa): kobject_add_internal: parent: 'vet', set: '' [ 1140.076130] kobject: 'queues' (00000000c6fc8efa): kobject_uevent_env [ 1140.082750] kobject: 'queues' (00000000c6fc8efa): kobject_uevent_env: filter function caused the event to drop! [ 1140.093459] kobject: 'rx-0' (0000000034955402): kobject_add_internal: parent: 'queues', set: 'queues' [ 1140.102909] kobject: 'rx-0' (0000000034955402): kobject_uevent_env [ 1140.109252] kobject: 'rx-0' (0000000034955402): fill_kobj_path: path = '/devices/virtual/net/vet/queues/rx-0' [ 1140.119405] kobject: 'tx-0' (000000003bf746d0): kobject_add_internal: parent: 'queues', set: 'queues' [ 1140.128869] kobject: 'tx-0' (000000003bf746d0): kobject_uevent_env [ 1140.135195] kobject: 'tx-0' (000000003bf746d0): fill_kobj_path: path = '/devices/virtual/net/vet/queues/tx-0' [ 1140.147045] kobject: 'rx-0' (0000000034955402): kobject_cleanup, parent 00000000c6fc8efa [ 1140.155299] kobject: 'rx-0' (0000000034955402): auto cleanup 'remove' event [ 1140.162437] kobject: 'rx-0' (0000000034955402): kobject_uevent_env [ 1140.168804] kobject: 'rx-0' (0000000034955402): fill_kobj_path: path = '/devices/virtual/net/vet/queues/rx-0' [ 1140.178940] kobject: 'rx-0' (0000000034955402): auto cleanup kobject_del [ 1140.185827] kobject: 'rx-0' (0000000034955402): calling ktype release [ 1140.192397] kobject: 'rx-0': free name [ 1140.196352] kobject: 'tx-0' (000000003bf746d0): kobject_cleanup, parent 00000000c6fc8efa [ 1140.204584] kobject: 'tx-0' (000000003bf746d0): auto cleanup 'remove' event [ 1140.211746] kobject: 'tx-0' (000000003bf746d0): kobject_uevent_env [ 1140.218481] kobject: 'tx-0' (000000003bf746d0): fill_kobj_path: path = '/devices/virtual/net/vet/queues/tx-0' [ 1140.228742] kobject: 'tx-0' (000000003bf746d0): auto cleanup kobject_del [ 1140.230369] kobject: 'loop4' (0000000091bb31bb): kobject_uevent_env [ 1140.235661] kobject: 'tx-0' (000000003bf746d0): calling ktype release [ 1140.235667] kobject: 'tx-0': free name [ 1140.235698] kobject: 'queues' (00000000c6fc8efa): kobject_cleanup, parent (null) [ 1140.242776] kobject: 'loop4' (0000000091bb31bb): fill_kobj_path: path = '/devices/virtual/block/loop4' [ 1140.248867] kobject: 'queues' (00000000c6fc8efa): calling ktype release [ 1140.248876] kobject: 'queues' (00000000c6fc8efa): kset_release [ 1140.248885] kobject: 'queues': free name [ 1140.249233] kobject: 'vet' (000000000261fbde): kobject_uevent_env [ 1140.269425] kobject: 'loop4' (0000000091bb31bb): kobject_uevent_env 17:56:03 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x13f000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:56:03 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696300000000f7900c00"}}) 17:56:03 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)={"67686169682d67656e6572696391cb0100"}}) [ 1140.279364] kobject: 'vet' (000000000261fbde): fill_kobj_path: path = '/devices/virtual/net/vet' [ 1140.283761] kobject: 'loop4' (0000000091bb31bb): fill_kobj_path: path = '/devices/virtual/block/loop4' [ 1140.330707] kobject: 'vet' (0000000031ea7e45): kobject_cleanup, parent (null) [ 1140.339270] binder: BINDER_SET_CONTEXT_MGR already set 17:56:03 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00\x00\x00\x000\x00'}}) [ 1140.344648] binder_alloc: binder_alloc_mmap_handler: 5227 20001000-20004000 already mapped failed -16 [ 1140.344724] binder: 5227:5238 ioctl 40046207 0 returned -16 [ 1140.364911] kobject: 'vet' (000000000261fbde): kobject_cleanup, parent (null) [ 1140.365476] kobject: 'vet' (0000000031ea7e45): calling ktype release [ 1140.380985] kobject: 'vet' (000000000261fbde): calling ktype release [ 1140.386302] kobject: 'vet': free name [ 1140.391614] kobject: 'loop2' (0000000064a32e4c): kobject_uevent_env [ 1140.395922] kobject: 'vet': free name 17:56:03 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={"00000000000000fffffdfd00", 0x8400}) [ 1140.405614] kobject: 'loop4' (0000000091bb31bb): kobject_uevent_env [ 1140.412051] kobject: 'loop4' (0000000091bb31bb): fill_kobj_path: path = '/devices/virtual/block/loop4' [ 1140.423158] could not allocate digest TFM handle ghaih-generic‘Ë [ 1140.424228] kobject: 'loop2' (0000000064a32e4c): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 1140.441955] binder: send failed reply for transaction 6026 to 5227:5229 17:56:03 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000006c00000000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) [ 1140.455281] binder: undelivered TRANSACTION_COMPLETE [ 1140.472333] kobject: 'loop5' (00000000acd4563f): kobject_uevent_env [ 1140.484236] kobject: 'vet' (000000007ac2a5fc): kobject_add_internal: parent: 'net', set: 'devices' [ 1140.493469] kobject: 'loop5' (00000000acd4563f): fill_kobj_path: path = '/devices/virtual/block/loop5' [ 1140.493701] could not allocate digest TFM handle ghaih-generic‘Ë [ 1140.515741] kobject: 'vet' (000000007ac2a5fc): kobject_uevent_env [ 1140.525415] kobject: 'vet' (000000007ac2a5fc): fill_kobj_path: path = '/devices/virtual/net/vet' [ 1140.529526] kobject: 'loop3' (0000000043049f60): kobject_uevent_env [ 1140.546470] kobject: 'loop3' (0000000043049f60): fill_kobj_path: path = '/devices/virtual/block/loop3' 17:56:04 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e657269630000000000007ffffffff000"}}) 17:56:04 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)={"6768612e682d67656e6572696391cb0100"}}) [ 1140.549922] kobject: 'queues' (00000000b0857b66): kobject_add_internal: parent: 'vet', set: '' [ 1140.589168] kobject: 'queues' (00000000b0857b66): kobject_uevent_env [ 1140.593110] binder: 5268:5276 got transaction with invalid data ptr [ 1140.597379] kobject: 'loop4' (0000000091bb31bb): kobject_uevent_env [ 1140.602667] binder_transaction: 8 callbacks suppressed [ 1140.602681] binder: 5268:5276 transaction failed 29201/-14, size 255-0 line 2992 [ 1140.615982] kobject: 'queues' (00000000b0857b66): kobject_uevent_env: filter function caused the event to drop! [ 1140.641196] kobject: 'loop4' (0000000091bb31bb): fill_kobj_path: path = '/devices/virtual/block/loop4' 17:56:04 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e657269630000000000c000"}}) [ 1140.658958] kobject: 'rx-0' (000000005597088e): kobject_add_internal: parent: 'queues', set: 'queues' [ 1140.699102] kobject: 'loop2' (0000000064a32e4c): kobject_uevent_env [ 1140.699774] kobject: 'rx-0' (000000005597088e): kobject_uevent_env [ 1140.707176] kobject: 'loop2' (0000000064a32e4c): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 1140.718590] kobject: 'rx-0' (000000005597088e): fill_kobj_path: path = '/devices/virtual/net/vet/queues/rx-0' [ 1140.732024] kobject: 'tx-0' (000000006aeae747): kobject_add_internal: parent: 'queues', set: 'queues' [ 1140.732428] could not allocate digest TFM handle gha.h-generic‘Ë [ 1140.741833] kobject: 'tx-0' (000000006aeae747): kobject_uevent_env [ 1140.754280] kobject: 'tx-0' (000000006aeae747): fill_kobj_path: path = '/devices/virtual/net/vet/queues/tx-0' [ 1140.768577] binder: BINDER_SET_CONTEXT_MGR already set [ 1140.778744] kobject: 'rx-0' (000000005597088e): kobject_cleanup, parent 00000000b0857b66 [ 1140.792915] binder: 5268:5269 ioctl 40046207 0 returned -16 [ 1140.796095] kobject: 'loop4' (0000000091bb31bb): kobject_uevent_env 17:56:04 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x6e000}], 0x1, 0x0) 17:56:04 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e65726963000000000000015700"}}) [ 1140.805459] kobject: 'loop4' (0000000091bb31bb): fill_kobj_path: path = '/devices/virtual/block/loop4' [ 1140.813222] kobject: 'loop0' (0000000022e299dc): kobject_uevent_env [ 1140.823081] binder_alloc_new_buf_locked: 2 callbacks suppressed [ 1140.823087] binder_alloc: 5268: binder_alloc_buf, no vma [ 1140.826933] kobject: 'loop0' (0000000022e299dc): fill_kobj_path: path = '/devices/virtual/block/loop0' [ 1140.841509] binder: 5268:5297 transaction failed 29189/-3, size 255-0 line 2973 [ 1140.844446] could not allocate digest TFM handle gha.h-generic‘Ë [ 1140.855679] kobject: 'rx-0' (000000005597088e): auto cleanup 'remove' event [ 1140.869175] binder: send failed reply for transaction 6031 to 5268:5269 [ 1140.878748] kobject: 'rx-0' (000000005597088e): kobject_uevent_env [ 1140.885532] binder_alloc: 5268: binder_alloc_buf, no vma [ 1140.885535] binder: undelivered TRANSACTION_COMPLETE [ 1140.885548] binder_release_work: 12 callbacks suppressed [ 1140.885553] binder: undelivered TRANSACTION_ERROR: 29189 17:56:04 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)={"67686130682d67656e6572696391cb0100"}}) [ 1140.891338] kobject: 'rx-0' (000000005597088e): fill_kobj_path: path = '/devices/virtual/net/vet/queues/rx-0' [ 1140.906350] kobject: 'loop2' (0000000064a32e4c): kobject_uevent_env [ 1140.917506] binder: 5268:5269 transaction failed 29189/-3, size 0-0 line 2973 [ 1140.923738] binder: undelivered TRANSACTION_ERROR: 29189 [ 1140.935703] kobject: 'rx-0' (000000005597088e): auto cleanup kobject_del [ 1140.953941] kobject: 'loop2' (0000000064a32e4c): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 1140.956711] kobject: 'rx-0' (000000005597088e): calling ktype release [ 1140.963696] binder: undelivered TRANSACTION_ERROR: 29189 [ 1140.978925] kobject: 'rx-0': free name [ 1140.987680] kobject: 'tx-0' (000000006aeae747): kobject_cleanup, parent 00000000b0857b66 [ 1140.989699] kobject: 'loop2' (0000000064a32e4c): kobject_uevent_env [ 1141.002428] binder: undelivered TRANSACTION_ERROR: 29201 [ 1141.003055] kobject: 'tx-0' (000000006aeae747): auto cleanup 'remove' event [ 1141.014491] kobject: 'loop2' (0000000064a32e4c): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 1141.020310] kobject: 'tx-0' (000000006aeae747): kobject_uevent_env [ 1141.031560] kobject: 'tx-0' (000000006aeae747): fill_kobj_path: path = '/devices/virtual/net/vet/queues/tx-0' [ 1141.041988] could not allocate digest TFM handle gha0h-generic‘Ë [ 1141.048960] kobject: 'tx-0' (000000006aeae747): auto cleanup kobject_del [ 1141.057209] kobject: 'tx-0' (000000006aeae747): calling ktype release [ 1141.065376] kobject: 'tx-0': free name [ 1141.069437] kobject: 'queues' (00000000b0857b66): kobject_cleanup, parent (null) [ 1141.078778] kobject: 'queues' (00000000b0857b66): calling ktype release [ 1141.082839] could not allocate digest TFM handle gha0h-generic‘Ë [ 1141.085620] kobject: 'queues' (00000000b0857b66): kset_release [ 1141.085631] kobject: 'queues': free name [ 1141.085963] kobject: 'vet' (000000007ac2a5fc): kobject_uevent_env [ 1141.108367] kobject: 'vet' (000000007ac2a5fc): fill_kobj_path: path = '/devices/virtual/net/vet' [ 1141.117932] kobject: 'vet' (0000000055aec8fc): kobject_add_internal: parent: 'net', set: 'devices' [ 1141.127621] kobject: 'vet' (0000000055aec8fc): kobject_uevent_env [ 1141.133888] kobject: 'vet' (0000000055aec8fc): fill_kobj_path: path = '/devices/virtual/net/vet' [ 1141.142948] kobject: 'queues' (00000000320dae00): kobject_add_internal: parent: 'vet', set: '' [ 1141.152307] kobject: 'queues' (00000000320dae00): kobject_uevent_env [ 1141.159157] kobject: 'queues' (00000000320dae00): kobject_uevent_env: filter function caused the event to drop! [ 1141.169450] kobject: 'rx-0' (00000000ef4b3506): kobject_add_internal: parent: 'queues', set: 'queues' [ 1141.178982] kobject: 'rx-0' (00000000ef4b3506): kobject_uevent_env [ 1141.185987] kobject: 'rx-0' (00000000ef4b3506): fill_kobj_path: path = '/devices/virtual/net/vet/queues/rx-0' [ 1141.196126] kobject: 'tx-0' (00000000bbba84df): kobject_add_internal: parent: 'queues', set: 'queues' [ 1141.205650] kobject: 'tx-0' (00000000bbba84df): kobject_uevent_env [ 1141.212094] kobject: 'tx-0' (00000000bbba84df): fill_kobj_path: path = '/devices/virtual/net/vet/queues/tx-0' [ 1141.223711] kobject: 'rx-0' (00000000ef4b3506): kobject_cleanup, parent 00000000320dae00 [ 1141.231996] kobject: 'rx-0' (00000000ef4b3506): auto cleanup 'remove' event [ 1141.239128] kobject: 'rx-0' (00000000ef4b3506): kobject_uevent_env [ 1141.245500] kobject: 'rx-0' (00000000ef4b3506): fill_kobj_path: path = '/devices/virtual/net/vet/queues/rx-0' [ 1141.255652] kobject: 'rx-0' (00000000ef4b3506): auto cleanup kobject_del [ 1141.262502] kobject: 'rx-0' (00000000ef4b3506): calling ktype release [ 1141.269335] kobject: 'rx-0': free name [ 1141.273261] kobject: 'tx-0' (00000000bbba84df): kobject_cleanup, parent 00000000320dae00 [ 1141.281515] kobject: 'tx-0' (00000000bbba84df): auto cleanup 'remove' event [ 1141.288887] kobject: 'tx-0' (00000000bbba84df): kobject_uevent_env [ 1141.295236] kobject: 'tx-0' (00000000bbba84df): fill_kobj_path: path = '/devices/virtual/net/vet/queues/tx-0' [ 1141.305416] kobject: 'tx-0' (00000000bbba84df): auto cleanup kobject_del [ 1141.312300] kobject: 'tx-0' (00000000bbba84df): calling ktype release [ 1141.319026] kobject: 'tx-0': free name [ 1141.322921] kobject: 'queues' (00000000320dae00): kobject_cleanup, parent (null) [ 1141.331352] kobject: 'queues' (00000000320dae00): calling ktype release [ 1141.338144] kobject: 'queues' (00000000320dae00): kset_release [ 1141.344110] kobject: 'queues': free name [ 1141.348610] kobject: 'vet' (0000000055aec8fc): kobject_uevent_env [ 1141.354991] kobject: 'vet' (0000000055aec8fc): fill_kobj_path: path = '/devices/virtual/net/vet' [ 1141.357339] kobject: 'loop4' (0000000091bb31bb): kobject_uevent_env [ 1141.370892] kobject: 'loop4' (0000000091bb31bb): fill_kobj_path: path = '/devices/virtual/block/loop4' [ 1141.382973] kobject: 'vet' (000000007ac2a5fc): kobject_cleanup, parent (null) [ 1141.398920] kobject: 'vet' (000000007ac2a5fc): calling ktype release [ 1141.401970] kobject: 'vet' (0000000055aec8fc): kobject_cleanup, parent (null) [ 1141.411685] kobject: 'vet': free name [ 1141.413876] kobject: 'vet' (0000000055aec8fc): calling ktype release [ 1141.424116] kobject: 'vet': free name [ 1141.448478] kobject: 'loop3' (0000000043049f60): kobject_uevent_env 17:56:04 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x7e000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:56:04 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e65726963000000000000000200"}}) 17:56:04 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)={"67686163682d67656e6572696391cb0100"}}) 17:56:04 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="0063404000000000000000000000000000007a0000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:56:04 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={'\x00\x00\x00\x00\x00\x00\x00\x00?\x00', 0x8400}) [ 1141.455047] kobject: 'loop3' (0000000043049f60): fill_kobj_path: path = '/devices/virtual/block/loop3' 17:56:05 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696300000000015700"}}) [ 1141.489139] binder: 5325:5328 got transaction with invalid data ptr [ 1141.500612] kobject: 'loop5' (00000000acd4563f): kobject_uevent_env [ 1141.509952] could not allocate digest TFM handle ghach-generic‘Ë [ 1141.522575] kobject: 'vet' (000000008f928e8a): kobject_add_internal: parent: 'net', set: 'devices' [ 1141.532068] kobject: 'loop5' (00000000acd4563f): fill_kobj_path: path = '/devices/virtual/block/loop5' [ 1141.544629] binder: 5325:5328 transaction failed 29201/-14, size 255-0 line 2992 [ 1141.545889] kobject: 'loop4' (0000000091bb31bb): kobject_uevent_env [ 1141.557533] kobject: 'loop2' (0000000064a32e4c): kobject_uevent_env [ 1141.563724] could not allocate digest TFM handle ghach-generic‘Ë [ 1141.565353] kobject: 'loop2' (0000000064a32e4c): fill_kobj_path: path = '/devices/virtual/block/loop2' 17:56:05 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e65726963000000000f00"}}) [ 1141.573509] binder_alloc: binder_alloc_mmap_handler: 5325 20001000-20004000 already mapped failed -16 [ 1141.591377] kobject: 'vet' (000000008f928e8a): kobject_uevent_env [ 1141.607388] kobject: 'loop4' (0000000091bb31bb): fill_kobj_path: path = '/devices/virtual/block/loop4' [ 1141.622110] kobject: 'vet' (000000008f928e8a): fill_kobj_path: path = '/devices/virtual/net/vet' [ 1141.626095] binder: BINDER_SET_CONTEXT_MGR already set 17:56:05 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)={"6768612d682d67656e6572696391cb0100"}}) [ 1141.637301] kobject: 'loop2' (0000000064a32e4c): kobject_uevent_env [ 1141.644414] kobject: 'loop2' (0000000064a32e4c): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 1141.662523] binder: 5325:5341 ioctl 40046207 0 returned -16 [ 1141.668195] binder_alloc: 5325: binder_alloc_buf, no vma [ 1141.674617] kobject: 'queues' (0000000028ae1c77): kobject_add_internal: parent: 'vet', set: '' 17:56:05 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00\x00\x00\x00\x00kkk\x00'}}) [ 1141.692038] binder_alloc: 5325: binder_alloc_buf, no vma [ 1141.705834] kobject: 'queues' (0000000028ae1c77): kobject_uevent_env [ 1141.713133] binder: 5325:5351 transaction failed 29189/-3, size 0-0 line 2973 [ 1141.721257] kobject: 'loop2' (0000000064a32e4c): kobject_uevent_env [ 1141.723519] binder: undelivered TRANSACTION_ERROR: 29201 [ 1141.731123] kobject: 'loop2' (0000000064a32e4c): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 1141.733706] binder: send failed reply for transaction 6036 to 5325:5328 [ 1141.757582] binder: 5325:5352 transaction failed 29189/-3, size 255-0 line 2973 [ 1141.768564] kobject: 'queues' (0000000028ae1c77): kobject_uevent_env: filter function caused the event to drop! [ 1141.779985] could not allocate digest TFM handle gha-h-generic‘Ë [ 1141.790014] binder: undelivered TRANSACTION_ERROR: 29189 [ 1141.796448] kobject: 'rx-0' (0000000015f8b57f): kobject_add_internal: parent: 'queues', set: 'queues' [ 1141.807155] binder: undelivered TRANSACTION_ERROR: 29189 [ 1141.819178] binder: undelivered TRANSACTION_COMPLETE [ 1141.826842] kobject: 'rx-0' (0000000015f8b57f): kobject_uevent_env [ 1141.827266] kobject: 'loop4' (0000000091bb31bb): kobject_uevent_env [ 1141.835674] binder: undelivered TRANSACTION_ERROR: 29189 [ 1141.845576] could not allocate digest TFM handle gha-h-generic‘Ë [ 1141.866749] kobject: 'rx-0' (0000000015f8b57f): fill_kobj_path: path = '/devices/virtual/net/vet/queues/rx-0' [ 1141.882900] kobject: 'tx-0' (00000000021ece04): kobject_add_internal: parent: 'queues', set: 'queues' [ 1141.897151] kobject: 'tx-0' (00000000021ece04): kobject_uevent_env [ 1141.897527] kobject: 'loop4' (0000000091bb31bb): fill_kobj_path: path = '/devices/virtual/block/loop4' [ 1141.907963] kobject: 'tx-0' (00000000021ece04): fill_kobj_path: path = '/devices/virtual/net/vet/queues/tx-0' [ 1141.916178] kobject: 'loop2' (0000000064a32e4c): kobject_uevent_env [ 1141.929699] kobject: 'loop2' (0000000064a32e4c): fill_kobj_path: path = '/devices/virtual/block/loop2' 17:56:05 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0xc2000}], 0x1, 0x0) 17:56:05 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)={"6768616f682d67656e6572696391cb0100"}}) 17:56:05 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00'}}) [ 1141.994580] kobject: 'loop0' (0000000022e299dc): kobject_uevent_env [ 1142.007604] kobject: 'rx-0' (0000000015f8b57f): kobject_cleanup, parent 0000000028ae1c77 [ 1142.037327] kobject: 'loop0' (0000000022e299dc): fill_kobj_path: path = '/devices/virtual/block/loop0' [ 1142.044305] kobject: 'rx-0' (0000000015f8b57f): auto cleanup 'remove' event [ 1142.056151] kobject: 'rx-0' (0000000015f8b57f): kobject_uevent_env [ 1142.062234] kobject: 'loop3' (0000000043049f60): kobject_uevent_env [ 1142.067701] kobject: 'rx-0' (0000000015f8b57f): fill_kobj_path: path = '/devices/virtual/net/vet/queues/rx-0' [ 1142.069389] kobject: 'loop3' (0000000043049f60): fill_kobj_path: path = '/devices/virtual/block/loop3' [ 1142.087701] kobject: 'rx-0' (0000000015f8b57f): auto cleanup kobject_del [ 1142.097217] kobject: 'loop4' (0000000091bb31bb): kobject_uevent_env [ 1142.104534] kobject: 'loop4' (0000000091bb31bb): fill_kobj_path: path = '/devices/virtual/block/loop4' [ 1142.125505] kobject: 'rx-0' (0000000015f8b57f): calling ktype release [ 1142.132457] could not allocate digest TFM handle ghaoh-generic‘Ë [ 1142.139116] kobject: 'rx-0': free name [ 1142.143196] kobject: 'tx-0' (00000000021ece04): kobject_cleanup, parent 0000000028ae1c77 [ 1142.151538] kobject: 'tx-0' (00000000021ece04): auto cleanup 'remove' event [ 1142.158910] kobject: 'tx-0' (00000000021ece04): kobject_uevent_env [ 1142.162562] could not allocate digest TFM handle ghaoh-generic‘Ë [ 1142.165322] kobject: 'tx-0' (00000000021ece04): fill_kobj_path: path = '/devices/virtual/net/vet/queues/tx-0' [ 1142.181719] kobject: 'tx-0' (00000000021ece04): auto cleanup kobject_del [ 1142.188792] kobject: 'tx-0' (00000000021ece04): calling ktype release [ 1142.195375] kobject: 'tx-0': free name [ 1142.199686] kobject: 'queues' (0000000028ae1c77): kobject_cleanup, parent (null) [ 1142.208424] kobject: 'queues' (0000000028ae1c77): calling ktype release [ 1142.215176] kobject: 'queues' (0000000028ae1c77): kset_release [ 1142.221190] kobject: 'queues': free name [ 1142.225588] kobject: 'vet' (000000008f928e8a): kobject_uevent_env [ 1142.231819] kobject: 'vet' (000000008f928e8a): fill_kobj_path: path = '/devices/virtual/net/vet' [ 1142.275622] kobject: 'vet' (000000008f928e8a): kobject_cleanup, parent (null) [ 1142.283883] kobject: 'vet' (000000008f928e8a): calling ktype release [ 1142.290558] kobject: 'vet': free name [ 1142.303793] kobject: 'loop5' (00000000acd4563f): kobject_uevent_env [ 1142.310410] kobject: 'loop5' (00000000acd4563f): fill_kobj_path: path = '/devices/virtual/block/loop5' [ 1142.526830] kobject: 'loop4' (0000000091bb31bb): kobject_uevent_env [ 1142.533275] kobject: 'loop4' (0000000091bb31bb): fill_kobj_path: path = '/devices/virtual/block/loop4' 17:56:06 executing program 4: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xbb40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x66000}], 0x1, 0x0) syz_mount_image$nfs4(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) 17:56:06 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = socket$inet6(0xa, 0x803, 0x20) ioctl(r3, 0x1000008912, &(0x7f0000000080)="0a5c2d023c126285718070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008000)={0x25, 0x0, &(0x7f0000004fbc)=ANY=[@ANYBLOB="006340400000000000000000000000000000020000000000000000000000000000000000ff"], 0x0, 0x800020, 0x0}) 17:56:06 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e657269630000000000000000000c90f700"}}) 17:56:06 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)={"67686158682d67656e6572696391cb0100"}}) 17:56:06 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x20000000ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000005c0)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f00000000c0)={'\x00\x00\x00\x00\x00\x00\x00\x00\x00?\x00', 0x8400}) [ 1142.595737] kobject: 'loop4' (0000000091bb31bb): kobject_uevent_env [ 1142.602236] kobject: 'loop4' (0000000091bb31bb): fill_kobj_path: path = '/devices/virtual/block/loop4' [ 1142.661513] kobject: 'vet' (000000004592bd06): kobject_add_internal: parent: 'net', set: 'devices' [ 1142.679952] kobject: 'vet' (000000004592bd06): kobject_uevent_env [ 1142.680491] could not allocate digest TFM handle ghaXh-generic‘Ë [ 1142.693072] kobject: 'vet' (000000004592bd06): fill_kobj_path: path = '/devices/virtual/net/vet' [ 1142.705550] kobject: 'loop2' (0000000064a32e4c): kobject_uevent_env 17:56:06 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00\x00\x00\x00\x00\x00\x001\x00'}}) [ 1142.712355] kobject: 'queues' (0000000011096208): kobject_add_internal: parent: 'vet', set: '' [ 1142.722695] binder: 5400:5417 got transaction with invalid data ptr [ 1142.723632] kobject: 'loop2' (0000000064a32e4c): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 1142.739801] could not allocate digest TFM handle ghaXh-generic‘Ë [ 1142.746433] binder: 5400:5417 transaction failed 29201/-14, size 255-0 line 2992 17:56:06 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)={"67686164682d67656e6572696391cb0100"}}) [ 1142.757441] kobject: 'queues' (0000000011096208): kobject_uevent_env [ 1142.763674] kobject: 'loop4' (0000000091bb31bb): kobject_uevent_env [ 1142.782808] kobject: 'queues' (0000000011096208): kobject_uevent_env: filter function caused the event to drop! [ 1142.787720] kobject: 'loop4' (0000000091bb31bb): fill_kobj_path: path = '/devices/virtual/block/loop4' [ 1142.801988] kobject: 'rx-0' (00000000a48b92d4): kobject_add_internal: parent: 'queues', set: 'queues' 17:56:06 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={'ghash-generic\x00\x00\x00\x00\x00\x00\x000\x00'}}) [ 1142.812621] kobject: 'loop2' (0000000064a32e4c): kobject_uevent_env [ 1142.819748] kobject: 'loop2' (0000000064a32e4c): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 1142.838271] kobject: 'rx-0' (00000000a48b92d4): kobject_uevent_env 17:56:06 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e6572696300000000000f00"}}) [ 1142.864495] kobject: 'rx-0' (00000000a48b92d4): fill_kobj_path: path = '/devices/virtual/net/vet/queues/rx-0' [ 1142.893319] kobject: 'tx-0' (00000000dee69330): kobject_add_internal: parent: 'queues', set: 'queues' [ 1142.905047] kobject: 'loop2' (0000000064a32e4c): kobject_uevent_env 17:56:06 executing program 0: mmap(&(0x7f000029d000/0x200000)=nil, 0x200000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xffffffea) r2 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0xb8000}], 0x1, 0x0) [ 1142.911742] could not allocate digest TFM handle ghadh-generic‘Ë [ 1142.913009] kobject: 'loop2' (0000000064a32e4c): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 1142.919629] kobject: 'loop4' (0000000091bb31bb): kobject_uevent_env [ 1142.934433] kobject: 'tx-0' (00000000dee69330): kobject_uevent_env [ 1142.934869] kobject: 'loop4' (0000000091bb31bb): fill_kobj_path: path = '/devices/virtual/block/loop4' [ 1142.958239] kobject: 'loop0' (0000000022e299dc): kobject_uevent_env 17:56:06 executing program 2: r0 = add_key$user(&(0x7f0000000280)='user\x00', &(0x7f0000000240)={'syz'}, &(0x7f0000000300)='\a', 0x1, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f0000000480)="3894e0aa755678642797c675ec97969c56f2bf12f6039bb83db491604e9211ccc8408e7618ea37393e03de7717926ee49759d8a25fe0ee491d33465a996e601cab82e84deffd4f43b4b8de7c4fc0f12375966fce546ed08ab352a291b7f16898f20eb89ab513fe62e97796f94ae97e59c92f1eb86a95087d0372707700c803790f74e808663977e98054589d308059a63b0534d429abbad8c75335c1bcd5f596b4ef809be3492bf40907de6a8cedbb24290c9e878204418bbe903f3ced734530", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r1, r0}, &(0x7f0000000140)=""/32, 0x20, &(0x7f0000000340)={&(0x7f0000000200)={"67686173682d67656e657269630000000000feffff00"}}) [ 1142.970455] kobject: 'tx-0' (00000000dee69330): fill_kobj_path: path = '/devices/virtual/net/vet/queues/tx-0' [ 1142.986689] kobject: 'loop0' (0000000022e299dc): fill_kobj_path: path = '/devices/virtual/block/loop0' [ 1142.996681] could not allocate digest TFM handle ghadh-generic‘Ë [ 1143.003927] binder_alloc: binder_alloc_mmap_handler: 5400 20001000-20004000 already mapped failed -16 [ 1143.005551] binder: BINDER_SET_CONTEXT_MGR already set 17:56:06 executing program 1: keyctl$dh_compute(0x17, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)={"6768612b682d67656e6572696391cb0100"}}) [ 1143.034335] kobject: 'loop4' (0000000091bb31bb): kobject_uevent_env [ 1143.038005] binder: 5400:5447 ioctl 40046207 0 returned -16 [ 1143.052129] kobject: 'rx-0' (00000000a48b92d4): kobject_cleanup, parent 0000000011096208 [ 1143.055212] binder_alloc: 5400: binder_alloc_buf, no vma [ 1143.064839] kobject: 'loop4' (0000000091bb31bb): fill_kobj_path: path = '/devices/virtual/block/loop4' [ 1143.066870] binder_alloc: 5400: binder_alloc_buf, no vma [ 1143.082809] binder: 5400:5411 transaction failed 29189/-3, size 0-0 line 2973 [ 1143.088527] kobject: 'loop2' (0000000064a32e4c): kobject_uevent_env [ 1143.097050] binder: 5400:5452 transaction failed 29189/-3, size 255-0 line 2973 [ 1143.101676] kobject: 'rx-0' (00000000a48b92d4): auto cleanup 'remove