], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 513.290333] binder_transaction: 44 callbacks suppressed [ 513.290350] binder: 32457:32461 transaction failed 29201/-22, size 0-0 line 2834 [ 513.304164] EXT4-fs (loop0): invalid inodes per group: 8192 [ 513.304164] [ 513.316999] binder: 32467:32480 transaction failed 29201/-22, size 0-0 line 2834 22:29:22 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x6800000000000000, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 513.382514] binder: 32469:32476 transaction failed 29201/-22, size 0-0 line 2834 [ 513.398011] binder: 32467:32490 transaction failed 29201/-22, size 0-0 line 2834 [ 513.416994] EXT4-fs (loop0): invalid inodes per group: 8192 [ 513.416994] 22:29:22 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x7, 0x80000) setsockopt$inet_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x4) socketpair$unix(0x1, 0x401, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) semget(0x1, 0x0, 0x0) 22:29:22 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x2, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:22 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000007fffffff1000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:22 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000366f6ffffc8030000ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 513.537021] binder: 32469:32506 transaction failed 29201/-22, size 0-0 line 2834 22:29:22 executing program 5: r0 = semget(0x2, 0x4, 0x10) semctl$GETVAL(r0, 0x7, 0xc, &(0x7f0000000200)) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000002200)='/dev/vga_arbiter\x00', 0x0, 0x0) r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000002280)='nbd\x00') r3 = geteuid() syz_mount_image$msdos(&(0x7f0000000200)='msdos\x00', &(0x7f0000000240)='./file0\x00', 0x0, 0x1, &(0x7f0000000340)=[{&(0x7f0000000280)="e4e0739dd2b692fa086126852dfdebc6e7f20645090bcc81cd64846b9299c400009d92dd440b26e700a7c3831ff51c3da9a9389b7865960dc9e38ed835628390e3a4962ede44ba697f1bbff829b2b613327fdc58c00516657252465c71d6e6b4519a47e6139e823fa7dcebd15043da573f82955754f826fcfa5e23c4f9f285c15d89be4dd433584257fc0aba479220ec4b77bc7c19", 0x95, 0x9}], 0x100000, &(0x7f0000000380)={[{@dots='dots'}, {@nodots='nodots'}, {@nodots='nodots'}, {@fat=@quiet='quiet'}, {@nodots='nodots'}, {@fat=@dmask={'dmask', 0x3d, 0x8}}, {@nodots='nodots'}, {@fat=@tz_utc='tz=UTC'}, {@fat=@nfs='nfs'}, {@dots='dots'}], [{@fowner_lt={'fowner<', r3}}, {@smackfsdef={'smackfsdef', 0x3d, 'nbd\x00'}}, {@fsmagic={'fsmagic', 0x3d, 0x200}}, {@rootcontext={'rootcontext', 0x3d, 'system_u'}}]}) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f0000002340)={&(0x7f0000002240), 0xc, &(0x7f0000002300)={&(0x7f00000022c0)={0x2c, r2, 0x5, 0x70bd25, 0x25dfdbfd, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x9}]}, 0x2c}, 0x1, 0x0, 0x0, 0x80}, 0x851) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000040)={{{@in, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f00000001c0)=0xe8) setfsuid(r4) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) pipe2(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) ioctl$BLKRESETZONE(r6, 0x40101283, &(0x7f0000000480)={0x1, 0x3}) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40042409, 0x1) semget(0xffffffffffffffff, 0x0, 0x0) 22:29:22 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x1200000000000000, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 513.614393] binder_release_work: 45 callbacks suppressed [ 513.614400] binder: undelivered TRANSACTION_ERROR: 29201 [ 513.631321] binder: undelivered TRANSACTION_ERROR: 29201 22:29:22 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000060000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 513.675962] binder: 32511:32519 transaction failed 29201/-22, size 0-0 line 2834 [ 513.714524] EXT4-fs (loop0): invalid inodes per group: 8192 [ 513.714524] [ 513.757170] binder: 32511:32529 transaction failed 29201/-22, size 0-0 line 2834 [ 513.796108] EXT4-fs (loop0): invalid inodes per group: 8192 [ 513.796108] 22:29:23 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4d, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 513.821672] binder: undelivered TRANSACTION_ERROR: 29201 [ 513.827377] binder: undelivered TRANSACTION_ERROR: 29201 22:29:23 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x4, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:23 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000666f6ffffc8030000ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:29:23 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000004800001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 513.866570] binder_transaction: 8 callbacks suppressed [ 513.866581] binder: 32531:32545 got transaction to invalid handle [ 513.928934] binder: 32531:32545 transaction failed 29201/-22, size 0-0 line 2834 [ 513.938423] binder: 32544:32553 Acquire 1 refcount change on invalid ref 4 ret -22 [ 513.967484] binder: 32544:32553 BC_FREE_BUFFER u0000000000000000 no match [ 513.996519] binder: 32555:32558 unknown command 0 [ 513.998569] binder: 32544:32553 ERROR: BC_REGISTER_LOOPER called without request [ 514.029949] binder: 32555:32558 ioctl c0306201 20000140 returned -22 22:29:23 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) semget(0xffffffffffffffff, 0x0, 0x0) r1 = syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0x4, 0xa840) setsockopt$inet_dccp_buf(r1, 0x21, 0xf, &(0x7f0000000080)="9030d89780f4dfb602e34fb3", 0xc) [ 514.042412] EXT4-fs (loop0): invalid inodes per group: 8192 [ 514.042412] [ 514.054548] binder: 32544:32553 unknown command 0 [ 514.062315] binder: 32559:32570 transaction failed 29189/-22, size 0-0 line 2834 [ 514.076144] binder: 32531:32572 got transaction to invalid handle [ 514.084143] binder: 32544:32553 ioctl c0306201 20000140 returned -22 [ 514.094507] binder: 32531:32572 transaction failed 29201/-22, size 0-0 line 2834 22:29:23 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x68, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 514.128686] EXT4-fs (loop0): invalid inodes per group: 8192 [ 514.128686] [ 514.130625] binder: undelivered TRANSACTION_ERROR: 29201 22:29:23 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000012000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 514.177251] binder: undelivered TRANSACTION_ERROR: 29201 22:29:23 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x54, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:23 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000006000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:23 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000566f6ffffc8030000ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 514.227942] binder: undelivered TRANSACTION_ERROR: 29189 [ 514.258615] binder: undelivered TRANSACTION_ERROR: 29189 22:29:23 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x20000000, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 514.356013] binder: 32587:32588 Acquire 1 refcount change on invalid ref 4 ret -22 [ 514.369690] binder: 32587:32588 BC_FREE_BUFFER u0000000000000000 no match [ 514.406163] EXT4-fs (loop0): invalid inodes per group: 8192 [ 514.406163] [ 514.406816] binder: 32590:32591 got transaction to invalid handle [ 514.413780] binder: 32587:32588 ERROR: BC_REGISTER_LOOPER called without request [ 514.433009] binder: 32587:32588 unknown command 0 [ 514.460063] binder: undelivered TRANSACTION_ERROR: 29189 [ 514.469772] binder: undelivered TRANSACTION_ERROR: 29189 [ 514.473469] binder: 32587:32588 ioctl c0306201 20000140 returned -22 22:29:23 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200004866f6ffffc8030000ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:29:23 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000a0000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:23 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x3, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 514.548579] binder: 32590:32621 got transaction to invalid handle [ 514.630044] EXT4-fs (loop0): invalid inodes per group: 8192 [ 514.630044] [ 514.653041] binder: 32627:32633 unknown command 64 [ 514.658125] binder: 32627:32633 ioctl c0306201 20000140 returned -22 22:29:23 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = open(&(0x7f0000000040)='./file0\x00', 0x81, 0x8) ioctl$DRM_IOCTL_GET_MAGIC(r1, 0x80046402, &(0x7f0000000200)=0xd36) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ioctl$EVIOCSABS3F(r1, 0x401845ff, &(0x7f00000000c0)={0x1ff, 0x2, 0x1, 0x8001, 0x6eb, 0x1}) init_module(&(0x7f0000000100)='}\\keyringem0\x00', 0xd, &(0x7f00000001c0)='!security\x00') semget(0xffffffffffffffff, 0x0, 0xfffffffffffffffe) 22:29:23 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000003000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:23 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x56, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 514.696639] binder: 32625:32630 got transaction to invalid handle [ 514.750920] EXT4-fs (loop0): invalid inodes per group: 8192 [ 514.750920] [ 514.761905] binder: 32625:32646 got transaction to invalid handle [ 514.763092] binder: 32638:32648 Acquire 1 refcount change on invalid ref 4 ret -22 [ 514.784118] binder: 32638:32648 BC_FREE_BUFFER u0000000000000000 no match [ 514.791177] binder: 32638:32648 ERROR: BC_REGISTER_LOOPER called without request 22:29:23 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a020000000af6ffffc8030000ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 514.816392] binder: 32638:32648 unknown command 0 [ 514.832129] binder: 32638:32648 ioctl c0306201 20000140 returned -22 [ 514.857304] binder: 32637:32654 got transaction to invalid handle 22:29:24 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x60, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:24 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000007a0000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:24 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x0) ioctl$VIDIOC_G_INPUT(r1, 0x80045626, &(0x7f0000000080)) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) semget(0xffffffffffffffff, 0x0, 0x0) 22:29:24 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x2f, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 514.916118] EXT4-fs (loop0): invalid inodes per group: 8192 [ 514.916118] [ 515.004889] binder: 32664:32677 got transaction to invalid handle [ 515.031672] EXT4-fs (loop0): invalid inodes per group: 8192 [ 515.031672] [ 515.042155] binder: 32637:32645 got transaction to invalid handle 22:29:24 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x7000000, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 515.048625] binder: 32678:32679 Acquire 1 refcount change on invalid ref 4 ret -22 [ 515.059044] binder: 32664:32681 got transaction to invalid handle [ 515.080382] binder: 32678:32679 BC_FREE_BUFFER u0000000000000000 no match 22:29:24 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000048000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:24 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a020000002ff6ffffc8030000ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:29:24 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000004c0000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:24 executing program 5: r0 = syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x880) r1 = openat$cgroup(r0, &(0x7f0000000080)='syz0\x00', 0x200002, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$DRM_IOCTL_GET_MAP(r0, 0xc0286404, &(0x7f00000000c0)={&(0x7f0000ffc000/0x4000)=nil, 0x8000, 0x3, 0x4, &(0x7f0000ff9000/0x4000)=nil, 0x3}) getsockopt$inet_sctp_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f00000001c0)={0x0, 0xffffffffffffff80, 0x6c, 0x100000000}, &(0x7f0000000200)=0x10) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000240)={r3, @in={{0x2, 0x4e20, @local}}, 0x8001, 0x80000000, 0x8001, 0x7ff, 0xa0}, 0x98) dup3(r1, r1, 0x80000) socketpair$inet_sctp(0x2, 0x1, 0x84, &(0x7f0000000340)) semget(0xffffffffffffffff, 0x0, 0x0) [ 515.107461] binder: 32678:32679 ERROR: BC_REGISTER_LOOPER called without request [ 515.132650] binder: 32678:32679 unknown command 0 [ 515.146748] binder: 32678:32679 ioctl c0306201 20000140 returned -22 22:29:24 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x68, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:24 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x3f000000, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 515.285581] EXT4-fs (loop0): invalid inodes per group: 8192 [ 515.285581] [ 515.345991] binder: 32706:32713 Acquire 1 refcount change on invalid ref 4 ret -22 [ 515.378303] binder: 32706:32713 BC_FREE_BUFFER u0000000000000000 no match 22:29:24 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x7a000000, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 515.404920] binder: 32706:32713 ERROR: BC_REGISTER_LOOPER called without request [ 515.422496] binder: 32706:32713 unknown command 0 [ 515.436839] binder: 32706:32713 ioctl c0306201 20000140 returned -22 22:29:24 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000300001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:24 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = accept4(r0, &(0x7f0000000040), &(0x7f00000000c0)=0x155, 0x800) ioctl$EXT4_IOC_RESIZE_FS(r1, 0x40086610, &(0x7f00000011c0)=0x6) r3 = add_key(&(0x7f00000012c0)='logon\x00', &(0x7f0000001300)={'syz', 0x3}, &(0x7f0000001340)="0d6c89f272f487235d4aaffb6f8c06045a31a9c08acab062ff690185631555a1ec9724ffd845335ca81c1a23bd9c20f30897f97c02bd209e80bb8185f413a3f1567d0369dd1de521229046ccf0345e2095cd7ad6ea1c6d15707067564efdb1572c2c92ba35f76f3433a446", 0x6b, 0xfffffffffffffffb) request_key(&(0x7f0000001200)='ceph\x00', &(0x7f0000001240)={'syz', 0x2}, &(0x7f0000001280)='+md5sum,md5sum!\x00', r3) setsockopt$bt_BT_SECURITY(r2, 0x112, 0x4, &(0x7f0000000100)={0x0, 0xad}, 0x2) r4 = syz_open_dev$audion(&(0x7f00000013c0)='/dev/audio#\x00', 0x63, 0x181500) ioctl$KVM_SET_XSAVE(r4, 0x5000aea5, &(0x7f0000001400)={"120bc76acafc888c14c8cd1b6b7920db9bc7a072c4c5d79ad3a932f5ecac1e5cc1b7421c20310174e3e7c3b9d7aae9bdf908c031584e4c815269d67ad91a7c6cd5fdbb476bb9be734bbbf0c641faebbb6f6e992ba012b3ca51445e7936c99b6742d2233482ec8b2d750ca8f91090bdcd8bc4b5fabfd71f3dc09127523e7ab8df8aaed04381eb809e0ca5e982affcf2896a856f069f8b235c6f6cd93bbf950fac3026f9804ef695b310ab6e69ebea6ad012d268f125234a78117984b647b8805d8be1e106c1ba1dc94f74d88fe92edc0bc6c98f5664c8e53ad28f036d4a46e0a90419fcd8107771d81b8f48b91983b0c890f480c40e0778332a78914d58b1e7dc2ae84caf7476906d9d738fc3a1b4faf226d945129134157c3c1782be20af7c670129e3b80d4625721fd49cc158ebb62c2a44c2f238615980c3e8aa10cb8c7db5b6493bf60a2cdab8205a871d7fbf031fa0ab58a73c6d4ffb4d4ca84e91fe4ba04e1331cbcb3950fc07a832002657e58b0469982e5e6c4ecf993a6d28c00cd50abd795541bd30f9a12db9153dd00da939f3978073dfdb2d78e3be3ec438b2205df70cf0b6c473e1ebef2235d881d1972f64bdff2ca4fb79911f1e18f85c5ddff2f3701c17ed95b0507d6cab2e76d18330c08a4ae28b24cf726a3c0cfc8ec27410676ee5aa792264062edb26fdea4c04014885d57d5e048a15c9710c4c22f7a196e9b385c790fe3bd754c0450c2343cd55f29a59b306c27442c5c99f217ed7ab69265a7e8cede977c6f1e1faf2b2094332a92bf787a90bb1dcba8def179146b4fc638fab16e07c5d2c8d9f60c809f01fac9a4746f5b7caae1659cbd8a54c8b0b152a671622a3c4fa63c41a6713c8b1dae667ef86f590a2d424a53a9e1fad44b4a6424686b85f60e132b75df445d3a9c9cf127daaae8f09b24b0b0334ee574d797f36aedeec2c9e4f7934d48480be236d90cb903791c9783d322f4d9c6ca21d39da0188f282192f28ef9dc7182888192b6ab6a96adbef0dd270e1a4bfe9a92fb10ddf90cdccce0cc3dc1854bebbf9814bdf95d77585359c7fd4720817e692faf9352741062374f4b79bc038daf8368dc7b36852a5aaeada774c51d9768cc5a4a15836d3a11a6e238cc4b69d5989505be27132b6b0e254d3244955f44f453893b3484ca50407fe1ae3cc6b0346089b420e45f1e354ba1e58af88a51fecb979f1cd4995e7f7bb6b48374c89e88e7a59467e31ee7079a857b940377b46d988c34418db104aa8933bb615f4f942fcf70a6370dfea0539bf1ab8e0a51b616dbfd1505e80184e74b5da69c2d2a69221b4ad5a6c192b8e551b5a7c999cc5dc23167f0ac3bca4fc5b02cb197445db624ec2c487a83e4499b750ee67ffc22a0af0d8345e24e8e40bea270ce8ae002af6e18ff75368a5a55f04ada7fc85a69a5718f66d1adf43"}) fdatasync(r1) semget(0xffffffffffffffff, 0x0, 0x0) r5 = dup(r1) ioctl$EVIOCGEFFECTS(r5, 0x80044584, &(0x7f00000001c0)=""/4096) 22:29:24 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x6, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:24 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000005000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:24 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000a66f6ffffc8030000ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:29:24 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x4c00000000000000, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 515.652042] binder: 32738:32741 unknown command 1661140992 [ 515.671980] binder: 32738:32741 ioctl c0306201 20000140 returned -22 [ 515.683871] EXT4-fs (loop0): invalid inodes per group: 8192 [ 515.683871] 22:29:24 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) semget(0x2, 0x0, 0x40002000002) 22:29:24 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000011000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 515.749871] binder: 32738:32741 unknown command 1661140992 [ 515.782654] binder: 32738:32741 ioctl c0306201 20000140 returned -22 [ 515.793064] EXT4-fs (loop0): invalid inodes per group: 8192 [ 515.793064] 22:29:25 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x6000000000000000, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:25 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vcs\x00', 0x1, 0x0) ioctl$VIDIOC_ENUMAUDOUT(r1, 0xc0345642, &(0x7f0000000040)={0xdfc, "80b62c3f3d96f600c29ae84bc46b4ae018612a05b9d952247cf139913c94fbcd", 0x2, 0x1}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) semget(0xffffffffffffffff, 0x0, 0x0) 22:29:25 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x7a000000, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:25 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000fffffdfd001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:25 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000766f6ffffc8030000ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:29:25 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0xffffff7f00000000, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:25 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000021000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:25 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x20000000, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 516.093042] EXT4-fs (loop0): invalid inodes per group: 8192 [ 516.093042] 22:29:25 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x6c000000, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:25 executing program 5: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1000000000000001, 0x0, &(0x7f0000000040)) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) semget(0xffffffffffffffff, 0x0, 0x0) [ 516.183186] EXT4-fs (loop0): invalid inodes per group: 8192 [ 516.183186] 22:29:25 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200004c66f6ffffc8030000ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:29:25 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x6c000000, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:25 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000006c00001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:25 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000000a001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:25 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x2000000, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:25 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket(0x9, 0xa, 0x92) r1 = syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x9, 0x4100) ioctl$sock_kcm_SIOCKCMUNATTACH(r0, 0x89e1, &(0x7f0000000080)={r1}) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r1, 0x80045530, &(0x7f00000001c0)=""/151) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) semget(0xffffffffffffffff, 0x0, 0x0) [ 516.459706] EXT4-fs (loop0): invalid inodes per group: 8192 [ 516.459706] 22:29:25 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x2000, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 516.531787] EXT4-fs (loop0): invalid inodes per group: 8192 [ 516.531787] 22:29:25 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x74000000, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:25 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200006866f6ffffc8030000ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:29:25 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000070000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:25 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x6c, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:25 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000004000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 516.808984] EXT4-fs (loop0): invalid inodes per group: 8192 [ 516.808984] 22:29:26 executing program 5: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0xfffffffffffffd9b, 0x3e7, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xfffffffffffffffc, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) semget(0xffffffffffffffff, 0x80000000000000, 0x4) r3 = dup2(r1, r0) setsockopt$bt_BT_SNDMTU(r3, 0x112, 0xc, &(0x7f0000000080)=0x5, 0x2) getsockopt$bt_sco_SCO_CONNINFO(r3, 0x11, 0x2, &(0x7f0000000000)=""/24, &(0x7f0000000100)=0x18) ioctl$FIDEDUPERANGE(r1, 0xc0189436, &(0x7f00000001c0)=ANY=[@ANYBLOB="d108000000000014448aba1400eeffffff00eb0000000000"]) sync_file_range(r0, 0x8001, 0x6, 0x4) setsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r3, 0x84, 0x13, &(0x7f0000000040)=0x2, 0x4) 22:29:26 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x4c000000, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 516.911157] EXT4-fs (loop0): invalid inodes per group: 8192 [ 516.911157] 22:29:26 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000fdfdffff1000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:26 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x4, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:26 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x3f00, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 517.085550] binder: 451:453 unknown command 4 22:29:26 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200002d66f6ffffc8030000ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:29:26 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_dev$usbmon(&(0x7f0000000080)='/dev/usbmon#\x00', 0x0, 0x1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_open_dev$adsp(&(0x7f0000000040)='/dev/adsp#\x00', 0x100000001, 0x410000) semget(0xffffffffffffffff, 0x0, 0x0) [ 517.149162] binder: 451:453 ioctl c0306201 20000140 returned -22 22:29:26 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000200000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:26 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x4c, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:26 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x6c, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:26 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000030000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 517.287896] EXT4-fs (loop0): invalid inodes per group: 8192 [ 517.287896] [ 517.356103] EXT4-fs (loop0): invalid inodes per group: 8192 [ 517.356103] 22:29:26 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0x524b6813, 0x28080) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000080)={0xffffffffffffffff}, 0x13f, 0xf}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r1, &(0x7f0000000100)={0x4, 0x8, 0xfa00, {r2, 0x80000000}}, 0x10) semget(0xffffffffffffffff, 0x0, 0x0) 22:29:26 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x68, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:26 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200006066f6ffffc8030000ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:29:26 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x7400000000000000, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:26 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000007a1000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:26 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x7a00000000000000, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:26 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x6000000, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:26 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000006c0000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:26 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/amemthresh\x00', 0x2, 0x0) ioctl$VIDIOC_S_OUTPUT(r1, 0xc004562f, &(0x7f00000001c0)=0x800003f) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) semget(0xffffffffffffffff, 0x0, 0x0) [ 517.694832] EXT4-fs (loop0): invalid inodes per group: 8192 [ 517.694832] [ 517.774438] EXT4-fs (loop0): invalid inodes per group: 8192 [ 517.774438] 22:29:27 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x4c00, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:27 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x1000000, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:27 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000866f6ffffc8030000ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:29:27 executing program 5: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0xfbb8) semget(0xffffffffffffffff, 0x0, 0x0) 22:29:27 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000fffffdfd1000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:27 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x6c00, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:27 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x5000000, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 518.153443] EXT4-fs (loop0): invalid inodes per group: 8192 [ 518.153443] 22:29:27 executing program 5: r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000100)='/dev/snapshot\x00', 0x101000, 0x0) ioctl$VIDIOC_QUERY_DV_TIMINGS(r0, 0x80845663, &(0x7f00000001c0)={0x0, @reserved}) r1 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x2400, 0x8) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) flistxattr(r2, &(0x7f0000000040)=""/164, 0xa4) semget(0xffffffffffffffff, 0x0, 0x0) 22:29:27 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000002001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:27 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x100000000000000, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:27 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a020000000af6ffffc8030000ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:29:27 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000681000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:27 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x2, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 518.431862] binder_transaction: 38 callbacks suppressed [ 518.431879] binder: 591:593 transaction failed 29189/-22, size 0-0 line 2834 [ 518.455760] EXT4-fs (loop0): invalid inodes per group: 8192 [ 518.455760] 22:29:27 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) semget(0xffffffffffffffff, 0x0, 0x0) r2 = accept(r0, 0x0, &(0x7f0000000040)=0x54) accept4$alg(r2, 0x0, 0x0, 0x800) socketpair$inet_udplite(0x2, 0x2, 0x88, &(0x7f0000000080)) socketpair$inet6_udplite(0xa, 0x2, 0x88, &(0x7f00000000c0)) 22:29:27 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0xffffff7f, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 518.488252] binder: 611:616 unknown command 278532 [ 518.489374] binder: 605:606 transaction failed 29189/-22, size 0-0 line 2834 [ 518.495075] binder: 611:616 ioctl c0306201 20000140 returned -22 22:29:27 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x2000000000000000, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 518.549046] EXT4-fs (loop0): invalid inodes per group: 8192 [ 518.549046] [ 518.559631] binder: 605:623 transaction failed 29189/-22, size 0-0 line 2834 22:29:27 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000025f6ffffc8030000ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 518.608183] binder: 591:630 transaction failed 29189/-22, size 0-0 line 2834 [ 518.664808] binder_release_work: 35 callbacks suppressed [ 518.664815] binder: undelivered TRANSACTION_ERROR: 29189 [ 518.684776] binder: undelivered TRANSACTION_ERROR: 29189 22:29:27 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x7a00, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:27 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x600000000000000, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:27 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000a000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 518.713845] binder: undelivered TRANSACTION_ERROR: 29189 [ 518.736002] binder: undelivered TRANSACTION_ERROR: 29189 22:29:27 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) semget(0xffffffffffffffff, 0x0, 0x0) r1 = creat(&(0x7f0000000040)='./file0\x00', 0x60) setsockopt$IP_VS_SO_SET_DELDEST(r1, 0x0, 0x488, &(0x7f0000000080)={{0x3f, @dev={0xac, 0x14, 0x14, 0x21}, 0x4e22, 0x0, 'ovf\x00', 0x8, 0x401, 0x4d}, {@remote, 0x4e23, 0x2, 0xfd0, 0x6, 0x400000000}}, 0x44) 22:29:28 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000700001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:28 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x500000000000000, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 518.838049] EXT4-fs (loop0): invalid inodes per group: 8192 [ 518.838049] 22:29:28 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x74000000, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 518.900737] binder_transaction: 16 callbacks suppressed [ 518.900747] binder: 642:659 got transaction to invalid handle [ 518.986835] EXT4-fs (loop0): invalid inodes per group: 8192 [ 518.986835] [ 518.999639] binder: 642:659 transaction failed 29201/-22, size 0-0 line 2834 22:29:28 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x4800000000000000, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:28 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a020000002ef6ffffc8030000ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 519.027063] binder: 665:676 transaction failed 29189/-22, size 0-0 line 2834 22:29:28 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) semget(0xffffffffffffffff, 0x0, 0x2) 22:29:28 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x2000000, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 519.115330] binder: 665:685 transaction failed 29189/-22, size 0-0 line 2834 [ 519.144943] binder: 642:653 got transaction to invalid handle [ 519.176102] binder: undelivered TRANSACTION_ERROR: 29189 [ 519.179781] binder: 642:653 transaction failed 29201/-22, size 0-0 line 2834 [ 519.205166] binder: undelivered TRANSACTION_ERROR: 29189 22:29:28 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000007a000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:28 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000200001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:28 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x6, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 519.236587] EXT4-fs (loop0): invalid inodes per group: 8192 [ 519.236587] [ 519.250619] binder: undelivered TRANSACTION_ERROR: 29201 [ 519.272701] binder: undelivered TRANSACTION_ERROR: 29201 22:29:28 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x3000000, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:28 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$media(&(0x7f0000000040)='/dev/media#\x00', 0x6, 0x88000) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000080)=0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r1, 0xc1105511, &(0x7f00000001c0)={{0x9, 0x1, 0x10001, 0x5, 'syz0\x00', 0x7}, 0x0, 0x4, 0x8, r2, 0x9, 0x1, 'syz0\x00', &(0x7f00000000c0)=['[-\x00', "a3656d312d00", 'eth1\'\x00', 'trusted\x00', 'md5sum\x00', '#vboxnet1cgroupvmnet0\x00', '&%system+)\x00', '}cpuset\\\x00', ')security\x00'], 0x52, [], [0x0, 0x5, 0x100000001, 0x5]}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) semget(0xffffffffffffffff, 0x0, 0x0) [ 519.340444] EXT4-fs (loop0): invalid inodes per group: 8192 [ 519.340444] [ 519.416286] binder: 709:717 unknown command 1660944384 [ 519.434184] binder: 706:718 got transaction to invalid handle [ 519.441157] binder: 709:717 ioctl c0306201 20000140 returned -22 [ 519.454583] binder: 702:719 transaction failed 29189/-22, size 0-0 line 2834 22:29:28 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a020000002ff6ffffc8030000ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 519.487886] binder: 706:718 transaction failed 29201/-22, size 0-0 line 2834 [ 519.517001] binder: undelivered TRANSACTION_ERROR: 29189 22:29:28 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0xa00000000000000, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 519.533475] binder: undelivered TRANSACTION_ERROR: 29189 22:29:28 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000004800001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:28 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x4c00000000000000, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:28 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) semget(0xffffffffffffffff, 0x4, 0x0) [ 519.610363] EXT4-fs (loop0): invalid inodes per group: 8192 [ 519.610363] [ 519.632279] binder: 706:739 got transaction to invalid handle 22:29:28 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000002000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 519.694690] EXT4-fs (loop0): invalid inodes per group: 8192 [ 519.694690] 22:29:28 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x48000000, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:28 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f60fffc8030000ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:29:28 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0xfdfdffff00000000, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:29 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) socket$inet6(0xa, 0x80000, 0x3) r1 = syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x0, 0x400000) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(r1, 0x28, 0x2, &(0x7f0000000080)=0x577, 0x8) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f00000001c0)={0x0, @multicast2, @multicast2}, &(0x7f0000000200)=0xc) sendto$packet(r1, &(0x7f00000000c0)="6d80242033b7682dc85801e615b281ec345892521e8771fb37e0419a4f9b8b52e88f3f50aaf6156cb0176c770a70535c513f31027ccd1d559e4ecf4c30c08554286f8fa6a3785c542c61", 0x4a, 0x0, &(0x7f0000000240)={0x11, 0x7, r2, 0x1, 0xa6, 0x6, @broadcast}, 0x14) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(r1, 0x80045700, &(0x7f0000000400)) semget(0xffffffffffffffff, 0x0, 0x0) socketpair$inet6(0xa, 0x801, 0xa51f, &(0x7f0000000280)) openat$full(0xffffffffffffff9c, &(0x7f0000000440)='/dev/full\x00', 0x0, 0x0) write$binfmt_script(r1, &(0x7f0000000300)={'#! ', './file0', [{0x20, '/dev/snd/pcmC#D#c\x00'}, {0x20, 'eth1+'}, {0x20, "656d306370757365742d1070726f632e95"}, {0x20, "5e2a5d215d2e73656c6626822870707031"}, {}, {0x20, '^'}, {0x20, '/dev/snd/pcmC#D#c\x00'}, {0x20, ']vboxnet1eth1'}], 0xa, "fffb827c365f5ed9dd01b790cfe159c83c08a4b10b1ffb02f7604620dad5549ac261491c72054b80a975bfbf3d72e842222cfdf039c44c73794f4d9f15ded2484bf9119aa50c2e83b11e614b187ab77e13f23725e2922833bd016dcde5c85b994716106f35a3f322665743170fb4b9a3fd39ba7d37858f381cbbf637634c4407d4"}, 0xed) [ 519.894764] binder: 757:758 got transaction to invalid handle 22:29:29 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000200000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:29 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x60000000, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:29 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x600, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 519.954878] EXT4-fs (loop0): invalid inodes per group: 8192 [ 519.954878] [ 520.040178] EXT4-fs (loop0): invalid inodes per group: 8192 [ 520.040178] 22:29:29 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ff0fc8030000ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 520.096404] binder: 757:797 got transaction to invalid handle 22:29:29 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000004001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:29 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0xfdfdffff, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:29 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x4800, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 520.257396] EXT4-fs (loop0): invalid inodes per group: 8192 [ 520.257396] 22:29:29 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000500000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:29 executing program 5: ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f0000000040)=0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x40000000, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0xffffffffffffffa2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) semget(0xffffffffffffffff, 0x0, 0x0) [ 520.356174] EXT4-fs (loop0): invalid inodes per group: 8192 [ 520.356174] 22:29:29 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x300, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:29 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x4c, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:29 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffff64030000ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:29:29 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_open_dev$rtc(&(0x7f00000001c0)='/dev/rtc#\x00', 0x7fff, 0x40000) semget(0xffffffffffffffff, 0x0, 0x0) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$EVIOCSFF(r2, 0x40304580, &(0x7f0000000200)={0x57, 0x100, 0x6, {0x4, 0x190d}, {0x3, 0xe3ea}, @cond=[{0xffff, 0xeb03, 0x7, 0x40, 0x2, 0x2}, {0x3, 0x81, 0xa5, 0x0, 0x4, 0x81}]}) ioctl$sock_bt_hidp_HIDPGETCONNINFO(r2, 0x800448d3, &(0x7f0000000080)={{0x4e79, 0x8be4, 0x3, 0x7, 0x4f5, 0x9}, 0xea, 0x4, 0x6, 0xffff, 0x3, "a7cdb139ed194269a15131c47ee9a2a9f1540fd5c518176739f3dc7bb471a4b57388095e228b4f8b5143416ccef9381c12b01682eba6b0b224ec67d9a334626b31668a843aa110fe01ea681ab01a223ab67ebea4b90cdbe7faea201223c2291e24242d56fb838bcfee1420dfdefc0b18892d126c81b67a314fa96e9c3de46846"}) ioctl$NBD_CLEAR_SOCK(r1, 0xab04) 22:29:29 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000007a001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:29 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x10, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 520.620111] EXT4-fs (loop0): invalid inodes per group: 8192 [ 520.620111] 22:29:29 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000600000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:29 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x68000000, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 520.714893] EXT4-fs (loop0): invalid inodes per group: 8192 [ 520.714893] 22:29:30 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x6c00000000000000, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 520.798276] binder: 876:882 unknown command 0 [ 520.807230] binder: 876:882 ioctl c0306201 20000140 returned -22 22:29:30 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/qat_adf_ctl\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f0000000080)={0x9, 0x0, 0x56d0, 'queue1\x00', 0x7fff}) semget(0x1, 0x0, 0x400) 22:29:30 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8cf0300ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 520.933599] QAT: Invalid ioctl 22:29:30 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x1000000, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 520.978370] QAT: Invalid ioctl 22:29:30 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000a00000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:30 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000007a0000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:30 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x1000000000000000, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 521.054931] EXT4-fs (loop0): invalid inodes per group: 8192 [ 521.054931] 22:29:30 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000040)=0x0) ioprio_get$pid(0x2, r1) semget(0xffffffffffffffff, 0x0, 0x0) [ 521.181161] EXT4-fs (loop0): invalid inodes per group: 8192 [ 521.181161] 22:29:30 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x500, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:30 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8d00300ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 521.223111] binder: 916:933 got transaction to invalid handle 22:29:30 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x100000000000000, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:30 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000003d00000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:30 executing program 5: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fstat(r0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0}) r2 = getegid() lchown(&(0x7f0000000040)='./file0\x00', r1, r2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) semget(0xffffffffffffffff, 0x0, 0x0) 22:29:30 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x700, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:30 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000006c000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 521.397694] binder: 916:925 got transaction to invalid handle [ 521.429679] EXT4-fs (loop0): invalid inodes per group: 8192 [ 521.429679] [ 521.504607] EXT4-fs (loop0): invalid inodes per group: 8192 [ 521.504607] 22:29:30 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0xfffffdfd, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:30 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000500001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:30 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc80a0000ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 521.646765] binder: 970:986 got transaction to invalid handle 22:29:30 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/ignore_tunneled\x00', 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) semget(0xffffffffffffffff, 0x0, 0x0) r1 = msgget$private(0x0, 0x400) msgctl$IPC_INFO(r1, 0x3, &(0x7f00000001c0)=""/202) 22:29:30 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0xa00, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:30 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0xffffff7f, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 521.802039] EXT4-fs (loop0): invalid inodes per group: 8192 [ 521.802039] [ 521.831799] binder: 970:992 got transaction to invalid handle 22:29:31 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000600001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:31 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000003f0000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:31 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb0fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x8) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = syz_open_dev$amidi(&(0x7f0000000040)='/dev/amidi#\x00', 0x3, 0x1) ioctl$KVM_GET_ONE_REG(r1, 0x4010aeab, &(0x7f0000000080)={0x101, 0x7}) semget(0xffffffffffffffff, 0x0, 0x0) [ 521.919105] EXT4-fs (loop0): invalid inodes per group: 8192 [ 521.919105] 22:29:31 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x12, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:31 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x7400, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:31 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8004400ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 522.112348] binder: 1045:1048 unknown command 0 22:29:31 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/autofs\x00', 0x0, 0x0) ioctl$KVM_SMI(r1, 0xaeb7) semget(0xffffffffffffffff, 0x0, 0x0) mincore(&(0x7f0000fff000/0x1000)=nil, 0x1000, &(0x7f0000000080)=""/34) [ 522.143129] binder: 1045:1048 ioctl c0306201 20000140 returned -22 22:29:31 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x600, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:31 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000020001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 522.221950] EXT4-fs (loop0): invalid inodes per group: 8192 [ 522.221950] 22:29:31 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x48, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:31 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000050000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:31 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) semget(0xffffffffffffffff, 0x0, 0x0) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400, 0x0) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000100)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000300)={&(0x7f00000000c0), 0xc, &(0x7f00000002c0)={&(0x7f00000001c0)={0xe4, r2, 0x520, 0x70bd2a, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xffff}, @IPVS_CMD_ATTR_SERVICE={0x4c, 0x1, [@IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e22}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x1, 0xa}}, @IPVS_SVC_ATTR_TIMEOUT={0x8}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0x2}, @IPVS_SVC_ATTR_FWMARK={0x8}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x14, 0x4}}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'nq\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x800}, @IPVS_CMD_ATTR_DAEMON={0x24, 0x3, [@IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @loopback}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xff}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x9451}, @IPVS_CMD_ATTR_DAEMON={0x40, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast2}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'veth0_to_bridge\x00'}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40040}, 0x40) bpf$BPF_MAP_GET_NEXT_ID(0xc, &(0x7f0000000040)=0x1, 0x4) [ 522.360440] EXT4-fs (loop0): invalid inodes per group: 8192 [ 522.360440] [ 522.394775] binder: 1078:1083 unknown command 0 22:29:31 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x500, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 522.406100] binder: 1078:1083 ioctl c0306201 20000140 returned -22 22:29:31 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8340000ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:29:31 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x4000000, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:31 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000007001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:31 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x7a00, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:31 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x7400, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:31 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vga_arbiter\x00', 0x8000, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snapshot\x00', 0x4000, 0x0) ioctl$VIDIOC_SUBDEV_S_SELECTION(r1, 0xc040563e, &(0x7f0000000080)={0x0, 0x7fff, 0x100, 0x3, {0x1fc, 0x10000, 0x2, 0x3}}) semget(0xffffffffffffffff, 0x0, 0x0) [ 522.690497] EXT4-fs (loop0): invalid inodes per group: 8192 [ 522.690497] 22:29:31 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000a0000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 522.781932] EXT4-fs (loop0): invalid inodes per group: 8192 [ 522.781932] 22:29:32 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8230200ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:29:32 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x2000000000000000, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:32 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000003001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:32 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x5, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:32 executing program 5: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpu.stat\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(0xffffffffffffff9c, 0x84, 0x1b, &(0x7f00000001c0)=ANY=[@ANYRES32=0x0, @ANYBLOB="59000000d5b54cf6643830d4b703f879408b208f4548d14d1be9a28d08f46846f7da4f2bf12d5b43ecd14ce8c455fdba094d6bd1fef5c9478733c1d67d0a2573fcf133c18ab012fe5af56fe36be39db9d37ea448e536f6ff240684f58f"], &(0x7f0000000100)=0x61) setsockopt$inet_sctp_SCTP_MAXSEG(r2, 0x84, 0xd, &(0x7f0000000240)=@assoc_value={r3, 0x1f}, 0x8) semget(0xffffffffffffffff, 0x0, 0x0) r4 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/thread-self/attr/fscreate\x00', 0x2, 0x0) write$binfmt_misc(r4, &(0x7f0000000080)=ANY=[@ANYBLOB="730887010306605033a31b59e8c448c76480f189e28bd1217c2c6a0b10d716"], 0x1f) r5 = fcntl$getown(r0, 0x9) mq_notify(r2, &(0x7f0000000040)={0x0, 0x40, 0x3, @tid=r5}) [ 522.972252] EXT4-fs (loop0): invalid inodes per group: 8192 [ 522.972252] 22:29:32 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x60000000, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 523.064090] binder: 1166:1173 unknown command 50331648 [ 523.094024] binder: 1166:1173 ioctl c0306201 20000140 returned -22 [ 523.117111] EXT4-fs (loop0): invalid inodes per group: 8192 [ 523.117111] 22:29:32 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc84f0000ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:29:32 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x6000000000000000, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:32 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000030000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:32 executing program 5: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000000, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) r1 = creat(&(0x7f00000000c0)='./file0\x00', 0x2) connect$inet(r1, &(0x7f0000000100)={0x2, 0x4e21, @multicast1}, 0x10) setsockopt$inet6_mtu(r1, 0x29, 0x17, &(0x7f00000001c0)=0x5, 0x4) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) semget(0xffffffffffffffff, 0x0, 0x0) socketpair(0x8, 0x80000, 0x5, &(0x7f0000000040)={0xffffffffffffffff}) write$P9_RLERROR(r2, &(0x7f0000000080)=ANY=[@ANYBLOB="1100210007020008002874727573746564"], 0x11) 22:29:32 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000048001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:32 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x12000000, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:32 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x200000000000000, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 523.398956] EXT4-fs (loop0): invalid inodes per group: 8192 [ 523.398956] 22:29:32 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x6000, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 523.482123] binder_transaction: 38 callbacks suppressed [ 523.482139] binder: 1212:1226 transaction failed 29189/-22, size 0-0 line 2834 [ 523.502857] EXT4-fs (loop0): invalid inodes per group: 8192 [ 523.502857] 22:29:32 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000600000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:32 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8050000ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:29:32 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) semget(0x3, 0x20000000000005, 0x0) 22:29:32 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x700000000000000, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:32 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x74, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 523.592761] binder: 1212:1233 transaction failed 29189/-22, size 0-0 line 2834 22:29:32 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000005001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:32 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x68000000, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:32 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x200000000000000, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:32 executing program 5: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000000c0)='cpuset.effective_mems\x00', 0x0, 0x0) write$P9_RXATTRWALK(r2, &(0x7f0000000100)={0xf, 0x1f, 0x2, 0x100000001}, 0xf) semget(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x4, 0x70, 0x0, 0x5, 0x7fff, 0x40, 0x0, 0x70, 0x40, 0xe, 0x4, 0x9, 0x6, 0x6, 0x7, 0x6, 0x9, 0x8, 0x9, 0x7, 0x4000000000000000, 0x6, 0xfac, 0x0, 0x800, 0x3, 0xc9, 0x5, 0x1, 0x0, 0xffc00000000000, 0x6, 0x6, 0xffffffffffffffd9, 0x3, 0x5, 0x1, 0xd5d, 0x0, 0x1, 0x1, @perf_config_ext={0xf5, 0x1}, 0x400, 0x2, 0x3, 0x0, 0x7f, 0x9, 0x2}, 0x0, 0x10, r0, 0xa) [ 523.751911] binder: 1239:1261 transaction failed 29201/-22, size 0-0 line 2834 [ 523.790531] EXT4-fs (loop0): invalid inodes per group: 8192 [ 523.790531] [ 523.892973] binder: 1246:1279 transaction failed 29189/-22, size 0-0 line 2834 22:29:33 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8040000ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 523.935766] binder_transaction: 8 callbacks suppressed [ 523.935776] binder: 1239:1256 got transaction to invalid handle [ 523.956043] binder: 1239:1256 transaction failed 29201/-22, size 0-0 line 2834 [ 523.974256] binder_release_work: 40 callbacks suppressed [ 523.974263] binder: undelivered TRANSACTION_ERROR: 29201 22:29:33 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x7a00000000000000, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:33 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x6c00, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 523.993488] binder: 1246:1289 transaction failed 29189/-22, size 0-0 line 2834 [ 524.003344] binder: undelivered TRANSACTION_ERROR: 29201 22:29:33 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000480000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:33 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0xfffbffffffffffff, 0x0, 0x0, 0xff, 0x0, 0x0, 0x80000000000000, 0xffffffffc68e3093, 0x1, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc982, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x2}, 0x0, 0x0, 0x0, 0x0, 0x800000000}, 0x0, 0x4, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) semget(0xffffffffffffffff, 0x0, 0x0) [ 524.060212] binder: undelivered TRANSACTION_ERROR: 29189 [ 524.091539] binder: undelivered TRANSACTION_ERROR: 29189 22:29:33 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000700000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 524.162144] EXT4-fs (loop0): invalid inodes per group: 8192 [ 524.162144] 22:29:33 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x400000000000000, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:33 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x60, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:33 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socket$l2tp(0x18, 0x1, 0x1) semget(0xffffffffffffffff, 0x0, 0x0) r1 = memfd_create(&(0x7f0000000080)='mime_typeproc\x00', 0x2) unlinkat(r1, &(0x7f0000000100)='./file0\x00', 0x204) openat$cgroup_ro(r1, &(0x7f0000000340)="686ed9751d6c622e324d422e75736167655f696e5f627974657300ea52a0bd74a9b4ba1a8876b4b78c3015c4e77151d012d8b33900ae96d6679a7f2f9f14b53bab071756c21f2342c904a97b531e1102685a1afe07000cfe6e96f382b22d57d9b10d8f481f465c711ff7f7768be686ac419a", 0x0, 0x0) [ 524.304091] binder: 1298:1309 got transaction to invalid handle [ 524.330755] binder: 1308:1326 transaction failed 29189/-22, size 0-0 line 2834 22:29:33 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc82d0000ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:29:33 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x6c00000000000000, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 524.354966] binder: 1298:1309 transaction failed 29201/-22, size 0-0 line 2834 [ 524.377363] binder: 1308:1330 transaction failed 29189/-22, size 0-0 line 2834 [ 524.442852] binder: undelivered TRANSACTION_ERROR: 29189 [ 524.448402] binder: undelivered TRANSACTION_ERROR: 29189 22:29:33 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000800000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:33 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x4000000, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 524.504702] binder: 1298:1346 got transaction to invalid handle [ 524.514861] binder: 1298:1346 transaction failed 29201/-22, size 0-0 line 2834 22:29:33 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x9958) r1 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0xfffffffffffffffb, 0x402) ioctl$GIO_FONTX(r1, 0x4b6b, &(0x7f00000021c0)=""/4096) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/audio\x00', 0x1, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r2, 0x541b, &(0x7f0000000080)) semget(0xffffffffffffffff, 0x0, 0x0) 22:29:33 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0xa, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 524.556902] EXT4-fs (loop0): invalid inodes per group: 8192 [ 524.556902] [ 524.569847] binder: undelivered TRANSACTION_ERROR: 29201 [ 524.575355] binder: undelivered TRANSACTION_ERROR: 29201 22:29:33 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000680000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 524.658230] EXT4-fs (loop0): invalid inodes per group: 8192 [ 524.658230] [ 524.727851] binder: 1364:1371 unknown command 278592 [ 524.736471] binder: 1364:1371 ioctl c0306201 20000140 returned -22 [ 524.747228] binder: undelivered TRANSACTION_ERROR: 29189 22:29:33 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x10000000, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:33 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8140000ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 524.770409] binder: undelivered TRANSACTION_ERROR: 29189 22:29:34 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000e00000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:34 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = accept4$inet6(0xffffffffffffff9c, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote}, &(0x7f0000000080)=0x1c, 0x800) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffffff, 0x84, 0x6c, &(0x7f00000001c0)={0x0, 0x7c, "789cdf4e3bfb4c8b3572497e89849e799430c39d40ce6e8a8e47f7dda8dba71fa3f92103883283477254654aa345a5df6ad8797851f40035071e1e08c7bdf970333b99570039cb360d61820ba01377a4f8ec97b47538e1745d8e856b5a3a179defa2e3f51c131e25fc4b74fc83c53ddc949203951e36a1e1fafcb354"}, &(0x7f00000000c0)=0x84) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f0000000100)={r2, 0x8}, &(0x7f0000000280)=0x8) r3 = creat(&(0x7f00000002c0)='./file0\x00', 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffff9c, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000300)={0xffffffffffffffff}, 0x106, 0x100d}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r3, &(0x7f0000000380)={0x4, 0x8, 0xfa00, {r4, 0x1358}}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) semget(0xffffffffffffffff, 0x0, 0x0) [ 524.824868] binder: 1365:1382 got transaction to invalid handle 22:29:34 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x7a, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:34 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x4c00, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 524.971361] EXT4-fs (loop0): invalid inodes per group: 8192 [ 524.971361] [ 524.982439] binder: 1365:1401 got transaction to invalid handle 22:29:34 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000005001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:34 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x3000000, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 525.064520] EXT4-fs (loop0): invalid inodes per group: 8192 [ 525.064520] 22:29:34 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) semget(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f00000001c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xb0, 0xc8, 0x80000000, {"7e8d0e4fb9bd726b10ad72a6a706c16f85e9a1337fc5a654f3ae45ea327388c7adcd0eb9d52c39ed63b44075310adbaa84cd012dd814d44beed90f37b3b8c12a4bbca19263f51a9557b1ad339ef76bb8c3247822577fa5cc50e2cbdefa2ed94abc5aca0fdf14bb8ffd1c3cc6375d0dff110afe5ebf24790d530696bc752b29f806e523061f895d33292443543651a6b54358b16e0d5e588e28cb78a87e7a523b0deea3dce8fd392c4cedbd5b7c"}}, {0x0, "e310b34356fc97c7106c3b9baffa7c5b9887aa45f6a544a3054be567f0dde2ff1a68bbcc0ca8e4815757f9ddf50133d0e58bafac6bb0c39ad18908e573865795597c309efbdbe99540210f87c0a76e53af2b68dccf8bc8b7ca50eafe671e247d13a4a9cc7c58547ede197e0242b496acb2a755c7ab244251fad886d7eca824030885b3ede3a462c043c13962c92aa6837884f17b7299d6be696dc6e36f4c4453acd51d0902883bae0f0f881bef077561d4fc3146704360a2685ed535a6b3335e7a026573656e5b8c586e4c573712c3928048909383fd38b8aad0f047642bffba71f0e38dfead3e2c57542cad75d87ec3fa1b8dfcf614ecc93007a01d6d"}}, &(0x7f0000000080)=""/129, 0x1c7, 0x81}, 0x20) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000040)=0x4, 0x4) 22:29:34 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8bc0300ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:29:34 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x3, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:34 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000b00000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:34 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x300000000000000, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 525.335214] EXT4-fs (loop0): invalid inodes per group: 8192 [ 525.335214] [ 525.379441] binder: 1439:1445 unknown command 1088 [ 525.384937] binder: 1439:1445 ioctl c0306201 20000140 returned -22 22:29:34 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x2002, 0x0) ioctl$TIOCGETD(r0, 0x5424, &(0x7f0000000080)) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x4001ff) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f00000000c0)=0x0) syz_open_procfs(r2, &(0x7f0000000100)='auxv\x00') semget(0xffffffffffffffff, 0x0, 0x0) [ 525.446020] EXT4-fs (loop0): invalid inodes per group: 8192 [ 525.446020] 22:29:34 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x300000000000000, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:34 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x700000000000000, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:34 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000120000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:34 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000007a00001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:34 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8070000ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:29:34 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ppp\x00', 0x101000, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000080)={0x0}, &(0x7f00000000c0)=0xc) ioctl$TIOCSPGRP(r1, 0x5410, &(0x7f0000000280)=r2) syz_open_dev$usbmon(&(0x7f00000001c0)='/dev/usbmon#\x00', 0x7fffffff, 0x64a501) semget(0xffffffffffffffff, 0x0, 0x0) [ 525.722976] EXT4-fs (loop0): invalid inodes per group: 8192 [ 525.722976] 22:29:34 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x7000000, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:34 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0xa000000, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 525.766341] binder: 1471:1478 got transaction to invalid handle 22:29:35 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000006000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 525.888214] binder: 1471:1510 got transaction to invalid handle 22:29:35 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8100000ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:29:35 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x1200, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:35 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000004c001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:35 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x6000000, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:35 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) semget(0x3, 0x3, 0x20) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) semget(0x2, 0x3, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$EVIOCGID(r1, 0x80084502, &(0x7f0000000040)=""/189) 22:29:35 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x700, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:35 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000000003e000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 526.145068] EXT4-fs (loop0): invalid inodes per group: 8192 [ 526.145068] 22:29:35 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x7, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 526.225572] EXT4-fs (loop0): invalid inodes per group: 8192 [ 526.225572] 22:29:35 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8080000ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 526.319592] binder: 1565:1569 unknown command 1080229888 [ 526.328776] binder: 1565:1569 ioctl c0306201 20000140 returned -22 22:29:35 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x4800, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:35 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x5, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 526.500410] binder: 1584:1590 unknown command 0 [ 526.507778] EXT4-fs (loop0): invalid inodes per group: 8192 [ 526.507778] [ 526.518758] binder: 1584:1590 ioctl c0306201 20000140 returned -22 22:29:35 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000001200001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:35 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x7a, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:35 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x3f00000000000000, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:35 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000006000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:35 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = memfd_create(&(0x7f0000000040)='wlan0^#@/bdev*\x00', 0x1) ioctl$VIDIOC_SUBDEV_S_FMT(r1, 0xc0585605, &(0x7f0000000080)={0x1, 0x800, {0xff, 0xfffffffffffffffb, 0x3019, 0x5, 0xf, 0x6, 0x1}}) semget(0xffffffffffffffff, 0x0, 0x0) [ 526.601761] EXT4-fs (loop0): invalid inodes per group: 8192 [ 526.601761] 22:29:35 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8020000ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:29:35 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0xffffff7f00000000, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:35 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x5000000, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 526.758853] binder: 1603:1623 got transaction to invalid handle 22:29:35 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2000000000000001, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) semget(0xffffffffffffffff, 0x0, 0x0) r1 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x0, 0x80000) ioctl$UI_BEGIN_FF_ERASE(r1, 0xc00c55ca, &(0x7f0000000040)={0x1, 0x7, 0x6}) 22:29:36 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000a00001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 526.863285] EXT4-fs (loop0): invalid inodes per group: 8192 [ 526.863285] 22:29:36 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x6800, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:36 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x6800, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 526.948142] binder: 1603:1643 got transaction to invalid handle 22:29:36 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8037a00ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:29:36 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000007000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:36 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x48, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:36 executing program 5: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400201) getrlimit(0x0, &(0x7f0000000000)) semget(0xffffffffffffffff, 0x0, 0x0) 22:29:36 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000006c001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:36 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x300, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 527.193939] EXT4-fs (loop0): invalid inodes per group: 8192 [ 527.193939] [ 527.273953] binder: 1658:1678 got transaction to invalid handle 22:29:36 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x4800000000000000, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:36 executing program 5: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) semget(0xffffffffffffffff, 0x0, 0x0) [ 527.358114] EXT4-fs (loop0): invalid inodes per group: 8192 [ 527.358114] 22:29:36 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x2000, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:36 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030410ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:29:36 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000074000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:36 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000068001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:36 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x6800000000000000, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:36 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x2, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:36 executing program 5: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x1) semget(0xffffffffffffffff, 0x0, 0x0) r2 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vsock\x00', 0x200100, 0x0) ioctl$KVM_ENABLE_CAP(r2, 0x4068aea3, &(0x7f00000000c0)={0xfd, 0x0, [0x1, 0x7f, 0xfffffffffffffeff, 0x100000001]}) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r0, 0x80045530, &(0x7f0000000240)=""/163) ioctl$sock_inet_tcp_SIOCINQ(r2, 0x541b, &(0x7f0000000780)) ioctl$KVM_GET_XSAVE(r2, 0x9000aea4, &(0x7f0000000300)) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r2, 0x84, 0x1, &(0x7f0000000000)={0x0, 0x80000000, 0x81, 0x6, 0x2, 0x10000}, &(0x7f00000001c0)=0x14) getsockopt$inet_sctp6_SCTP_MAXSEG(r2, 0x84, 0xd, &(0x7f0000000700)=@assoc_value={r3, 0x8}, &(0x7f0000000740)=0x8) [ 527.676490] EXT4-fs (loop0): invalid inodes per group: 8192 [ 527.676490] [ 527.783939] EXT4-fs (loop0): invalid inodes per group: 8192 [ 527.783939] 22:29:36 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000300000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 527.826243] binder: 1736:1746 unknown command 16388 22:29:37 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc803000aec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:29:37 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x4c000000, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 527.865104] binder: 1736:1746 ioctl c0306201 20000140 returned -22 22:29:37 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000fdfdffff001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:37 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) semget(0xffffffffffffffff, 0x0, 0x0) 22:29:37 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x600000000000000, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:37 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x48000000, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 528.085901] EXT4-fs (loop0): invalid inodes per group: 8192 [ 528.085901] 22:29:37 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000900000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:37 executing program 5: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0x301001, 0x0) r1 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x200000f, 0x1010, 0xffffffffffffff9c, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000080)={r1}) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) semget(0xffffffffffffffff, 0x0, 0x0) [ 528.174019] EXT4-fs (loop0): invalid inodes per group: 8192 [ 528.174019] 22:29:37 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030dacec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:29:37 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x630c}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:37 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x7, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:37 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000003f001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 528.455920] binder: 1816:1822 unknown command 0 [ 528.462470] binder: 1815:1823 unknown command 140706560 [ 528.474884] EXT4-fs (loop0): invalid inodes per group: 8192 [ 528.474884] [ 528.484792] binder: 1815:1823 ioctl c0306201 20000140 returned -22 [ 528.491539] binder: 1816:1822 ioctl c0306201 20000140 returned -22 [ 528.500099] binder_transaction: 38 callbacks suppressed 22:29:37 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x4008630a}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 528.500117] binder: 1796:1826 transaction failed 29189/-22, size 0-0 line 2834 22:29:37 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x400000000000000, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 528.604668] EXT4-fs (loop0): invalid inodes per group: 8192 [ 528.604668] [ 528.619781] binder: 1824:1838 transaction failed 29189/-22, size 0-0 line 2834 22:29:37 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001100000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:37 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8031004ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:29:37 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x500000000000000, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 528.682190] binder: BC_ATTEMPT_ACQUIRE not supported [ 528.698382] binder: 1837:1844 ioctl c0306201 20000140 returned -22 22:29:37 executing program 5: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) semget(0x1, 0x0, 0x0) r3 = gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r3, r0, 0x0, 0x22, &(0x7f00000000c0)="776c616e312dae70726f632626403a7b2e296d696d655f747970656367726f757000", 0xffffffffffffffff}, 0x30) r4 = fcntl$dupfd(r0, 0x406, r1) getsockopt$inet_pktinfo(r4, 0x0, 0x8, &(0x7f0000000040)={0x0, @remote, @multicast2}, &(0x7f0000000080)=0xc) 22:29:37 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x400c630f}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 528.751794] binder: 1824:1831 transaction failed 29189/-22, size 0-0 line 2834 22:29:38 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000003001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:38 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x74, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 528.877745] EXT4-fs (loop0): invalid inodes per group: 8192 [ 528.877745] [ 528.894331] binder: 1854:1868 transaction failed 29189/-22, size 0-0 line 2834 22:29:38 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000080)=""/161) semget(0xffffffffffffffff, 0x0, 0x0) [ 528.953927] binder: 1854:1875 transaction failed 29189/-22, size 0-0 line 2834 [ 528.990324] EXT4-fs (loop0): invalid inodes per group: 8192 [ 528.990324] 22:29:38 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40486311}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 529.012004] binder_release_work: 39 callbacks suppressed [ 529.012011] binder: undelivered TRANSACTION_ERROR: 29189 [ 529.047149] binder: undelivered TRANSACTION_ERROR: 29189 [ 529.059049] binder: 1871:1887 transaction failed 29189/-22, size 0-0 line 2834 22:29:38 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000300001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:38 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030200ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:29:38 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x7400000000000000, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 529.200199] binder: 1896:1899 transaction failed 29189/-22, size 0-0 line 2834 [ 529.217899] binder: 1871:1876 transaction failed 29189/-22, size 0-0 line 2834 [ 529.236671] binder: undelivered TRANSACTION_ERROR: 29189 [ 529.242378] binder: undelivered TRANSACTION_ERROR: 29189 22:29:38 executing program 5: r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rfkill\x00', 0x2088c2, 0x0) ioctl$KVM_SET_SIGNAL_MASK(r0, 0x4004ae8b, &(0x7f0000000080)={0x62, "7f27da89a4490f84a6b33e46550fdc181389c5bc0477230b615f6afef0fbddf0ae16cf96433f96b0b07dea2c2443833f8481776843a6d0f1062ae3f1c0421b5850c2b626ced46a28a3670572a84b84747192a0e804b9d28ee798bff59a3e8331beac"}) r1 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x2400, 0x3) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) semget(0xffffffffffffffff, 0x0, 0x0) [ 529.259698] binder: undelivered TRANSACTION_ERROR: 29189 [ 529.267675] binder: 1903:1910 transaction failed 29189/-22, size 0-0 line 2834 22:29:38 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000048001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:38 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x630d}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 529.306520] binder: 1903:1914 transaction failed 29189/-22, size 0-0 line 2834 [ 529.315587] EXT4-fs (loop0): invalid inodes per group: 8192 [ 529.315587] [ 529.342827] binder: undelivered TRANSACTION_ERROR: 29189 [ 529.348356] binder: undelivered TRANSACTION_ERROR: 29189 22:29:38 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000007a001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:38 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x6000, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:38 executing program 5: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000040)={{{@in=@dev, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in6=@local}}, &(0x7f00000001c0)=0xe8) r3 = getegid() fchown(r0, r2, r3) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x4001fe) r4 = creat(&(0x7f0000000200)='./file0\x00', 0x171) ioctl$VHOST_SET_MEM_TABLE(r4, 0x4008af03, &(0x7f0000000880)={0x8, 0x0, [{0x3004, 0x7d, &(0x7f0000000240)=""/125}, {0x1000, 0xc6, &(0x7f00000002c0)=""/198}, {0x3000, 0xca, &(0x7f00000003c0)=""/202}, {0x10f002, 0xc3, &(0x7f00000004c0)=""/195}, {0xd000, 0xc0, &(0x7f00000005c0)=""/192}, {0x11001, 0xc5, &(0x7f0000000680)=""/197}, {0x1000, 0x3a, &(0x7f0000000780)=""/58}, {0x2000, 0x89, &(0x7f00000007c0)=""/137}]}) semget(0xffffffffffffffff, 0x0, 0x0) [ 529.477102] EXT4-fs (loop0): invalid inodes per group: 8192 [ 529.477102] [ 529.488508] binder: 1926:1935 unknown command 0 [ 529.520783] binder: 1926:1935 ioctl c0306201 20000140 returned -22 [ 529.555963] binder: 1926:1935 unknown command 0 [ 529.564662] binder: 1926:1935 ioctl c0306201 20000140 returned -22 22:29:38 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc803fc00ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 529.599174] binder: undelivered TRANSACTION_ERROR: 29189 [ 529.605563] binder: undelivered TRANSACTION_ERROR: 29189 22:29:38 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046309, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:38 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046302}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:38 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000004c001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 529.646509] binder: undelivered TRANSACTION_ERROR: 29189 22:29:38 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000068000000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 529.747744] binder: 1958:1963 unknown command 1074029321 [ 529.778178] binder: 1958:1963 ioctl c0306201 20000140 returned -22 22:29:38 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$cgroup_ro(r0, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000000c0)='veth0_to_bond\x00', 0x10) ioctl$BLKRESETZONE(r2, 0x40101283, &(0x7f0000000400)={0xffff, 0x7}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x6) write$vnet(r2, &(0x7f00000005c0)={0x1, {&(0x7f0000000440)=""/162, 0xa2, &(0x7f0000000500)=""/134, 0x1, 0x7}}, 0x68) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(r2, &(0x7f00000003c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000380)={&(0x7f0000000200)=ANY=[@ANYBLOB="64010000", @ANYRES16=r3, @ANYBLOB="040527bd7000fbdbdf250e00000008000500649e00003c00020008000b000a0000000800030003000000080002004e20000008000400210b0000080005000014000008000500c849000008000900030000001400010008000b0073697000080001000a000000040003004c000200080002004e200000080002004e24000008000600fddb20c48bdd483ef4da18ffffff080008000600000008000300020000000800070008009e1a292fcb0000080006000100000008000b000a00000008000700ffffff7f640003000800030000000000140002006970365f7674693000000000000000000800030000000000080007004e2200000800080000000000080004003f000000080001000300000014000600ff020000000000000000000000000001080008000000000008000500018000001800010014000300ac1414bb00000000000000000000000024000200080003000300000008000b000200000008"], 0x164}, 0x1, 0x0, 0x0, 0x20000000}, 0x800) syz_open_dev$admmidi(&(0x7f0000000080)='/dev/admmidi#\x00', 0x8, 0x40) semget(0x0, 0x1, 0x15) semget(0xffffffffffffffff, 0x0, 0x0) [ 529.799690] EXT4-fs (loop0): invalid inodes per group: 8192 [ 529.799690] 22:29:39 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40086310}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:39 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046312, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:39 executing program 5: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) semget(0xffffffffffffffff, 0x0, 0x0) [ 529.889090] EXT4-fs (loop0): invalid inodes per group: 8192 [ 529.889090] [ 529.926921] binder_transaction: 5 callbacks suppressed [ 529.926931] binder: 1967:1988 got transaction to invalid handle 22:29:39 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc803001fec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:29:39 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000000a001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 530.038028] binder: 1994:1997 unknown command 1074029330 [ 530.055362] binder: 1994:1997 ioctl c0306201 20000140 returned -22 [ 530.061859] binder: 1992:2000 BC_DEAD_BINDER_DONE 4040630000000000 not found [ 530.090080] binder: 1992:2000 unknown command 4 [ 530.105978] binder: 1967:2005 got transaction to invalid handle [ 530.108941] binder: 1992:2000 ioctl c0306201 20000140 returned -22 22:29:39 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000004c0000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:39 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40106308}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:39 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x630b, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 530.178244] EXT4-fs (loop0): invalid inodes per group: 8192 [ 530.178244] 22:29:39 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000004400000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:39 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) lstat(&(0x7f0000000100)='./file0\x00', &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) ioprio_get$uid(0x0, r1) r2 = syz_open_dev$adsp(&(0x7f0000000080)='/dev/adsp#\x00', 0x8000, 0x250081) bpf$OBJ_PIN_MAP(0x6, &(0x7f00000000c0)={&(0x7f0000000040)='./file0\x00', r2}, 0x10) semget(0xffffffffffffffff, 0x0, 0x40) epoll_ctl$EPOLL_CTL_DEL(r2, 0x2, r2) [ 530.276213] EXT4-fs (loop0): invalid inodes per group: 8192 [ 530.276213] 22:29:39 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8036000ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 530.348140] binder: 2026:2027 BC_INCREFS_DONE u4040630000000000 no match [ 530.386138] binder: 2028:2036 ERROR: BC_REGISTER_LOOPER called without request [ 530.409623] binder: 2026:2027 unknown command 0 [ 530.424865] binder: 2028:2036 unknown command 4 [ 530.439114] binder: 2026:2027 ioctl c0306201 20000140 returned -22 [ 530.447063] binder: 2025:2045 got transaction to invalid handle [ 530.470854] binder: 2028:2036 ioctl c0306201 20000140 returned -22 [ 530.502531] binder: 2028:2036 ERROR: BC_REGISTER_LOOPER called without request 22:29:39 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046304}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 530.519972] binder: 2028:2036 unknown command 4 [ 530.525468] binder: 2028:2036 ioctl c0306201 20000140 returned -22 [ 530.545110] EXT4-fs (loop0): invalid inodes per group: 8192 [ 530.545110] 22:29:39 executing program 5: r0 = add_key(&(0x7f0000000040)='.dead\x00', &(0x7f0000000080)={'syz', 0x2}, &(0x7f00000001c0)="2db2326ecb4e90952cdce8a88975fabaf42c2f237e8418da9368385ac7fa5e7696ec23e782002775daa80b1118467a6b59905c35223cfefb1b7d9024be7f489eac5c1b31058ca5494f82fc0905d0a3d2ebd4bbc180fb60f5fd5f8829a960ae6b624fb13fb46a9c4c02d066d509127c313e2b281dba9852d63a358594ff5a18f091e8f89fc5c0274943cfdaa91dc7aa90", 0x90, 0xfffffffffffffff8) keyctl$assume_authority(0x10, r0) pipe2(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4800) ioctl$VIDIOC_G_SLICED_VBI_CAP(r1, 0xc0745645, &(0x7f0000000280)={0x0, [0xffffffffffffffff, 0x3, 0x4, 0x8, 0x5, 0x3, 0x200, 0x5, 0x5, 0x4, 0x80000001, 0xf4, 0x400, 0x2, 0x8000, 0x1, 0x4, 0x40, 0x5, 0x0, 0x0, 0x5, 0x5, 0x70d, 0xc000000000000000, 0x1, 0xffffffffffffffff, 0x9c, 0x1, 0x9, 0x100, 0x1, 0x0, 0x9, 0x5, 0x6, 0x6, 0x7, 0x2, 0xe7b1, 0x40, 0x80000001, 0x7f, 0x3ff, 0x4, 0x1, 0x1, 0x43f], 0xf}) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) semget(0x1, 0x100000000, 0x0) 22:29:39 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000004c00001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:39 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046302, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 530.624984] binder: 2025:2062 got transaction to invalid handle 22:29:39 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000006001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 530.688170] binder: 2061:2067 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 530.728336] binder: 2061:2067 got transaction to invalid handle [ 530.748615] EXT4-fs (loop0): invalid inodes per group: 8192 [ 530.748615] [ 530.768728] binder: BC_ACQUIRE_RESULT not supported 22:29:39 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030074ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:29:39 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046306}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:40 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000006c00001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 530.796366] binder: 2068:2077 ioctl c0306201 20000140 returned -22 [ 530.824177] binder: BC_ACQUIRE_RESULT not supported [ 530.830553] binder: 2068:2077 ioctl c0306201 20000140 returned -22 22:29:40 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) semget(0xffffffffffffffff, 0x0, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(0xffffffffffffffff, 0x770a, 0x0) 22:29:40 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x630d, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 530.940019] binder: 2087:2095 Release 1 refcount change on invalid ref 0 ret -22 [ 530.948547] EXT4-fs (loop0): invalid inodes per group: 8192 [ 530.948547] [ 530.989911] binder: 2087:2095 got transaction to invalid handle 22:29:40 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046309}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 531.039425] EXT4-fs (loop0): invalid inodes per group: 8192 [ 531.039425] [ 531.059140] binder: 2101:2110 unknown command 4 [ 531.071609] binder: 2101:2110 ioctl c0306201 20000140 returned -22 22:29:40 executing program 5: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_script(r0, &(0x7f0000000080)={'#! ', './file0', [{}], 0xa, "e1c9b5a139f1137bc8f70f429f0b9191b93d9f1538384f645f1b8acf88f0b4c631bc0f76ca1d9abc8bcd83b3d0dfa243eaf37fc52783be3a6a50c71dd541290c058281f6ff49c19591bb768a52bd137c615cf6f93f0fb30e335b2c6f04505938accbdbebaff9840fc78729a9cebc167280090e30892d731a"}, 0x84) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) semget(0xffffffffffffffff, 0x0, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x513103, 0x0) ioctl$RTC_UIE_OFF(r2, 0x7004) 22:29:40 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030003ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:29:40 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046307, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:40 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000001001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:40 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000400001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 531.232056] binder: 2116:2121 unknown command 1074029321 [ 531.283181] binder: 2116:2121 ioctl c0306201 20000140 returned -22 22:29:40 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046312}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 531.331593] EXT4-fs (loop0): invalid inodes per group: 8192 [ 531.331593] [ 531.338536] binder: 2130:2138 DecRefs 0 refcount change on invalid ref 4 ret -22 [ 531.349641] binder: 2130:2138 BC_FREE_BUFFER u0000000000000000 no match [ 531.369317] binder: 2130:2138 ERROR: BC_REGISTER_LOOPER called without request 22:29:40 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) semget(0xffffffffffffffff, 0x0, 0x0) [ 531.428663] EXT4-fs (loop0): invalid inodes per group: 8192 [ 531.428663] 22:29:40 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40406300, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:40 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030068ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 531.475261] binder: 2147:2154 unknown command 1074029330 [ 531.510946] binder: 2147:2154 ioctl c0306201 20000140 returned -22 22:29:40 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000006800001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:40 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000007fffffff001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:40 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x400c630e}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 531.660461] binder: 2164:2171 got transaction to invalid handle [ 531.676131] EXT4-fs (loop0): invalid inodes per group: 8192 [ 531.676131] 22:29:40 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x630c, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 531.712591] binder: 2179:2180 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 531.721788] binder: 2179:2180 unknown command 0 [ 531.727704] binder: 2179:2180 ioctl c0306201 20000140 returned -22 22:29:40 executing program 5: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) semget(0x2, 0x0, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$SG_GET_PACK_ID(r3, 0x227c, &(0x7f00000000c0)) fsetxattr$trusted_overlay_redirect(r1, &(0x7f0000000040)='trusted.overlay.redirect\x00', &(0x7f0000000080)='./file0\x00', 0x8, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x401) [ 531.785925] EXT4-fs (loop0): invalid inodes per group: 8192 [ 531.785925] [ 531.807879] binder: 2175:2194 got transaction to invalid handle 22:29:41 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40406300}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 531.843699] binder: 2193:2200 unknown command 4 22:29:41 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc803006cec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 531.867739] binder: 2193:2200 ioctl c0306201 20000140 returned -22 22:29:41 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000007400001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:41 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x4004634d, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:41 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40086303}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 532.006166] binder: 2175:2216 got transaction to invalid handle 22:29:41 executing program 5: r0 = socket$bt_hidp(0x1f, 0x3, 0x6) flock(r0, 0x1) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) semget(0xffffffffffffffff, 0x0, 0x0) 22:29:41 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000060000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 532.101059] binder: 2217:2228 unknown command 1074029389 [ 532.106931] EXT4-fs (loop0): invalid inodes per group: 8192 [ 532.106931] [ 532.158639] binder: 2217:2228 ioctl c0306201 20000140 returned -22 [ 532.169581] binder: 2227:2233 BC_FREE_BUFFER u4040630000000000 no match [ 532.198863] binder: 2227:2233 unknown command 4 22:29:41 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046306, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 532.221296] binder: 2227:2233 ioctl c0306201 20000140 returned -22 [ 532.238610] binder: 2227:2233 BC_FREE_BUFFER u4040630000000000 no match 22:29:41 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000022300000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:41 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8037400ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 532.267562] binder: 2227:2233 unknown command 4 [ 532.302674] binder: 2227:2233 ioctl c0306201 20000140 returned -22 [ 532.334765] binder: 2234:2252 got transaction to invalid handle 22:29:41 executing program 5: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = shmget$private(0x0, 0x3000, 0x78000a23, &(0x7f0000ffb000/0x3000)=nil) shmctl$SHM_UNLOCK(r1, 0xc) open_by_handle_at(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="1a00a7e5fc15b8a7e2f454000000000000000000000000000000"], 0x40c00) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x20000, 0x0) ioctl$KVM_SET_SREGS(r3, 0x4138ae84, &(0x7f00000001c0)={{0x10001, 0x1000, 0x4, 0x1ff, 0x730, 0x800, 0x1, 0x7, 0xa5b, 0x3, 0x1, 0xffff}, {0x1000, 0x10000, 0x0, 0x10001, 0x4, 0x3, 0x5, 0x2, 0x1f, 0x20, 0x1}, {0x0, 0xf000, 0xe, 0x4b5, 0x5, 0x100, 0xf10, 0x9, 0x200, 0x2, 0x2, 0xfffffffffffffffe}, {0x1002, 0x2000, 0xd, 0x5, 0x3, 0x40, 0x4, 0x4, 0x100000000000, 0x7, 0x7652, 0x2}, {0x3000, 0x0, 0x10, 0x5, 0x6, 0x10001, 0xb4a, 0x6, 0x0, 0x8, 0x170d, 0xfffffffffffffff7}, {0x3, 0x2, 0xd, 0x0, 0x1, 0x1, 0x1, 0x800, 0x2, 0x1000, 0x3ff, 0xa8}, {0x0, 0x7000, 0xf, 0xffffffff, 0x1, 0x1, 0x8cdc, 0x4, 0x7, 0x400, 0x7a, 0x1}, {0x104000, 0x3000, 0xf, 0x50, 0x6, 0x20, 0x6, 0x7f, 0xfffffffffffffffb, 0xdb11, 0x81, 0x1f}, {0x5000, 0x7000}, {0x100000, 0x2}, 0x20000011, 0x0, 0x0, 0x1, 0xa, 0x0, 0xf000, [0xea, 0xfb, 0x6c5, 0x9]}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r3, 0x2) semget(0xffffffffffffffff, 0x0, 0x0) 22:29:41 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046356}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 532.384153] binder: 2251:2256 Release 1 refcount change on invalid ref 4 ret -22 [ 532.409220] binder: 2251:2256 BC_FREE_BUFFER u0000000000000000 no match [ 532.456545] binder: 2251:2256 ERROR: BC_REGISTER_LOOPER called without request [ 532.467661] EXT4-fs (loop0): invalid inodes per group: 8192 [ 532.467661] 22:29:41 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000074001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:41 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x400c630f, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 532.541659] binder: 2271:2276 unknown command 1074029398 [ 532.556822] binder: 2271:2276 ioctl c0306201 20000140 returned -22 [ 532.579097] EXT4-fs (loop0): invalid inodes per group: 8192 [ 532.579097] 22:29:41 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000002f00000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:41 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046363}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:41 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) semget(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCADDDLCI(r0, 0x8980, &(0x7f0000000040)={'team_slave_0\x00'}) r2 = add_key$keyring(&(0x7f0000000100)='keyring\x00', &(0x7f00000001c0)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffc) add_key(&(0x7f0000000080)='rxrpc_s\x00', &(0x7f00000000c0)={'syz', 0x1}, 0x0, 0x0, r2) 22:29:41 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc803003fec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 532.731031] binder: 2283:2295 BC_CLEAR_DEATH_NOTIFICATION invalid ref 4 [ 532.773413] binder: 2283:2295 unknown command 0 [ 532.791699] binder: 2283:2295 ioctl c0306201 20000140 returned -22 [ 532.808654] binder: 2296:2306 unknown command 1074029411 [ 532.828658] EXT4-fs (loop0): invalid inodes per group: 8192 [ 532.828658] [ 532.835952] binder: 2296:2306 ioctl c0306201 20000140 returned -22 22:29:42 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40086303, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:42 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000700001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:42 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000680000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:42 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40486312}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 532.990227] EXT4-fs (loop0): invalid inodes per group: 8192 [ 532.990227] 22:29:42 executing program 5: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = msgget(0x2, 0x65) fstat(r0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r0, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r0, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f00000003c0)=0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000400)={0x0}, &(0x7f0000000440)=0xc) msgctl$IPC_SET(r1, 0x1, &(0x7f0000000480)={{0x9, r2, r3, r4, r5, 0x0, 0x6}, 0xffffffffffff8001, 0x1f, 0x5, 0x0, 0x6, 0xa75d, r6, r7}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r9, 0x8912, 0x400200) r10 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dsp\x00', 0x400, 0x0) ioctl$TIOCMBIC(r10, 0x5417, &(0x7f0000000080)=0x9) fsetxattr(r8, &(0x7f00000000c0)=@known='system.sockprotoname\x00', &(0x7f0000000100)="706f7369785f61636c5f616363657373a0656d3129d16370757365746b657972696e67626465767b286c6f747275737465646370757365746370757365742900", 0x40, 0x3) semget(0xffffffffffffffff, 0x0, 0x0) 22:29:42 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030fffec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 533.077672] binder: 2327:2334 BC_FREE_BUFFER u4008630300000004 no match [ 533.111500] binder: 2331:2337 got reply transaction with no transaction stack [ 533.144638] binder: 2327:2334 unknown command 0 22:29:42 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000012001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:42 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x630b}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 533.201610] binder: 2327:2334 ioctl c0306201 20000140 returned -22 [ 533.264738] binder: 2327:2334 BC_FREE_BUFFER u4008630300000004 no match [ 533.283741] EXT4-fs (loop0): invalid inodes per group: 8192 [ 533.283741] 22:29:42 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) semget(0x0, 0x4, 0xfffffffffffffffd) [ 533.315011] binder: 2327:2334 unknown command 0 [ 533.320414] binder: 2327:2334 ioctl c0306201 20000140 returned -22 [ 533.325861] binder: 2359:2363 ERROR: BC_REGISTER_LOOPER called without request [ 533.349347] binder: 2359:2363 unknown command 0 22:29:42 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x400c630e, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 533.366688] EXT4-fs (loop0): invalid inodes per group: 8192 [ 533.366688] [ 533.373812] binder: 2359:2363 ioctl c0306201 20000140 returned -22 22:29:42 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030009ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:29:42 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000021000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:42 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40406301}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:42 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000c00000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:42 executing program 5: perf_event_open(&(0x7f0000000140)={0x4, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x4) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) semget(0xffffffffffffffff, 0x0, 0x0) [ 533.569724] binder: 2380:2386 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 [ 533.603132] binder: 2380:2386 unknown command 0 [ 533.633320] binder: 2390:2399 got reply transaction with no transaction stack [ 533.639987] binder: 2380:2386 ioctl c0306201 20000140 returned -22 [ 533.649950] EXT4-fs (loop0): invalid inodes per group: 8192 [ 533.649950] [ 533.658581] binder_transaction: 46 callbacks suppressed [ 533.658598] binder: 2390:2399 transaction failed 29201/-71, size 0-0 line 2741 22:29:42 executing program 5: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) semget(0xffffffffffffffff, 0x0, 0x0) 22:29:42 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40086310, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:42 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046307}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 533.697532] binder: 2388:2409 transaction failed 29189/-22, size 0-0 line 2834 [ 533.705413] EXT4-fs (loop0): invalid inodes per group: 8192 [ 533.705413] [ 533.720390] binder: 2387:2395 transaction failed 29189/-22, size 0-0 line 2834 [ 533.770548] binder: 2388:2414 transaction failed 29189/-22, size 0-0 line 2834 22:29:43 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc80300fcec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 533.857286] binder: 2387:2431 transaction failed 29189/-22, size 0-0 line 2834 [ 533.883914] binder: 2417:2427 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 533.906948] binder: 2426:2434 BC_DEAD_BINDER_DONE 4008630300000004 not found 22:29:43 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000400000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:43 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x4001, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) semget(0xffffffffffffffff, 0x0, 0x0) 22:29:43 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000051000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 533.948715] binder: 2417:2427 transaction failed 29201/-22, size 0-0 line 2834 [ 533.961490] binder: 2426:2434 unknown command 0 [ 533.994104] binder: 2426:2434 ioctl c0306201 20000140 returned -22 [ 534.001081] binder: 2417:2427 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 534.028377] binder: 2417:2427 transaction failed 29201/-22, size 0-0 line 2834 22:29:43 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046363, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 534.062373] binder_release_work: 49 callbacks suppressed [ 534.062380] binder: undelivered TRANSACTION_ERROR: 29201 22:29:43 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40106309}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 534.131180] binder: 2444:2460 transaction failed 29189/-22, size 0-0 line 2834 [ 534.151994] binder: 2445:2463 transaction failed 29189/-22, size 0-0 line 2834 22:29:43 executing program 5: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = dup2(r0, r1) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000040)={@in6={{0xa, 0x4e22, 0x8, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x15}}, 0xfffffffffffffffb}}, 0x6, 0x9, 0xf311, "f2a31bf54852498f5e138c539002c1fff617ab8a140c86768b94a3d2e73cd0d80d5f478a181b8ca7f2e0817f75c46eb687ddeda7181d64211cbd4dba9a206916ad0ee6cf45a2e9a412d778873b7e130c"}, 0xd8) ioctl$INOTIFY_IOC_SETNEXTWD(r2, 0x40044900, 0x7) [ 534.179884] EXT4-fs (loop0): invalid inodes per group: 8192 [ 534.179884] [ 534.186807] binder: 2456:2461 unknown command 1074029411 [ 534.224008] binder: 2444:2473 transaction failed 29189/-22, size 0-0 line 2834 [ 534.232762] binder: 2456:2461 ioctl c0306201 20000140 returned -22 [ 534.246511] binder: 2466:2475 BC_ACQUIRE_DONE u4040630000000000 no match [ 534.261139] binder: undelivered TRANSACTION_ERROR: 29189 [ 534.266689] binder: undelivered TRANSACTION_ERROR: 29189 [ 534.283669] binder: 2466:2475 unknown command 0 [ 534.297894] EXT4-fs (loop0): invalid inodes per group: 8192 [ 534.297894] [ 534.315748] binder: 2466:2475 ioctl c0306201 20000140 returned -22 22:29:43 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40106308, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:43 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000005300000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 534.339640] binder: undelivered TRANSACTION_ERROR: 29189 [ 534.345185] binder: undelivered TRANSACTION_ERROR: 29189 22:29:43 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$amidi(&(0x7f0000000040)='/dev/amidi#\x00', 0x1ff, 0x14000) ioctl$BLKPBSZGET(r1, 0x127b, &(0x7f0000000080)) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) semget(0xffffffffffffffff, 0x0, 0x0) socket$rds(0x15, 0x5, 0x0) socket$inet(0x2, 0x6, 0x452f4f4a) 22:29:43 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x48}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:43 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000071000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:43 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030500ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 534.494208] binder: 2489:2494 BC_INCREFS_DONE u4008630300000004 no match [ 534.531338] binder: 2489:2494 ERROR: BC_REGISTER_LOOPER called without request [ 534.543589] binder: 2495:2502 Acquire 1 refcount change on invalid ref 72 ret -22 [ 534.569214] EXT4-fs (loop0): invalid inodes per group: 8192 [ 534.569214] [ 534.580034] binder: undelivered TRANSACTION_ERROR: 29201 [ 534.588613] binder: undelivered TRANSACTION_ERROR: 29189 22:29:43 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x60}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:43 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40486311, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:43 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000074001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 534.672571] EXT4-fs (loop0): invalid inodes per group: 8192 [ 534.672571] 22:29:43 executing program 5: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) socket$xdp(0x2c, 0x3, 0x0) semget(0xffffffffffffffff, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x2) [ 534.739338] binder: 2518:2524 Acquire 1 refcount change on invalid ref 96 ret -22 [ 534.774332] binder: undelivered TRANSACTION_ERROR: 29201 [ 534.784933] binder: undelivered TRANSACTION_ERROR: 29201 22:29:44 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030006ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:29:44 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0xa}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 534.824951] binder: undelivered TRANSACTION_ERROR: 29189 22:29:44 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40106309, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:44 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000041000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 534.971730] binder: 2542:2553 Acquire 1 refcount change on invalid ref 10 ret -22 [ 535.004098] EXT4-fs (loop0): invalid inodes per group: 8192 [ 535.004098] [ 535.012058] binder_transaction: 8 callbacks suppressed 22:29:44 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000040), 0x2}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) semget(0xffffffffffffffff, 0x0, 0x0) [ 535.012067] binder: 2542:2553 got transaction to invalid handle 22:29:44 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000060001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 535.042563] binder: 2554:2558 BC_ACQUIRE_DONE u4008630300000004 no match [ 535.074210] binder: 2554:2558 ERROR: BC_REGISTER_LOOPER called without request 22:29:44 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x400000000000000}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:44 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046354, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 535.125454] EXT4-fs (loop0): invalid inodes per group: 8192 [ 535.125454] 22:29:44 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8031020ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:29:44 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x800000002, 0x0) ioctl$KDSKBLED(r1, 0x4b65, 0x3) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x8, 0x40010, r1, 0x2) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0xf2) syz_open_dev$mouse(&(0x7f0000000040)='/dev/input/mouse#\x00', 0x4, 0x80082) semget(0xffffffffffffffff, 0x0, 0x0) [ 535.265947] binder: 2578:2584 Acquire 1 refcount change on invalid ref 0 ret -22 [ 535.289351] binder: 2578:2584 got transaction to invalid handle [ 535.302252] binder: 2582:2591 unknown command 1074029396 22:29:44 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000a1000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:44 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x74000000}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 535.357615] binder: 2582:2591 ioctl c0306201 20000140 returned -22 22:29:44 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000d00000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 535.400937] EXT4-fs (loop0): invalid inodes per group: 8192 [ 535.400937] 22:29:44 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046356, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 535.484542] EXT4-fs (loop0): invalid inodes per group: 8192 [ 535.484542] [ 535.503032] binder: 2606:2612 got transaction to invalid handle 22:29:44 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) semget(0xffffffffffffffff, 0x0, 0x0) 22:29:44 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x5000000}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 535.575234] binder: 2616:2624 unknown command 1074029398 [ 535.593764] binder: 2616:2624 ioctl c0306201 20000140 returned -22 22:29:44 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8036800ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:29:44 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40486312, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 535.694357] binder_thread_write: 1 callbacks suppressed [ 535.694373] binder: 2634:2643 Acquire 1 refcount change on invalid ref 83886080 ret -22 22:29:44 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001200000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:44 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000004c0000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 535.778330] EXT4-fs (loop0): invalid inodes per group: 8192 [ 535.778330] [ 535.801060] binder: 2634:2643 got transaction to invalid handle 22:29:45 executing program 5: r0 = syz_open_dev$media(&(0x7f0000000300)='/dev/media#\x00', 0xa, 0x10d01) ioctl$EVIOCRMFF(r0, 0x40044581, &(0x7f0000000100)=0xfb) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f00000001c0)={0x0}, &(0x7f0000000200)=0x8) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000280)={r1, 0x30, &(0x7f0000000240)=[@in={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x1c}}, @in={0x2, 0x4e22, @loopback}, @in={0x2, 0x4e24, @loopback}]}, &(0x7f00000002c0)=0x10) r2 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) semget(0xffffffffffffffff, 0x0, 0x0) fsetxattr$trusted_overlay_nlink(r2, &(0x7f0000000040)='trusted.overlay.nlink\x00', &(0x7f0000000080)={'L-', 0x9}, 0x28, 0x1) 22:29:45 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x60000000}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 535.841896] binder: 2652:2656 got reply transaction with no transaction stack [ 535.895733] EXT4-fs (loop0): invalid inodes per group: 8192 [ 535.895733] 22:29:45 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046304, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:45 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8032010ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 535.965480] binder: 2655:2658 got transaction to invalid handle 22:29:45 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000100000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 536.027895] binder: 2670:2679 Acquire 1 refcount change on invalid ref 1610612736 ret -22 [ 536.085686] binder: 2681:2687 IncRefs 0 refcount change on invalid ref 4 ret -22 [ 536.092402] binder: 2670:2679 got transaction to invalid handle [ 536.109780] binder: 2681:2687 BC_FREE_BUFFER u0000000000000000 no match [ 536.118123] binder: 2655:2692 got transaction to invalid handle 22:29:45 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x2000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0xfffffffffffffffe, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) semget(0xffffffffffffffff, 0x0, 0x0) setxattr(&(0x7f0000000200)='./file0\x00', &(0x7f0000000240)=@known='com.apple.system.Security\x00', &(0x7f0000000280)='+:\x00', 0x3, 0x2) r2 = accept(r0, &(0x7f0000000040)=@ax25, &(0x7f00000000c0)=0x80) setsockopt$packet_fanout_data(r2, 0x107, 0x16, &(0x7f00000001c0)={0x1, &(0x7f0000000100)=[{0x11, 0x101, 0xfff, 0x3}]}, 0x10) 22:29:45 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x6}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 536.131493] binder: 2681:2687 ERROR: BC_REGISTER_LOOPER called without request [ 536.155000] EXT4-fs (loop0): invalid inodes per group: 8192 [ 536.155000] 22:29:45 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000070000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:45 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x4008630a, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 536.260669] EXT4-fs (loop0): invalid inodes per group: 8192 [ 536.260669] 22:29:45 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc803ac0dec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:29:45 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000006001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 536.361716] binder: 2708:2718 Acquire 1 refcount change on invalid ref 6 ret -22 [ 536.383895] binder: 2708:2718 got transaction to invalid handle 22:29:45 executing program 5: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r0, 0x800c6613, &(0x7f0000000040)={0x0, @aes128, 0x1, "d63dfc5867d32ac8"}) semget(0xffffffffffffffff, 0x0, 0x0) 22:29:45 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x68}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 536.407432] binder: 2702:2725 got transaction to invalid handle [ 536.407711] binder: BC_ATTEMPT_ACQUIRE not supported [ 536.439776] binder: 2716:2723 ioctl c0306201 20000140 returned -22 22:29:45 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40406301, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 536.541986] binder: 2702:2738 got transaction to invalid handle [ 536.588048] EXT4-fs (loop0): invalid inodes per group: 8192 [ 536.588048] 22:29:45 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000740000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:45 executing program 5: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getsockname$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast1}, &(0x7f0000000080)=0x1c) semget(0xffffffffffffffff, 0x0, 0x0) [ 536.670748] binder: 2740:2753 Acquire 1 refcount change on invalid ref 104 ret -22 [ 536.700273] EXT4-fs (loop0): invalid inodes per group: 8192 [ 536.700273] 22:29:45 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000681000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 536.736352] binder: 2749:2758 got reply transaction with no transaction stack [ 536.745356] binder: 2740:2753 Acquire 1 refcount change on invalid ref 104 ret -22 22:29:45 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x6}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:46 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x7}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:46 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030900ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:29:46 executing program 5: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ppp\x00', 0x80000, 0x0) setsockopt$inet6_buf(r0, 0x29, 0xcc, &(0x7f00000001c0)="d7eadc9c73873edb1cfae557cee66b94a51440cab3d243b2ce6d9422e94d0be2e351b93c57eb8d950fe8af0d0d330dc83ac87c8b62c6779319ba9ee6292e425ecec6ae4b61b8213298696975dce9c02804ec94ce9863c13ab80bf97343753ffe1d7675a057646f6424724b85aa523bd27d73706cf62978c17762f24179723be798d9dc531171fbd94ac0e4fb265d3697e962ec932d3cae29d3a7", 0x9a) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) semget(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$adsp(&(0x7f0000000040)='/dev/adsp#\x00', 0x1, 0x80000) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'gre0\x00', 0x0}) setsockopt$packet_drop_memb(r2, 0x107, 0x2, &(0x7f00000000c0)={r3, 0x1, 0x6}, 0x10) [ 536.951584] binder: 2774:2785 Acquire 1 refcount change on invalid ref 7 ret -22 [ 536.983954] binder: 2778:2787 Acquire 1 refcount change on invalid ref 6 ret -22 22:29:46 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x3000000}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 537.041260] binder: 2778:2787 BC_FREE_BUFFER u0000000000000000 no match [ 537.044918] EXT4-fs (loop0): invalid inodes per group: 8192 [ 537.044918] 22:29:46 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000a1000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:46 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000fdfdffff1000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 537.081734] binder: 2778:2787 ERROR: BC_REGISTER_LOOPER called without request 22:29:46 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) semget(0xffffffffffffffff, 0x0, 0x0) ioctl$SIOCGIFMTU(0xffffffffffffffff, 0x8921, &(0x7f0000000080)) [ 537.159970] EXT4-fs (loop0): invalid inodes per group: 8192 [ 537.159970] 22:29:46 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x54}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:46 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030040ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 537.214081] binder: 2802:2810 Acquire 1 refcount change on invalid ref 50331648 ret -22 [ 537.266732] binder: 2802:2810 Acquire 1 refcount change on invalid ref 50331648 ret -22 22:29:46 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x6800}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 537.342376] binder: 2823:2831 BC_FREE_BUFFER u0000000000000000 no match 22:29:46 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000040)='/dev/input/mouse#\x00', 0x5, 0x200000) getpeername$netlink(r0, &(0x7f0000000100), &(0x7f0000000380)=0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffff9c, 0x0, 0x1b, &(0x7f0000000080)='{bdev/em1GPLproc#mime_type\x00', 0xffffffffffffffff}, 0x30) ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r0, 0xc1105511, &(0x7f0000000240)={{0x0, 0x3, 0x87, 0x80, 'syz1\x00', 0xfffffffffffffffb}, 0x2, 0x8, 0x5, r1, 0x6, 0x2, 'syz0\x00', &(0x7f00000001c0)=['}nodevsecurity\x00', 'system:\x00', 'bdevmime_type\x00', '!md5sumusereth1', 'selinuxsystemppp0\x00', 'usercgroup/cgroup\\\x00'], 0x59, [], [0xfffffffffffffeff, 0x8, 0x49, 0xffff]}) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0xffffffffffff8001) semget(0xffffffffffffffff, 0x0, 0x0) 22:29:46 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000006001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 537.385523] binder: 2823:2831 ERROR: BC_REGISTER_LOOPER called without request [ 537.444280] EXT4-fs (loop0): invalid inodes per group: 8192 [ 537.444280] 22:29:46 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000011000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:46 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x5400}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:46 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4000000}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 537.531742] EXT4-fs (loop0): invalid inodes per group: 8192 [ 537.531742] 22:29:46 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/vhost-vsock\x00', 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x80) accept$nfc_llcp(r1, &(0x7f0000000080), &(0x7f0000000100)=0x60) semget(0xffffffffffffffff, 0x0, 0x0) 22:29:46 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030048ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:29:46 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000074001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:46 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x6000000}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 537.717987] binder: 2860:2874 BC_FREE_BUFFER u0000000000000000 no match [ 537.751601] binder: 2860:2874 ERROR: BC_REGISTER_LOOPER called without request [ 537.825319] EXT4-fs (loop0): invalid inodes per group: 8192 [ 537.825319] 22:29:47 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0xa}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:47 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x7a}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 537.915030] EXT4-fs (loop0): invalid inodes per group: 8192 [ 537.915030] 22:29:47 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000007400001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:47 executing program 5: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_read_part_table(0x400, 0x4, &(0x7f00000012c0)=[{&(0x7f0000000040)="764a116ed9e3275b35d1b093defb207f61ea843a3ffd0404f7c509d34277811c1a0385941dbe697d378a51801f42240075035e69bdfb3f44957422368d1de228cb64d42aae734a1e3797b1cd36d084859e970a44679f11fc22b03c32e20497110cd8dd2ccb64e8ee69f77d7e31b64ee01668b134457506c67eed58a6637db81dd71eda9f57466a179c4a66d9b8cf46de5cf441d565554d919eff0fa1274921154c7d77fbb89e08cee970438ec595406737134aa98989a57ab81eb3f3700cfcac7430cbcb", 0xc4, 0x4}, {&(0x7f00000001c0)="acb4a9c5cb4b9eba1b34a267", 0xc, 0x7}, {&(0x7f0000000200)="a6e80a4ade0f4c0a3cecfb4c6bf7752ec85926bb67059c6caf100bd45381f3561cab0acfb368213ef844ba83257a9038c54902fa87dfb8c1b961474fd36d7a44010fff5fb90d9fbf613bb8e59cdab3e9def43d21fd7a3fe0f462195456f940838310669b43c42b95a04b77e7dec6cb76446969353bc49d8e5930a463e5366f82ef8d15a700ca4c132f03db2d10607c3993d4f081d9bd169bfc320d035d93804ab0fdf185d753f711459e3582eabb3732b84366a139a0e32e0bb1d211", 0xbc, 0xffff}, {&(0x7f00000002c0)="ef37bb8a8953492fa494a230578a02a3e61aa762437dbc2c5f05bbce0ba4e419e49356233b0478179c0678a351d341446067eb4e24f61596f90f414b7db535757a59dc9259901afcba7ea88c97fd3f8be9fd5f56c6065ccfa26816b78f421823bd12acbb58e715843779b3367ede724ebeac90cf6d0df2f7cf22e50ec2acb9bec622d42216f08b6fbd95efdedff7e53202d328c86c2e3d1fe30933334649d1c390de9007cd8f3d12152d89a1be96920e58e9c7cc0870a244e765903bbbb37aa314a7c5ea8f0154f6c332900151789ae240c8501726c9e40052d7fe56add87515f67b7f1933bd5f837cd5a44a25014fef954e3755da1357b977d81a5a83a73acbe7142e4c434984dfbb981159fcd5a110ac8f48b7ac39907b12a82cb43d30682f6e4a0395cc3afb3a5e16539be47456195f59991ca1285d1f7b19bf957b6fade09ba6d103eb6f5def4ec9551fa871f60adacfa76e31599fbb2304a0bed814743a4488062d3f3749ea9438a87eefa28dc1ac47b72674779a08f544765fabaeaa3e8f04a80a5956199eab78e7b05a6066d5f3688a62cff92922ca7a3bd7e829d6f47e0d0f15c4b99a349512d18d5a01b0d660fc8ea112a2e2bf066c4a35ac8e4afa2f96e10c878c951cd4202ad93db53b5a5cd5612631ded5c17107339f01b032a881ff2a8ccf0c65beb33cb6f293cfd6f055d66fe232881359c40059b5b1c144131a2aef82cdc2f11e84ee1d84c3b8e2fe69766d5ef1a62eba4e3d879f6fa4d56c5cbfbe4b92d949f0f84b3b00a4be0925450a4735a3cf988ebba9c7518c6a4ba911719e375123121957add102fb1ca94dc4cab283d5fcf3257c222793b675b5e641955930c17a894450c635f749dab85b54ebeb49abfc63a9f04f06b422d3bc7154026af32bed8e370f6ee8c732ecf30aa67b52cd006eed13aeedc464658fd6e02fd0fbe3f2e9f6e4a07206d3d527b5c0f2de63d61b20883d9dabca61cf72256ee80cb8e68827271939b9a2c8141fdc08a7bf664e197983653eb92fed85f774017d31f87816bd4d925760e51396e7e2347baac897ba0c2c49c8e670fc3c659266cfe5de3d71709a29864ea2174b43cf9cfce2f6f8f36f06d8831529d8373e5cf7a62e60fd5f469df2ecde3fd8180a861634add7e51576da9cc8f6a2e9d91ad400a1c5237bf20253156460f3ec52dc59e0f848c7794ba9dc8af2720855aa35e89162f217f5cc59dbafbd8e7c2468578662768a4c066952f69bec7c7a7227b10926a55880b784a637c2bf44ebeb2879ed1ccbee1f0c1c890d0a50cf046337e0cd8fb1787e3e3c5e5e3cdc030c6dd55c99b0b0d63e2c3c92a51ae84031dfe84961f949f80ba30d650a1d754529b9045d33d1b6a0332c5d23301d5eb0194e77be5d6c0c50c9bfa533182fde2669894eeccc676a0794c77140df180d9338ce3d6ddb61418bbf8c505541c15c9a74cafeed3bf2635d86f0e05330a095d0834ea6953efe33deee7e84888cdaf9adee668d7398b9cd075492dc34070efa207e41894ab308165e39a7f17a358dd97ee936b8af0a2ad710a75603065c1715bd15a5ae97f0740ae7cb943b3cc861780ff6cc0d8d345107cf51099cfb1429ec442eecc93ec3e22235d6dfe0b342efe7287d1f3131d74f30ed8e24871c35f26b869578557422fe8d6926712f2fa264b722d1ff7fe02d925964fb543a3083da5e0496c3e28b42da450a0700a7c5d6f6e01d387ab9a0a5b6e53442b69f710efb6d7cfa4c8dc1cf88d420945f19ec5a3f8b46784c3a6ac903e85f1dca2e9246c61ca28acf1824cdfc3765ea86b068257f8b13670df6f22dce3fa562dbacd992de6d26fc433d235c24ff1b430f17076d6a5a3899976e829ee6be992d08f708eeca94289b745e027415eac57f6a4f2ac75f6fdf3414286c7e2fb2dff6f4b41ec4fe74497b259b4b16d910b54e19c69e2fe266b8d561e97d34ed5601dfbe0441154b76a1e72e0a6a84da7f68cdb04f39ed01082c1d46f74f54f890fa1aeb55ba500be68911573a0631781553688026da319a525f73e854af551b4655e3711a0cb995d7c0777c3567718f84715ac8ad15df4068db29ff1a68eeb864921070529d61c3735a905f2bc3c74a0f66ecc65dd633ce3f586723c57add9a76f32cb0e827f6ab0e8fa9af2c08f97a7c669d59288cce23ca290f602bb1d57dd37691271956820ec0bcf34f5758ec76c74b487040b7f6082497e001a171f512c53348a1334724cb1a73861056cbefab368758d23b1037ccf1feb1e9602b69df1d7e8cf1ab2f42d5f2a7ae718204cdc0bb716b464af5df2099e8137a12d73e7a3797a52e6cf73fc5b3e9077bf7277c67cb457f6447911c0ef9650875a1a32451e2d3faa9e55748e722866da790aa576b57c9a10c668b48298acfbfca0645300889bcaa6c8782f247586804217f4424600311e91eade36e31a4cd8c84096ab8795fd57af6c3c13fcc8596c8f23dde4b11ed3b71f123958c48ebf07ac2900313f7379d8a73e393c99f54d5d0bd98e8796b049c645cdf8b8baecde08f2890599a53de77bad88aab662d2861ecf2ec6e8c1b87da7638ecf04c622cf837acf0fc0ed1aa0901e7e14fb364841fe36dc270f9c9335992628e8e87af1193bfc17a1fcfd70b5452866582d7546f7bcec90d2d27a14407053c59d0aecde859b4a464afd20d651d4d1820dcd44c47952c519d6efb3d957ba7bd35da6199fd4c8175fe960e3a01f84d776c355bb13694d9667716b90e16613e4ad3adb6b7c7569b95130fd90a4a4dbe562a2a89bd7206f45b151d1f41bed7d6700ab66558002dcaee9fb3317b61e2d0ee60c22ee5d38cfb96ef8e4438e12c86ca30b1c248f8a3dcbf4292d6db0b0826c7ab73a173d2fd47b4c9c27b284ba01eb14e152e1cfec8be246ded04bfc0e70d7f699820626e445dc49002e91fc4394068ee69ebcf095160075ada27f1ad984ac8d64eb3bfbdbc576270b7461e3797d05fbe151df2bcec42a9e8a00b70bd5f097b898539963fbb42ebca74994b3ea9ad7b1334a6a27e7fdcf97be2abfa17d62e1f93dbde6e8adca90bfc50259a58ae8d8dd017e5f8e32796cec29380c170de1cda055aa57c0c845dd741ee4144c25acb8888a3014cafe87e3992e1f5d68da253e9791582a85e75c81d99e0cf957cb694084c0a4a22a686800732539756d863064267497c194207a9c2151b1bfdc0e146177f7dd1284adc019d3913e0270bdbd66c217898e4ce664a6d699afd2da5ac148c52f49d2b4292c74ef9facb05e5f50ca534415c868403ea3d69914d07d1aa05bb62d8cac430fac8672e497b48f53f2f04292d357165d1449de5a5eb152c1f896e5e63979fb0377fe86683af7ebbc10ab3f387b472c88da9db92610c0f0d22bce80615340677cee4d34565c778c3f98138267961ce036b71c86807fe33d48d0e1b0fdf3e0a66c1889a070b21d0a359956fdc837b6917c795593fbb5cb31a0341ab688c0ab70fcc46d8f611c64c9815e1300a5ff870c87db28c67b98239dd93dfacb928e36b02131a2ccd6ced35b2c9cfb4e5205791b8d3d71e752e912dd17f213c1dc9e37a65c37da85823561cf50e59b34cdb2e07bd234379b3f222f6894926a919d72f603b6afc5d7c43a4477b63033fb7dcb20f3136eddd6b183b89ddbb66175c999a5db44ff189f19b0cafeaa199667d91bd9d512c91b8f573815c757c095fb5ec762d1442908630bc81f71d52e635e2ffd6699cf8ec48aae1acfa1fd97259c821a3b33a86b216c89621cdf71ba126812678a24ad49374d52e848cb104616fa112486a206372cba38ff8abcb1f56e569c39ffbc7be24f9514e29596773b95484fa7637555a717ef94a2c1913237eca31a122497351b7104c905d04f54690f464b10177f0a5772d6f13b4990f0cb3728898966d47ac1e177cf20645e34057a0cbca183bb94fa199b1f6ef020bee592696c345effec39abe9699681976c196e1564e28def03b5dd55aa8c8b099dc339fbf9b808dd60387953e4cd820fe0f6b4f4901fe5896b23d1f30026f14ede3fdce60d8b2dc645e1107a50d98cd9131b818e34eba077a52c9cbcbd59a8d384be82ad84ed144945eb0f9202dea26a332df39297f2a18fb6446e64376e791f02b7ea79a25a828b625c41ba8169df377fdd604fe4ceba89d133bc1be50777acbe1088b9dd683ae3c640158718fa424cb558db44800624f3347a78a7d00cde51b7227acdb396c3ec5ff3503e0065a393bd00c84e065a79a185725fd75140921fe777eb66dc67f05e2616edf356d4688271e27c352c6a2fd2fcf4626229ec3aa9f79af3324463430024ea8e1550eaa09054c9ac2b2a07a54bc449c91d05ce6002e57f1a1414fbff15ca2c7c58edde2a6447989edc7a30682a0f02f55022b828be9cdc3506fa193b72b6dd0b34dc23040930e1f1b97445218a0e206692bfc298edbeae405f41156772bbdcc7dbeeecc24d75ef5010207ae0daf90bc2d3dc5756589a7729615db8e5c4fe841b2ff7effc44c5642da4034825c77a7afb5b7b5c5879511635396bbea3cd52ecb313540adedf6d541bd78130498f0cceb3114f286c277b28a70b31f6aff472090526c29fbedbe8ecbefcd7feca6c57716fe9901d35154ddf68eab5807f26eabccfa2bfaa0ba255fe61fc9b531a069552c116f2d1812a87d049186f1c26abc53c998754bf72b1e58ce342e9a7e8a8b73cca22b8228bd2c8417cb63d5eaeda57355e8212d61dc47be4b565242c6af96d3d036d84376f2b2f7ec11855e114d2fbf07ac48087166cb406d8f1b88dc4d06cd0782a93dc43b2eed34b6dedc3350dc3aa09c039315a04f72cc3b531cf047b288922625879e65000afeb49c829585103726fa7915e57374f5f6bc981434240f8d0872b56e92eca74a24a3b3f311e7ba89ae54c34f8256b84e2946a250c3648f9efa9706d0cde538dfff190c4a5898f7a0c60c5ffe182af556ebb4efde3865648d06d3c853baeb193d35661575a7a2cb8992be1436f54b4f2ae2f4da9601a505aa6c8a4aa3756b9c2deb84f64d646d056aad9ea11352e46735324d91e941f6b163de46984330129e4505a96d9ad94389c077aca886bb648d3908f7300b6f0245ca71cafc2a4e5f53c575b91dd247a81004b305a31ecb9e10daba3ed8285c401d75e62a4a0bb211e07b7491d54fb8de9baeae5c905346c988c8afe7575930f09578cc70f9e99444f841140d8a120d4ce97a4d2103082de2df89f7c558a3053576408c2826fca0ce413846655d2bcb6092e0405634e5af26fbc765bce7050bb1c9c1f2d951edde5d419c531d58f9c7ee215b1cb885d3f4a4442ee00220bb570729b3ce04d1d464a2d167ed00907e3b874ea6400652c71806425b18759b97d21f4a7a3e4a73d9be8a5cb27e78afc4d2d6d4d1dba2caf7906c41ddeb6498fae5543af09cc19028d6ca96f2a6e66cfbe9881741b64a6f9430efa06a35d22959409eba9fbe10ae7bd8104184c7b45038fddead11c59cc59de573bf3ae53e6f4e73b0fe3d162232bc30741b146b41309b921893e60d5b764237d069aeafa22c54d944526851dadeb811734ea09413bd4147d663ea60ed9e5ac6db024498664f51c1a420b9b026647afae0d9cb9b7d2469f034f57eecd43097626c0fafc761ee3979d12d9962ea93f820de142f7d43981b56e8ec6a5ef56d668d2ecf0dd7a63a48407a77b381423f2339f4af42e37d84b540673f4fae4719b648d997c8238515c4a34b145618f574e5b4bf5067ffcb69ac7f8da8f9cf029af63076", 0x1000, 0x7}]) r1 = syz_open_dev$admmidi(&(0x7f0000001600)='/dev/admmidi#\x00', 0x7c1, 0x400) ioctl$VIDIOC_ENUM_FREQ_BANDS(r1, 0xc0405665, &(0x7f0000001380)={0x80000001, 0x4, 0x101, 0x4, 0x5, 0x7, 0xc}) semget(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000001400)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000013c0)={0xffffffffffffffff}, 0x13f, 0xb}}, 0x20) write$RDMA_USER_CM_CMD_REJECT(r1, &(0x7f0000001440)={0x9, 0x108, 0xfa00, {r2, 0x13, "619a1c", "98c41f2d448ca1d4b55d18ecb919a178feb53997fad1a8d4bf544430180abb940a74a580a90eaadba836e0e3a843e784419db1a7181480dcf6f33ed9c2a9a7c417d49dc80bec60b8db57df01aa8670e31a62b847942af4c5d4854a6d06187ea6083b208aebb6a7cb77d444ba858a12de2d80b1e024352b55ad4dda230baf87b623e7d1745d494e9bd320ef785372132ba3521a91614abd9187edb5663c21f72c4317b205f8bc90c305ced1254b24330e823613012bb0f356246746b630c2a5454b6be21bf046876698d2ac052e23daba9d28661d27b2d463bd6607d0a6495f8b0e57d67228f669b86d6bdf0d4f378a5034cef913f9a98532bc9d3ad096f53f4b"}}, 0x110) r3 = shmget$private(0x0, 0x4000, 0x18, &(0x7f0000ffb000/0x4000)=nil) shmctl$IPC_RMID(r3, 0x0) restart_syscall() [ 538.004810] binder: 2901:2903 BC_FREE_BUFFER u0000000000000000 no match 22:29:47 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc803002dec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:29:47 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000007001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 538.085425] binder: 2901:2903 ERROR: BC_REGISTER_LOOPER called without request 22:29:47 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x100000000000000}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:47 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x2}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 538.183060] EXT4-fs (loop0): invalid inodes per group: 8192 [ 538.183060] [ 538.251236] EXT4-fs (loop0): invalid inodes per group: 8192 [ 538.251236] 22:29:47 executing program 5: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) semget(0xffffffffffffffff, 0x3, 0x442) fcntl$getownex(r0, 0x10, &(0x7f0000000040)={0x0, 0x0}) ptrace$peek(0x1, r3, &(0x7f0000000080)) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x10010, r1, 0x0) 22:29:47 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000002000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 538.309771] binder: 2945:2947 BC_FREE_BUFFER u0000000000000000 no match [ 538.342522] binder: 2945:2947 ERROR: BC_REGISTER_LOOPER called without request 22:29:47 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x2000000000000000}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:47 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8032d00ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:29:47 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000006c1000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 538.417331] binder: 2945:2947 BC_FREE_BUFFER u0000000000000000 no match [ 538.433889] binder: 2945:2947 ERROR: BC_REGISTER_LOOPER called without request 22:29:47 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x5}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:47 executing program 5: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = msgget(0x2, 0x65) fstat(r0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r0, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r0, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f00000003c0)=0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000400)={0x0}, &(0x7f0000000440)=0xc) msgctl$IPC_SET(r1, 0x1, &(0x7f0000000480)={{0x9, r2, r3, r4, r5, 0x0, 0x6}, 0xffffffffffff8001, 0x1f, 0x5, 0x0, 0x6, 0xa75d, r6, r7}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r9, 0x8912, 0x400200) r10 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dsp\x00', 0x400, 0x0) ioctl$TIOCMBIC(r10, 0x5417, &(0x7f0000000080)=0x9) fsetxattr(r8, &(0x7f00000000c0)=@known='system.sockprotoname\x00', &(0x7f0000000100)="706f7369785f61636c5f616363657373a0656d3129d16370757365746b657972696e67626465767b286c6f747275737465646370757365746370757365742900", 0x40, 0x3) semget(0xffffffffffffffff, 0x0, 0x0) [ 538.537427] EXT4-fs (loop0): invalid inodes per group: 8192 [ 538.537427] 22:29:47 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4d}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 538.644637] EXT4-fs (loop0): invalid inodes per group: 8192 [ 538.644637] [ 538.668161] binder: 2994:2995 BC_FREE_BUFFER u0000000000000000 no match [ 538.679198] binder_transaction: 66 callbacks suppressed [ 538.679215] binder: 2992:2996 transaction failed 29201/-22, size 0-0 line 2834 22:29:47 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000601000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 538.684972] binder: 2955:2963 transaction failed 29189/-22, size 0-0 line 2834 [ 538.717969] binder: 2994:2995 ERROR: BC_REGISTER_LOOPER called without request 22:29:47 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030700ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:29:47 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000003f00001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:47 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x56}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:47 executing program 5: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = msgget(0x2, 0x65) fstat(r0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r0, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r0, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f00000003c0)=0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000400)={0x0}, &(0x7f0000000440)=0xc) msgctl$IPC_SET(r1, 0x1, &(0x7f0000000480)={{0x9, r2, r3, r4, r5, 0x0, 0x6}, 0xffffffffffff8001, 0x1f, 0x5, 0x0, 0x6, 0xa75d, r6, r7}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r9, 0x8912, 0x400200) r10 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dsp\x00', 0x400, 0x0) ioctl$TIOCMBIC(r10, 0x5417, &(0x7f0000000080)=0x9) fsetxattr(r8, &(0x7f00000000c0)=@known='system.sockprotoname\x00', &(0x7f0000000100)="706f7369785f61636c5f616363657373a0656d3129d16370757365746b657972696e67626465767b286c6f747275737465646370757365746370757365742900", 0x40, 0x3) semget(0xffffffffffffffff, 0x0, 0x0) 22:29:47 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x300000000000000}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 538.808675] binder: 3001:3004 transaction failed 29189/-22, size 0-0 line 2834 [ 538.822061] binder: 3001:3007 transaction failed 29189/-22, size 0-0 line 2834 [ 538.871083] binder: 3008:3021 BC_FREE_BUFFER u0000000000000000 no match 22:29:48 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000481000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 538.920890] binder: 3015:3031 transaction failed 29201/-22, size 0-0 line 2834 [ 538.939183] EXT4-fs (loop0): invalid inodes per group: 8192 [ 538.939183] [ 538.946661] binder: 3008:3021 ERROR: BC_REGISTER_LOOPER called without request 22:29:48 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x3}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:48 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0xa00000000000000}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 538.993515] binder: 3010:3023 transaction failed 29189/-22, size 0-0 line 2834 [ 539.004496] EXT4-fs (loop0): invalid inodes per group: 8192 [ 539.004496] 22:29:48 executing program 5: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = msgget(0x2, 0x65) fstat(r0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r0, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r0, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f00000003c0)=0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000400)={0x0}, &(0x7f0000000440)=0xc) msgctl$IPC_SET(r1, 0x1, &(0x7f0000000480)={{0x9, r2, r3, r4, r5, 0x0, 0x6}, 0xffffffffffff8001, 0x1f, 0x5, 0x0, 0x6, 0xa75d, r6, r7}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r9, 0x8912, 0x400200) r10 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dsp\x00', 0x400, 0x0) ioctl$TIOCMBIC(r10, 0x5417, &(0x7f0000000080)=0x9) fsetxattr(r8, &(0x7f00000000c0)=@known='system.sockprotoname\x00', &(0x7f0000000100)="706f7369785f61636c5f616363657373a0656d3129d16370757365746b657972696e67626465767b286c6f747275737465646370757365746370757365742900", 0x40, 0x3) semget(0xffffffffffffffff, 0x0, 0x0) [ 539.087361] binder: 3050:3056 transaction failed 29201/-22, size 0-0 line 2834 [ 539.113452] binder: 3044:3059 transaction failed 29189/-22, size 0-0 line 2834 [ 539.123769] binder: 3051:3058 BC_FREE_BUFFER u0000000000000000 no match 22:29:48 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030600ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 539.137773] binder_release_work: 65 callbacks suppressed [ 539.137779] binder: undelivered TRANSACTION_ERROR: 29201 [ 539.148058] binder: 3051:3058 ERROR: BC_REGISTER_LOOPER called without request 22:29:48 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x3f000000}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 539.196583] binder: 3044:3065 transaction failed 29189/-22, size 0-0 line 2834 [ 539.210322] binder: 3010:3068 transaction failed 29189/-22, size 0-0 line 2834 [ 539.232840] binder: undelivered TRANSACTION_ERROR: 29189 [ 539.239033] binder: undelivered TRANSACTION_ERROR: 29189 [ 539.271519] binder: undelivered TRANSACTION_ERROR: 29189 [ 539.304662] binder: undelivered TRANSACTION_ERROR: 29189 22:29:48 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000201000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:48 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000050000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:48 executing program 5: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = msgget(0x2, 0x65) fstat(r0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r0, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r0, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f00000003c0)=0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000400)={0x0}, &(0x7f0000000440)=0xc) msgctl$IPC_SET(r1, 0x1, &(0x7f0000000480)={{0x9, r2, r3, r4, r5, 0x0, 0x6}, 0xffffffffffff8001, 0x1f, 0x5, 0x0, 0x6, 0xa75d, r6, r7}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r9, 0x8912, 0x400200) r10 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dsp\x00', 0x400, 0x0) ioctl$TIOCMBIC(r10, 0x5417, &(0x7f0000000080)=0x9) fsetxattr(r8, &(0x7f00000000c0)=@known='system.sockprotoname\x00', &(0x7f0000000100)="706f7369785f61636c5f616363657373a0656d3129d16370757365746b657972696e67626465767b286c6f747275737465646370757365746370757365742900", 0x40, 0x3) 22:29:48 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x5}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 539.324613] binder: undelivered TRANSACTION_ERROR: 29201 [ 539.336951] EXT4-fs (loop0): invalid inodes per group: 8192 [ 539.336951] 22:29:48 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x300}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 539.423475] binder: 3085:3089 BC_FREE_BUFFER u0000000000000000 no match [ 539.450203] EXT4-fs (loop0): invalid inodes per group: 8192 [ 539.450203] [ 539.463632] binder: undelivered TRANSACTION_ERROR: 29201 22:29:48 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x6c}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:48 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030023ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 539.520280] binder: undelivered TRANSACTION_ERROR: 29189 [ 539.525970] binder: undelivered TRANSACTION_ERROR: 29189 22:29:48 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000003001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:48 executing program 5: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = msgget(0x2, 0x65) fstat(r0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r0, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r0, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f00000003c0)=0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000400)={0x0}, &(0x7f0000000440)=0xc) msgctl$IPC_SET(r1, 0x1, &(0x7f0000000480)={{0x9, r2, r3, r4, r5, 0x0, 0x6}, 0xffffffffffff8001, 0x1f, 0x5, 0x0, 0x6, 0xa75d, r6, r7}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) r9 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dsp\x00', 0x400, 0x0) ioctl$TIOCMBIC(r9, 0x5417, &(0x7f0000000080)=0x9) 22:29:48 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x7}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 539.600801] binder: undelivered TRANSACTION_ERROR: 29201 22:29:48 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 539.674980] EXT4-fs (loop0): invalid inodes per group: 8192 [ 539.674980] 22:29:48 executing program 5: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = msgget(0x2, 0x65) fstat(r0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r0, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r0, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f00000003c0)=0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000400)={0x0}, &(0x7f0000000440)=0xc) msgctl$IPC_SET(r1, 0x1, &(0x7f0000000480)={{0x9, r2, r3, r4, r5, 0x0, 0x6}, 0xffffffffffff8001, 0x1f, 0x5, 0x0, 0x6, 0xa75d, r6, r7}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) openat$dsp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dsp\x00', 0x400, 0x0) [ 539.763282] EXT4-fs (loop0): invalid inodes per group: 8192 [ 539.763282] 22:29:49 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000030000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:49 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x7a00000000000000}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:49 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x12}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:49 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000012001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:49 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc803004cec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:29:49 executing program 5: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = msgget(0x2, 0x65) fstat(r0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r0, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r0, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f00000003c0)=0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000400)={0x0}, &(0x7f0000000440)=0xc) msgctl$IPC_SET(r1, 0x1, &(0x7f0000000480)={{0x9, r2, r3, r4, r5, 0x0, 0x6}, 0xffffffffffff8001, 0x1f, 0x5, 0x0, 0x6, 0xa75d, r6, r7}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) 22:29:49 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x20000000}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:49 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x5600}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 540.013434] EXT4-fs (loop0): invalid inodes per group: 8192 [ 540.013434] [ 540.023900] binder_transaction: 25 callbacks suppressed [ 540.023910] binder: 3153:3168 got transaction to invalid handle 22:29:49 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000004c001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 540.107080] binder: 3174:3176 got transaction to invalid handle [ 540.126806] EXT4-fs (loop0): invalid inodes per group: 8192 [ 540.126806] 22:29:49 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0xa000000}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:49 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030005ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:29:49 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4d00}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 540.284735] binder: 3194:3195 got transaction to invalid handle 22:29:49 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000061000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:49 executing program 5: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = msgget(0x2, 0x65) fstat(r0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r0, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r0, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f00000003c0)=0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000400)={0x0}, &(0x7f0000000440)=0xc) msgctl$IPC_SET(r1, 0x1, &(0x7f0000000480)={{0x9, r2, r3, r4, r5, 0x0, 0x6}, 0xffffffffffff8001, 0x1f, 0x5, 0x0, 0x6, 0xa75d, r6, r7}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) [ 540.332452] EXT4-fs (loop0): invalid inodes per group: 8192 [ 540.332452] 22:29:49 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer={0x40086312}, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:49 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x68000000}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:49 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000068001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 540.402252] EXT4-fs (loop0): invalid inodes per group: 8192 [ 540.402252] 22:29:49 executing program 5: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = msgget(0x2, 0x65) fstat(r0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r0, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r0, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f00000003c0)=0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000400)={0x0}, &(0x7f0000000440)=0xc) msgctl$IPC_SET(r1, 0x1, &(0x7f0000000480)={{0x9, r2, r3, r4, r5, 0x0, 0x6}, 0xffffffffffff8001, 0x1f, 0x5, 0x0, 0x6, 0xa75d, r6, r7}) 22:29:49 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030020ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 540.523268] binder: 3226:3228 unknown command 1074291474 [ 540.531602] binder: 3224:3229 got transaction to invalid handle [ 540.569943] binder: 3226:3228 ioctl c0306201 20000140 returned -22 [ 540.602062] EXT4-fs (loop0): invalid inodes per group: 8192 [ 540.602062] 22:29:49 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer={0x40106309}, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:49 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4800}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:49 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000007fffffff1000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 540.695883] EXT4-fs (loop0): invalid inodes per group: 8192 [ 540.695883] 22:29:49 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000741000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:49 executing program 5: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = msgget(0x2, 0x65) fstat(r0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r0, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r0, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f00000003c0)=0x0) msgctl$IPC_SET(r1, 0x1, &(0x7f0000000480)={{0x9, r2, r3, r4, r5, 0x0, 0x6}, 0xffffffffffff8001, 0x1f, 0x5, 0x0, 0x6, 0xa75d, r6}) 22:29:50 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8032300ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 540.811902] binder_thread_write: 32 callbacks suppressed [ 540.811918] binder: 3258:3261 Acquire 1 refcount change on invalid ref 18432 ret -22 22:29:50 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer={0x40086310}, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:50 executing program 5: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = msgget(0x2, 0x65) fstat(r0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r0, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r0, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) msgctl$IPC_SET(r1, 0x1, &(0x7f0000000480)={{0x9, r2, r3, r4, r5, 0x0, 0x6}, 0xffffffffffff8001, 0x1f, 0x5, 0x0, 0x6, 0xa75d}) [ 540.890950] binder: 3258:3261 got transaction to invalid handle [ 540.913232] binder: 3256:3280 got transaction to invalid handle [ 540.960820] binder: 3258:3261 Acquire 1 refcount change on invalid ref 18432 ret -22 [ 540.966482] EXT4-fs (loop0): invalid inodes per group: 8192 [ 540.966482] 22:29:50 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000031000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 541.005704] binder: 3287:3289 Acquire 1 refcount change on invalid ref 4 ret -22 [ 541.017462] binder: 3258:3261 got transaction to invalid handle 22:29:50 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x1200}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 541.048998] EXT4-fs (loop0): invalid inodes per group: 8192 [ 541.048998] [ 541.050939] binder: 3287:3289 BC_DEAD_BINDER_DONE 0000000000000000 not found 22:29:50 executing program 5: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = msgget(0x2, 0x65) fstat(r0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r0, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) msgctl$IPC_SET(r1, 0x1, &(0x7f0000000480)={{0x9, r2, r3, r4, 0x0, 0x0, 0x6}, 0xffffffffffff8001, 0x1f, 0x5, 0x0, 0x6, 0xa75d}) 22:29:50 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000601000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 541.141065] binder: 3287:3289 Acquire 1 refcount change on invalid ref 4 ret -22 [ 541.156682] binder: 3287:3289 BC_DEAD_BINDER_DONE 0000000000000000 not found 22:29:50 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030800ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 541.192426] binder: 3311:3312 Acquire 1 refcount change on invalid ref 4608 ret -22 [ 541.214288] binder_thread_write: 6 callbacks suppressed [ 541.214299] binder: 3287:3289 ERROR: BC_REGISTER_LOOPER called without request 22:29:50 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000007a1000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 541.268559] binder: 3311:3312 got transaction to invalid handle [ 541.288185] EXT4-fs (loop0): invalid inodes per group: 8192 [ 541.288185] 22:29:50 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer={0x40106308}, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:50 executing program 5: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = msgget(0x2, 0x65) fstat(r0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r0, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) msgctl$IPC_SET(r1, 0x1, &(0x7f0000000480)={{0x9, r2, r3, 0x0, 0x0, 0x0, 0x6}, 0xffffffffffff8001, 0x1f, 0x5, 0x0, 0x6, 0xa75d}) 22:29:50 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x7400}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 541.410021] binder: 3340:3344 Acquire 1 refcount change on invalid ref 4 ret -22 22:29:50 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000004800001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:50 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030400ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 541.465322] binder: 3340:3344 BC_INCREFS_DONE u0000000000000000 no match [ 541.488105] binder: 3354:3355 Acquire 1 refcount change on invalid ref 29696 ret -22 22:29:50 executing program 5: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = msgget(0x2, 0x65) fstat(r0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) msgctl$IPC_SET(r1, 0x1, &(0x7f0000000480)={{0x9, r2, 0x0, 0x0, 0x0, 0x0, 0x6}, 0xffffffffffff8001, 0x1f, 0x5, 0x0, 0x6, 0xa75d}) [ 541.520429] binder: 3340:3344 Acquire 1 refcount change on invalid ref 4 ret -22 [ 541.528046] binder: 3340:3344 BC_INCREFS_DONE u0000000000000000 no match [ 541.529689] binder: 3354:3355 got transaction to invalid handle 22:29:50 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000000a001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 541.583348] EXT4-fs (loop0): invalid inodes per group: 8192 [ 541.583348] 22:29:50 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer={0x630d}, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:50 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x3f00000000000000}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 541.714347] EXT4-fs (loop0): invalid inodes per group: 8192 [ 541.714347] [ 541.726658] binder: 3379:3387 Acquire 1 refcount change on invalid ref 4 ret -22 [ 541.749873] binder: 3379:3387 unknown command 0 22:29:50 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = msgget(0x2, 0x65) msgctl$IPC_SET(r0, 0x1, &(0x7f0000000480)={{0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0xffffffffffff8001, 0x1f, 0x5, 0x0, 0x6, 0xa75d}) [ 541.759939] binder: 3379:3387 ioctl c0306201 20000140 returned -22 [ 541.782591] binder: 3390:3395 Acquire 1 refcount change on invalid ref 0 ret -22 22:29:51 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000006c1000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:51 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer={0x40046302}, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 541.816480] binder: 3390:3395 got transaction to invalid handle 22:29:51 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030060ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:29:51 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000004001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:51 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) msgctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0xffffffffffff8001, 0x1f, 0x5, 0x0, 0x6, 0xa75d}) 22:29:51 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x7400000000000000}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 541.966676] binder: BC_ACQUIRE_RESULT not supported [ 541.981486] binder: 3407:3413 ioctl c0306201 20000140 returned -22 [ 542.048719] EXT4-fs (loop0): invalid inodes per group: 8192 [ 542.048719] 22:29:51 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer={0x40046304}, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:51 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000004c1000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 542.106014] EXT4-fs (loop0): invalid inodes per group: 8192 [ 542.106014] 22:29:51 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x6c000000}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:51 executing program 5: msgctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0xffffffffffff8001, 0x1f, 0x5, 0x0, 0x6, 0xa75d}) 22:29:51 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030300ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 542.219398] binder: 3442:3445 unknown command 0 22:29:51 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000121000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 542.268661] binder: 3442:3445 ioctl c0306201 20000140 returned -22 22:29:51 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x6c00}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 542.338742] EXT4-fs (loop0): invalid inodes per group: 8192 [ 542.338742] 22:29:51 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer={0x40086363}, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:51 executing program 5: msgctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0xffffffffffff8001, 0x1f, 0x5, 0x0, 0x6, 0xa75d}) 22:29:51 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000048001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 542.441969] EXT4-fs (loop0): invalid inodes per group: 8192 [ 542.441969] 22:29:51 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4c}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:51 executing program 5: msgctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0xffffffffffff8001, 0x1f, 0x5, 0x0, 0x6, 0xa75d}) [ 542.518538] binder: 3480:3483 unknown command 1074291555 [ 542.547235] binder: 3480:3483 ioctl c0306201 20000140 returned -22 22:29:51 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030007ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:29:51 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer={0x40086354}, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:51 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000007a1000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:51 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000071000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:51 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x600000000000000}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:51 executing program 5: perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) msgctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0xffffffffffff8001, 0x1f, 0x5, 0x0, 0x6, 0xa75d}) [ 542.748570] EXT4-fs (loop0): invalid inodes per group: 8192 [ 542.748570] [ 542.786872] binder: 3507:3519 unknown command 1074291540 22:29:52 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x7a000000}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 542.833340] binder: 3507:3519 ioctl c0306201 20000140 returned -22 [ 542.863332] EXT4-fs (loop0): invalid inodes per group: 8192 [ 542.863332] 22:29:52 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x7a00}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:52 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc803007aec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:29:52 executing program 5: perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) msgctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0xffffffffffff8001, 0x1f, 0x5, 0x0, 0x6, 0xa75d}) 22:29:52 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000061000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:52 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer={0x400c630f}, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:52 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000007a00001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:52 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x74}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 543.161675] binder: 3559:3567 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 543.191867] EXT4-fs (loop0): invalid inodes per group: 8192 [ 543.191867] 22:29:52 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000005001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:52 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer={0x40486311}, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:52 executing program 5: perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) msgctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0xffffffffffff8001, 0x1f, 0x5, 0x0, 0x6, 0xa75d}) [ 543.298051] EXT4-fs (loop0): invalid inodes per group: 8192 [ 543.298051] 22:29:52 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x12000000}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:52 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8036c00ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:29:52 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000006000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:52 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) msgctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0xffffffffffff8001, 0x1f, 0x5, 0x0, 0x6, 0xa75d}) 22:29:52 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer={0x40406300}, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:52 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x2000000}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:52 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000006c001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 543.576116] EXT4-fs (loop0): invalid inodes per group: 8192 [ 543.576116] 22:29:52 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer={0x40086302}, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:52 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) msgctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0xffffffffffff8001, 0x1f, 0x5, 0x0, 0x6, 0xa75d}) 22:29:52 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030a00ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:29:52 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4800000000000000}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 543.752300] binder_transaction: 74 callbacks suppressed [ 543.752355] binder: 3631:3633 transaction failed 29189/-22, size 0-0 line 2834 [ 543.776423] EXT4-fs (loop0): invalid inodes per group: 8192 [ 543.776423] [ 543.787777] binder: 3640:3645 transaction failed 29201/-22, size 0-0 line 2834 22:29:53 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000a00001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 543.803531] binder: 3647:3650 unknown command 1074291458 [ 543.823212] binder: 3647:3650 ioctl c0306201 20000140 returned -22 22:29:53 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) msgctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0xffffffffffff8001, 0x1f, 0x5, 0x0, 0x6, 0xa75d}) 22:29:53 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x3f00}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:53 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer={0x4008634d}, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 543.882010] EXT4-fs (loop0): invalid inodes per group: 8192 [ 543.882010] [ 543.890509] binder: 3631:3662 transaction failed 29189/-22, size 0-0 line 2834 [ 543.958857] binder: 3656:3671 transaction failed 29189/-22, size 0-0 line 2834 [ 543.996855] binder: 3673:3674 transaction failed 29201/-22, size 0-0 line 2834 22:29:53 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8034800ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:29:53 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000121000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 544.005240] binder: 3675:3676 unknown command 1074291533 [ 544.017401] binder: 3675:3676 ioctl c0306201 20000140 returned -22 22:29:53 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x700000000000000}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:53 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer={0x400c630e}, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:53 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) msgctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0xffffffffffff8001, 0x1f, 0x5, 0x0, 0x6, 0xa75d}) [ 544.124132] EXT4-fs (loop0): invalid inodes per group: 8192 [ 544.124132] [ 544.135237] binder: 3656:3663 transaction failed 29189/-22, size 0-0 line 2834 [ 544.145347] binder: 3682:3691 transaction failed 29189/-22, size 0-0 line 2834 [ 544.169762] binder_release_work: 73 callbacks suppressed [ 544.169769] binder: undelivered TRANSACTION_ERROR: 29189 [ 544.193149] binder: undelivered TRANSACTION_ERROR: 29189 22:29:53 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000007a0000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 544.233963] binder: 3698:3701 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 544.235005] binder: 3696:3697 transaction failed 29201/-22, size 0-0 line 2834 [ 544.258966] binder: undelivered TRANSACTION_ERROR: 29201 22:29:53 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x500000000000000}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 544.286859] binder: 3682:3706 transaction failed 29189/-22, size 0-0 line 2834 [ 544.297572] EXT4-fs (loop0): invalid inodes per group: 8192 [ 544.297572] 22:29:53 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) msgctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{}, 0xffffffffffff8001, 0x1f, 0x5, 0x0, 0x6, 0xa75d}) 22:29:53 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer={0x630b}, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 544.354064] binder: undelivered TRANSACTION_ERROR: 29189 [ 544.355227] binder: 3713:3714 transaction failed 29201/-22, size 0-0 line 2834 [ 544.359940] binder: undelivered TRANSACTION_ERROR: 29189 22:29:53 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8034c00ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:29:53 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x6000000000000000}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:53 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000051000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 544.445522] binder: undelivered TRANSACTION_ERROR: 29201 [ 544.472254] binder: 3725:3726 ERROR: BC_REGISTER_LOOPER called without request [ 544.479279] binder: undelivered TRANSACTION_ERROR: 29201 [ 544.572590] binder: 3725:3726 unknown command 0 22:29:53 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) msgctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{}, 0x0, 0x1f, 0x5, 0x0, 0x6, 0xa75d}) 22:29:53 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000120000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 544.599754] binder: undelivered TRANSACTION_ERROR: 29201 [ 544.605375] binder: undelivered TRANSACTION_ERROR: 29201 [ 544.631873] binder: 3725:3726 ioctl c0306201 20000140 returned -22 [ 544.635890] binder: undelivered TRANSACTION_ERROR: 29189 22:29:53 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000060001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 544.669865] binder: 3725:3726 ERROR: BC_REGISTER_LOOPER called without request [ 544.707415] binder: 3725:3726 unknown command 0 22:29:53 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer={0x4008630a}, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 544.719852] binder: 3725:3726 ioctl c0306201 20000140 returned -22 22:29:54 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x200000000000000}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 544.878737] EXT4-fs (loop0): invalid inodes per group: 8192 [ 544.878737] [ 544.899762] binder: BC_ATTEMPT_ACQUIRE not supported [ 544.904936] binder: 3761:3765 ioctl c0306201 20000140 returned -22 [ 544.921603] EXT4-fs (loop0): invalid inodes per group: 8192 [ 544.921603] 22:29:54 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) msgctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{}, 0x0, 0x0, 0x5, 0x0, 0x6, 0xa75d}) 22:29:54 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000007a001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:54 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030004ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:29:54 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer={0x40046307}, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 545.064929] binder_transaction: 22 callbacks suppressed [ 545.064962] binder: 3780:3783 got transaction to invalid handle [ 545.101981] EXT4-fs (loop0): invalid inodes per group: 8192 [ 545.101981] 22:29:54 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0xa00}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 545.137510] binder: 3795:3796 unknown command 0 22:29:54 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) msgctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{}, 0x0, 0x0, 0x0, 0x0, 0x6, 0xa75d}) [ 545.158519] binder: 3795:3796 ioctl c0306201 20000140 returned -22 [ 545.173748] binder: 3762:3804 got transaction to invalid handle [ 545.182616] EXT4-fs (loop0): invalid inodes per group: 8192 [ 545.182616] 22:29:54 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer={0x40406301}, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:54 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000002001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:54 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000a0000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:54 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030068ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 545.256468] binder: 3810:3811 got transaction to invalid handle 22:29:54 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0xffffff7f}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 545.318251] binder: 3816:3817 got reply transaction with no transaction stack 22:29:54 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) msgctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)={{}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa75d}) 22:29:54 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer={0x40086309}, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 545.439144] EXT4-fs (loop0): invalid inodes per group: 8192 [ 545.439144] [ 545.447056] binder: 3820:3821 got transaction to invalid handle [ 545.456675] binder: 3828:3838 got transaction to invalid handle 22:29:54 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001200000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:54 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x500}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 545.553279] EXT4-fs (loop0): invalid inodes per group: 8192 [ 545.553279] [ 545.571153] binder: 3849:3850 unknown command 1074291465 22:29:54 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) msgctl$IPC_SET(0x0, 0x1, &(0x7f0000000480)) [ 545.609615] binder: 3849:3850 ioctl c0306201 20000140 returned -22 [ 545.618177] binder: 3857:3858 got transaction to invalid handle [ 545.625290] binder: 3820:3859 got transaction to invalid handle 22:29:54 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000fffffdfd1000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:54 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x6000}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:54 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc803000aec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:29:54 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer={0x40086356}, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:54 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000300000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:55 executing program 5: unshare(0x24020400) mknod(&(0x7f0000000080)='./file0\x00', 0x103c, 0x0) execve(&(0x7f0000001500)='./file0\x00', &(0x7f00000016c0), &(0x7f0000000180)) fcntl$getown(0xffffffffffffffff, 0x9) gettid() ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000000200)=0x0) r1 = syz_open_procfs(r0, &(0x7f00000001c0)='personality\x00') preadv(r1, &(0x7f0000000100)=[{&(0x7f0000000480)=""/4096, 0x3}], 0x1, 0x0) lseek(r1, 0x0, 0x1) open(&(0x7f0000000000)='./file0\x00', 0x401, 0x0) getsockopt$IPT_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x0, 0x42, &(0x7f00000000c0)={'NETMAP\x00'}, &(0x7f0000000140)=0x1e) ioctl$FS_IOC_GETFSMAP(r1, 0xc0c0583b, &(0x7f0000001540)={0x0, 0x0, 0x5, 0x0, [], [{0x3, 0x0, 0x4, 0x6, 0x9, 0x80000001}, {0x0, 0x8119, 0x0, 0x0, 0x81}], [[], [], [], [], []]}) [ 545.840632] binder_thread_write: 42 callbacks suppressed [ 545.840648] binder: 3879:3885 Acquire 1 refcount change on invalid ref 24576 ret -22 [ 545.868762] binder: 3873:3875 got transaction to invalid handle [ 545.872640] binder: 3879:3885 got transaction to invalid handle [ 545.895440] binder: 3889:3892 Acquire 1 refcount change on invalid ref 4 ret -22 [ 545.928921] binder: 3889:3892 unknown command 1074291542 22:29:55 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000006c1000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 545.943913] binder: 3889:3892 ioctl c0306201 20000140 returned -22 [ 545.946636] EXT4-fs (loop0): invalid inodes per group: 8192 [ 545.946636] 22:29:55 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer={0x40486312}, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:55 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x2000}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 546.036059] EXT4-fs (loop0): invalid inodes per group: 8192 [ 546.036059] [ 546.056821] binder: 3912:3913 Acquire 1 refcount change on invalid ref 4 ret -22 [ 546.065028] binder: 3873:3914 got transaction to invalid handle 22:29:55 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000500001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:55 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer={0x630c}, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 546.113724] binder: 3912:3913 got reply transaction with no transaction stack [ 546.149427] binder: 3920:3923 Acquire 1 refcount change on invalid ref 8192 ret -22 22:29:55 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc803007aec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:29:55 executing program 5: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23}, 0x1c) setsockopt$inet_sctp6_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x14) listen(r0, 0x20009) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl(r2, 0x20000000008912, &(0x7f00000001c0)="0a5c2d0240316285717070") r3 = socket$inet6_udplite(0xa, 0x2, 0x88) recvmmsg(r3, &(0x7f0000005540)=[{{&(0x7f0000003c00)=@nfc_llcp, 0x80, &(0x7f0000003dc0)=[{&(0x7f0000003c80)=""/150, 0x96}, {&(0x7f0000003d40)=""/100, 0x64}], 0x2, &(0x7f0000003e00)=""/248, 0xf8, 0x6}, 0xffff}, {{&(0x7f0000003f00)=@hci, 0x80, &(0x7f00000042c0)=[{&(0x7f0000003f80)=""/235, 0xeb}, {&(0x7f0000004080)=""/124, 0x7c}, {&(0x7f0000004100)=""/74, 0x4a}, {&(0x7f0000004180)=""/90, 0x5a}, {&(0x7f0000004200)=""/45, 0x2d}, {&(0x7f0000004240)=""/104, 0x68}], 0x6, &(0x7f0000004340)=""/3, 0x3, 0xc00000000000000}, 0x3}, {{&(0x7f0000004380)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}}}, 0x80, &(0x7f0000004500)=[{&(0x7f0000004400)=""/246, 0xf6}], 0x1, &(0x7f0000004540)=""/4096, 0x1000, 0x7}, 0x4825}], 0x3, 0x10000, 0x0) setsockopt$inet_udp_int(r4, 0x11, 0x6f, &(0x7f0000005600)=0x100000000, 0x4) ioctl(r3, 0x20000000008912, &(0x7f00000001c0)="0a5c2d0240316285717070") bpf$MAP_CREATE(0x0, &(0x7f0000346fd4)={0x0, 0x0, 0x0, 0x8dc, 0x20}, 0x2c) r5 = getpid() getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0}, &(0x7f0000000080)=0xc) r7 = getgid() setsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f00000000c0)={r5, r6, r7}, 0xc) r8 = socket(0x400000000010, 0x3, 0x0) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r8, 0x84, 0x6c, &(0x7f0000001780)={0x0, 0xe3, "bc93a88e1c622bc9cd0e3d57e3d166ee1fa84fd3f9d024fb444095589b367307b3ae720211ceacca3c96bf7541a1dfc677f11f2154e9ed450feb9bed5298edc76f9a04d6f27a2c150f5b98b6de2f323e5172efa6796f5fe2c986a6f42f7c8192f9902bb112eeb4b57f7301e484a0c55f080013221a2a1e52a57d4b351e6f5787fb9542dd8a82a71130bfda801eb7bdb19504b0d4901b529cc8f62350678f2da88a2ddba025150313b491544e91d254bcf4d2b46a7c734c4a8eb968a5e66c5e7e4f87b53e5030ee9f9c8a1a8689c5168b79f423a3516e40c8185f88778280ae6862bdb3"}, &(0x7f0000000400)=0xeb) getsockopt$IP6T_SO_GET_ENTRIES(r2, 0x29, 0x41, &(0x7f0000001540)={'nat\x00', 0xec, "eb88cd90e3922f6ef61babb81c5eaa0b1fa77f75ff964e7511aa437fcf89ad469d62919bf005f40cdf20738711b2d9feac9e13cf40897e00a4b94cd4a3172e0323cea5e7b009733cfdae743f3a3eba8e86309e841c67d0cc85b3f80e7c5db580a5b11d6fc0cb730b6d35bcedc8444ea69e222396283ae6085ca7191c6146c83148aea651515eb69b81ab92ffcb2d21b11b85c4e903c396cdb272683b741fb4c24e5d08de6a29a98a34061e58d3f5456abb9a2f4fdce8cac26b6ce5f7785682f25e84fda061e351f80201f8b09cdb76380658a65cd8ab6643d7b49c9f19e5e4bee3ed392647c66357c535c907"}, &(0x7f00000003c0)=0x110) setsockopt$inet_sctp6_SCTP_RESET_ASSOC(r8, 0x84, 0x78, &(0x7f0000000140)=r9, 0x4) write(r8, &(0x7f0000000000)="2400000021002551071c0165ff00fc020200000000100f000ee1000c08000b0000000000", 0x24) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f0000000040)={0x0, 0x0, 0x20}, 0xc) sendto$inet6(r1, &(0x7f0000e33fe0)='X', 0x1, 0x0, &(0x7f00000001c0)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r1, 0x84, 0x77, &(0x7f0000000000)={0x0, 0xffff, 0x3, [0x2, 0x7, 0x2376]}, &(0x7f00000000c0)=0xe) r11 = socket$netlink(0x10, 0x3, 0xe) sendmsg$nl_generic(r11, &(0x7f0000002640)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000002600)={&(0x7f0000000500)=ANY=[@ANYBLOB="14100000180000022bbd7000fcdbdf250c000000506d688ff5b4f9b28630fcad7014b3801d788dce5260a277e428d7f73ae5834b92384517e1d424098cac24a35b7919eb1e15be3c3b2201649013e0e67ecaff5d5d3b920bd9704e6ae36a4b8e0f59552639c9e29aaa9c969576ce316fd0e689811692302be729b86a7245a67fd3604039c6a3531aee8dbf4fd0622c04c766c20a6dfd15c820b4724b7a16f82d3f5dd8bc775a2bad2392db4c719b640f0224682b31d39cc96c090017d2c86e61108439ce49bef387e413f373f9998bb9f6c61690940412021be9c60abc4885de90839556116ad62c353035a478e02258cc6fe3c8a0d847d28666c2f5852e19349cc40f002ff3a8a238e6502e14962c1411ff0483bba1a62c20b5bc0d64f3d4ed7f14dba449ef982fda3b80ff968eac4ba9bb75e153551ae509ebe9d486c78fb3bfb8cbfe210442ec5a17494b067775aa2045049f592a5f255d1c82f4f43bceaf2a24228dea74a7f8c535ff9e61d805dca0d676796abd9fb5484a294a41df7ab7b37b8322a74695d968fd5a8d8d6513f04cf713edd8fed0eb01b24a1e7f86aee52edb7ed35de641687689dc6dc126305b034b95960b91525d7f83f59f962f8fa83aebdd4bc7696de2a730d454d1260ff2ef0f25354b27ff8cb3a32d497fd8c47992756e4a1d4351d8973df6498c1dcda2d1f330b29a8bd59ff4a344e1f998c5cbf37e95d91efd6ec3916db6e76f25205082f48cffed2780210bbcda1658d67073720c209d37ed701d10c42716b107e01e5fd2921781531bdb023b254fca774ccbd13f31a883a7f4cfb7e6104e6ca2fe2796faaef11e6b894fc756cc4d9721a96b76343671831968c473fa53049dacbee886cf5d8676f1535693f2f78bf115eac10d7219d6b59c37c7155bed5d76ad8c07e639b2086e6a65e33203973a0b0e0317da31606c2daf2e38dc0ff0f21ad9c5f3bfd70db53fb55872cf5fed2bfdf916196c6dc79e608fc36cf4def895540b5f9a469977a5e2532f49ebd99e41ed1a73f2feabacdc8cdf5480db47330b718d0988715f844b0d00a9afa80dc538f831cfefb57d5ea8c8f05ca9c6acbbc7dbcc918489b0dd8731d5bcc3d5bee1ae6434ff30d4afe38f6739889db5a14af08b06d6cfe35e37e671a2f529a3825780510b38e09d2feccf193ab407d180ca7a7b3679db957c85d69aeba6fadee4c70ec1351884e1e3c336bb6a7b7e36fec0c4198aba4e50190924f198f40d0e629382dfd82cbe7f147ba92f316635aae90cdc94ddffbe48d402cc966d6835e81a9dd9b88ef7d70d5eae5c29b36e053c5c62bc972890f70b16000f9652d2bc2351b7e9b750d8645598dde955152bd2dc8cffa3744723605b4ce77f51db12e5143a73d1fd5165ed28acac68f1da661c21e9a98a43a0649172845a910b675e28ddc2899b82fa69774a9890e04e599640ba395f22b87c276e85e40c06e2b3cea87130199d6e0ca0e656afbfcf7641faf20efcbd6e61076148afac745d22dda7d3baf8f22387c8fc205b002bd9b864d3a8c32f57f774f4501ada36f5b8c398d08d26cfef8d0be8ec614bbb9dd6598f78a6e80565e81a7e102edcb75436a8c88b18b5246eddd5ddb1d10058fa2784c42a0c8e617e6f851afe7c88f661477a6f620eb851dddc947bed4d2aead22a63901c595354a3eda10e5b456f2f071ad3242eca1ed45437bbd815b72c42888428ff1746b67656559575395e33b31e53dba96cbfc5d318f0b95e0930d374239c1c88a327410197ea7f89594c27dab41bd256bd981fb924b59946b73fc2d3f0884139a03b37ceb5a47547ee294e574dd095a7cb659fa8655d1cce9593dc4d836c96a520c28669c66ea8cea6e77fcd55a122a58be6ccad3eab88d4fa5ff45c88003d765d831bed0464b091516e80e04b39d962147bb589674f2944e3069738debda91f41973ae296cb5a9c6d75112842cfab16524d64cab3c91d19aee4ddc047bb6f316540b9ff14f9e3acad942f373f6bca7aedce8ee6e2cf7bbdfb9cab75c57b822f77348f83cb59130d5683cab0c06d15098bfa3e1b626523b9933c283266c3854ea265c8de996dc1752765d035667a1c1c0c25a94af8352dc233b873af5c4e8541de17a8d2b0adcdb81c5105d541ba0a84be8b42dfda4f79776166aad637dece415cf9f48276bbde2a3ec256c3e287da14f6c38defb76cf44dac44c22b41a2e6c079a8f19f4cd9a43f2ff0e0c3ccd548a88b34fcfa3bc3bf0ebccf932c36467b88c1accf7637814bed656de44eed94689c9e3a46a489865e1a089b0610c09a9270a2cfb415ac1fcc50b269eba33fc17077c7b3c8547f04d7fa82c325d0f8b811a609614a223815d17e615e90511d699917041f39ab229cc1e0cc08955b10f7d09d22b1fde5de56c3cbd7d5d2a12d891352bc9e037f11d741ff6ea13e68861afd8eaf7400a4037ce433e770f37c690e8b1067588936bb6e4b734727becb5ceb3e47299b8727b97e502c3ebcaed5f6d7bde750976885af4428bb06463bd8ffa44b27dd11dfe5cc7c5ed4bcd096b2f10b02fd0b7ace48b93194f3e16a05df470b87f15aac39e4444de22dacdff7e17f1d4c537f3f7c098f0537ae7003650360e85debd0cc3594e5bb4d185ae3a94847099d3820e166f42cd1c8022c2840d4d62fce08d7d609fb48ffce4d4457f353e055415dd542771a72c8ee61e48fb66e10d566903a4e1c8ec228d37ee102917a721a5e9c8cd50e89cdc1e9ccde55ba19525adff69b1f0d3d0fd32d124e4ce9e194ea59e418d83a6435079aa7d26f0eb15ed6a855eaf780994a6b73ae7580ca803732314fdb143eb36d20959217c5303b38d840f05120579d309f1af808765efd3627652c16b78269f7353b4bc8ea3174507806341cdf1b34dfc2527f3ed1f6fc4515add6221c2d424bef36f110e403fc757659a562d45868b67ba7bb59b19f6c596428931703f73219721016e6208f542f045e2a6a27112cb75dbe530075d8a6bd6b6c1c7712ab10e45e32af7f04bae026164bf9321563dcaf0afb06c582eb235cb143c4cb65c5c1683d4c7a91078335f6c616bb06c6e1c3f317081d52c5528243587ef2c43648585182368f4d742fc7c1eda320495c4b460a19ae4f39c2a4a8adbaf77d31e1c497c46eee36ae555ca97b265afcb3cdeee78401584d11bd124d72cf4e6f08b34cff9e2266f6719b51c23949d83ab0263677c83e9ff7f1a7174ea4d1f045108bcc7a39f17fe7019dd26ff507c588de139c61c0bb0113219a8b5ffd64cbc3d21f5f2c0b20c2c1217c397d1742a35d4b22c030be2f221d6104616c0b0087c0fdec0b14d601eeeee3187cfc5798ab512f9f2bb0b06a9e4ed295f5852cececafc2d3adc071df18c59a3c4dd84b08924a2d57f8788c4233ef7f16b6abec29145674005d1d0e44fedc71cb62332fe3a29d700549090e4a6bf95a89e80252421996fa82d070c92ac67820b7c8b36aa1434ebffacb2d139f9b9073f7bd77d15e26c401af507717d21cda787a977ad87bc2ce543add0c9693bc338ea1a83dffbd84303e2be760b072623ddcc72c2323d95f88bd25410f2771a047f90315c3dd97e56510beaf0438b20a7e4dacc069a983c88b641ec9dc4e6704ce33ea7f665a4febde601978d1685a62d3822f4bea36a6b9b5bb52b9a9987fcf3741ebfc71af49927f718ad62e5154c239e3923f9a454bf1d9e154893bb3f1faf6654115b324bcc5c108b20822e5ecb56639040945fe3221088fdd078c83c45e5696913993eef9dfb4665b994367c23444d383132b2245ce772bcd681498b500588e1037bb975877baa16738637c1e605119eadd1707b16d84be0caf87ce877ec6eef95e861ed6bdbb616b0aaf8c464e1b952dd8e38d1c5858d9658c008212d9e15d649df42c1b3f8e3419fb454ae30d4e3a11d69f0416788af71fefdb78b890b5022f496f7ba1cb24bf067d93915e00eebc28cbd6b181b72fc25b05ba1ee7024440f1556e24a001f96d29b68e4b3c9eb2239094fa8db54b9eab4e00fdd2c1a77491957cbeb98415c168075257cbfe7641d392ae35ba888343a6a8029f6df04cb3e1fae1e46c35900165adcfc32c33d9fc9437b10bbbe944a3d5a513c8dde6ffd601c56307aac9f6f428ee0913ad45857fd2d00e50d692562ad7278b58738ae0964835ef1e2caa06cb6336e13f1586a4e3700b0d8f5442a9a659cc18e9cd1a6d33e60f700904f4602f576ccd2067e64d19023bd2aa8fb120eb125ae396f2bf35ce314cd9c40da273cd5937829b4581ef4aadbf97cdd7cfb9b0937d23098fb5dd68d7221429e21dac730cc790b8063e31b16dcae2b411bff08b1e8a3391332dee73e5799f9c35d745b9df12d31c8d3ac27abed86c2de9e66f558721354c2107702c54cccd93b811e589ca93afb06f35fe843bbdb89f97190dd3e6aa167ac86c457044e8558bcda0ee940256ac3a52786e9960a2648a6734c1f5202e8a1d2a31010ce6139d0b5aa6c7a5bc4d777b2340ba82054daf9aad637fb147e197a2937c7dc76bcf41be996812c7b5ad55dcad35c3c32888d0356a1e83e820ed7295310f7d092586bf314c1904b25862effed58281a737f0556e3c26fdef0d5ef950e5c53de3aa3bcfc1a36e668746ab9e4b59260309514578fb0adb199f9ac24b1b5045d97d5be57b2e254f895b18cce09f28f007f652b43a1bda4fa26a80bb4f5e4084051faacc51018bcf7a52f62839c0d7814884a1bd5d2db98e301f1f6b13552f671c1fde5bcd98492974a36f2f8f80302f55ab3d2b6bd1a9309bdca9b96e276900ea01b3852d3440633dccda643ea8d8c95a02980fbf070c85d0b0ef0711cb2254bcaf8bb510882b692d2e1ed6bcd55ac8e3249d7b0e2ac1a54572f4bc4b493dcbb44b17820b691fc324e8b8993863a009bd50591905fc471dabb86fb74dc2cdf9e8a5be0a6c3c6afb1fe896efb09ec80a0c1140d6917a1a91bcd9586c2acce5d559836c9bf8ff38321a25dd1772a6956a4510b3b98ca553f9993dafd20411d539bc4c3e4163a4a510a67dd57c0161a1f5284a886874cf71cff5e32731b5adb99523ee05c2bd3f103b7ff9d64ddcb6458d9e075b7d76e0b3acba8cacdabf2c7f0c4f7ad07a816acf2d5c8a56a10758d61eb1c9df7629a46702d9082192391f350d972ccd51544eef56a4a8a43a7274669ab157cc963a3ff331ee5c570ef571d5c73c3f7c38acf5df523eafc3c3239e05e4cf7a88f7e2f96e9abf61795423dedccaf537f16a0ec63ca62f0f06a36dbb7f3c4ff008cf22a3822c970b93cf1401cfe67a0139afa4d29d35b2ad0f1cf29f3a3c9248472294d4712cf14017200ddbcfc917f225dee2ec20e1377827cfe84d0d9f575fd01c35a562b8e4620775b905221231b0e0f578260e65c04eeb04afb14698fde5d40f76cec229f9c66a481133711ffe4ed04899c1e875824e45172f8a303b3d5bde5a30fa650d2b8c58d09ec17c837149432a3e194e193401384b2519528315a1c048768b45e9ccf64ca2bc579eb09c0dae5ba44ef3f15ef2d40231610f3d04eae1086d2f9e91c12464f399b2f96bba5b231d98c50e6e83e58591ceccf31e4bddfdd96666840f725d1bd61853062104aed655902b22e33e2e9008d5530d327532625d3cb8f7d883d9c874cbd6bb693d027536036306c0f9716fd177ecca29e81211f8b6b1576de5a1b520e714f4f7ec1dfe57aac03e9f5b1016d3f567a4b3eeb46d3308a39166542b3572192518c2ea6ee1dc86546987a09cfb40d85a0fe0638bcae5f1bf44ba1e300638c7"], 0x1}, 0x1, 0x0, 0x0, 0x4000054}, 0x4) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r0, 0x84, 0x70, &(0x7f0000000240)={r10, @in={{0x2, 0x4e22, @remote}}, [0xffffffff80000000, 0x2, 0x5, 0xc7, 0x4, 0x7, 0x790916ec, 0x6, 0x8, 0x5, 0x8001, 0x24db285c, 0x1, 0x155400, 0x5]}, &(0x7f0000000340)=0x100) getsockopt$inet_sctp6_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000100)=@assoc_id=r10, &(0x7f0000000140)=0x4) 22:29:55 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000041000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 546.257265] binder: 3938:3939 Acquire 1 refcount change on invalid ref 4 ret -22 [ 546.290068] EXT4-fs (loop0): invalid inodes per group: 8192 [ 546.290068] 22:29:55 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x12}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 546.319762] binder: 3938:3939 unknown command 0 [ 546.345919] binder: 3938:3939 ioctl c0306201 20000140 returned -22 [ 546.367100] EXT4-fs (loop0): invalid inodes per group: 8192 [ 546.367100] [ 546.385422] binder: 3938:3939 Acquire 1 refcount change on invalid ref 4 ret -22 [ 546.406499] binder: 3938:3939 unknown command 0 [ 546.426578] binder: 3938:3939 ioctl c0306201 20000140 returned -22 [ 546.433162] binder: 3955:3961 Acquire 1 refcount change on invalid ref 18 ret -22 22:29:55 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000c00000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:55 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000031000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:55 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030002ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 546.499894] binder: 3955:3961 Acquire 1 refcount change on invalid ref 18 ret -22 22:29:55 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper={0x400c630e}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:55 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x6800000000000000}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 546.619848] binder: 3979:3981 Acquire 1 refcount change on invalid ref 4 ret -22 [ 546.643986] sctp: [Deprecated]: syz-executor5 (pid 3989) Use of int in maxseg socket option. [ 546.643986] Use struct sctp_assoc_value instead [ 546.647546] EXT4-fs (loop0): invalid inodes per group: 8192 [ 546.647546] [ 546.683790] binder_thread_write: 4 callbacks suppressed [ 546.683802] binder: 3979:3981 BC_FREE_BUFFER u0000000000000000 no match 22:29:55 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000005300000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 546.750600] binder: 3979:3981 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 546.753318] binder: 4000:4002 Acquire 1 refcount change on invalid ref 0 ret -22 [ 546.785902] binder: 3979:3981 BC_FREE_BUFFER u0000000000000000 no match 22:29:56 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000600001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:56 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0xffffff7f00000000}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 546.815260] binder: 3979:3981 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 546.831756] EXT4-fs (loop0): invalid inodes per group: 8192 [ 546.831756] 22:29:56 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper={0x400c630f}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 547.009112] binder: 4026:4028 BC_FREE_BUFFER u0000000000000000 no match [ 547.019863] binder: 4026:4028 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 22:29:56 executing program 5: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f00006dc000)=[{0x6, 0x0, 0x0, 0xa1}]}, 0x10) sendto$inet(r0, &(0x7f00000001c0), 0x0, 0x200007ff, &(0x7f0000deaff0)={0x2, 0x3, @loopback}, 0x10) sendto$inet(r0, &(0x7f00000002c0)="20d6dac772b6f65cc7c3fc9bf8d917fbd5bd28cd6ad9243ec3c3fc41fe4295b32b630b3e888a8d0eb1abd9d081c0c6655507c293ed17dcc8e25f2cb85d0e732ff34d9f574cdd31597a5e3a688fff4a8f31474711e4b8f7ab05068770f885c03286fadc1d0fd02098bd981aaf152f2da86443cc605a5cb9a63475b63d354cb1f158bd", 0x82, 0x0, &(0x7f0000000200)={0x2, 0x0, @dev}, 0x10) recvfrom(r0, &(0x7f0000000380)=""/239, 0xff4e, 0x0, 0x0, 0x307) shutdown(r0, 0x1) 22:29:56 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030008ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:29:56 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000000003e000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:56 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x7000000}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:56 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper={0x40406300}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:56 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000004c00001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 547.283614] sctp: [Deprecated]: syz-executor5 (pid 3969) Use of int in maxseg socket option. [ 547.283614] Use struct sctp_assoc_value instead [ 547.368008] binder: 4051:4052 BC_FREE_BUFFER u0000000000000000 no match 22:29:56 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x40, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000001080)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f00003b9fdc)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) mprotect(&(0x7f00002a8000/0x1000)=nil, 0x1000, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) 22:29:56 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper={0x40486311}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 547.423047] EXT4-fs (loop0): invalid inodes per group: 8192 [ 547.423047] 22:29:56 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4c000000}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:56 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000031000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 547.565022] EXT4-fs (loop0): invalid inodes per group: 8192 [ 547.565022] [ 547.582918] binder: 4088:4089 BC_FREE_BUFFER u0000000000000000 no match 22:29:56 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030009ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:29:56 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x1000000}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:56 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000020000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:56 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper={0x40106309}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:56 executing program 5: bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000240)={0xffffffffffffffff, 0x50, &(0x7f00000002c0)}, 0x10) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f00000000c0)={'\x00', 0x400}) ioctl$TUNATTACHFILTER(r0, 0x401054d5, &(0x7f0000000200)={0x2000000000000276, &(0x7f0000000240)=[{}]}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={"76657400000000000000000400", 0x43732e5398416f1a}) 22:29:57 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x700}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 547.774083] binder: 4112:4114 BC_FREE_BUFFER u0000000000000000 no match [ 547.787641] EXT4-fs (loop0): invalid inodes per group: 8192 [ 547.787641] [ 547.809626] binder: 4112:4114 BC_ACQUIRE_DONE u0000000000000000 no match 22:29:57 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000600000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 547.902633] EXT4-fs (loop0): invalid inodes per group: 8192 [ 547.902633] 22:29:57 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper={0x630d}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:57 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x2}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:57 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0xfb) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x4e23, @multicast1}, 0x10) 22:29:57 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030003ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:29:57 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000040000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 548.055357] binder: 4145:4148 BC_FREE_BUFFER u0000000000000000 no match 22:29:57 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000b00000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:57 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper={0x6354}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 548.160366] EXT4-fs (loop0): invalid inodes per group: 8192 [ 548.160366] 22:29:57 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x6c00000000000000}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:57 executing program 5: r0 = syz_open_dev$sndseq(&(0x7f000011c000)='/dev/snd/seq\x00', 0x0, 0x8000000000102) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000000080)={0x0, 0x0, 0x60, {0x0, 0x989680}}) [ 548.263522] binder: 4173:4178 BC_FREE_BUFFER u0000000000000000 no match [ 548.279608] binder: 4173:4178 unknown command 25428 [ 548.292919] binder: 4173:4178 ioctl c0306201 20000140 returned -22 [ 548.302027] EXT4-fs (loop0): invalid inodes per group: 8192 [ 548.302027] 22:29:57 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000061000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:57 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x600}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:57 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper={0x630c}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:57 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc803006cec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:29:57 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000080)=[@textreal={0x8, &(0x7f0000000040)="0f01cbf21a8f9c5a67670f0fcb9e0fc76200263eda7ff6f23002263e0ff673730f21aa0f01d1baf80c66b8449a478366efbafc0c66ed", 0x36}], 0x1, 0x0, &(0x7f00000000c0), 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000480)=[@textreal={0x8, &(0x7f0000000300)="67660f3a400300baf80c66b85fbeb78066efbafc0cb0e3eeba200066edc30f350f20e06635200000000f22e0660f3830b3708f3e0f060f01712166b9800000c00f326635000100000f30", 0x4a}], 0x1, 0x10, &(0x7f00000004c0), 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 22:29:57 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000004c1000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 548.544897] binder: 4208:4214 BC_FREE_BUFFER u0000000000000000 no match 22:29:57 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4c00}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 548.587856] EXT4-fs (loop0): invalid inodes per group: 8192 [ 548.587856] 22:29:57 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper={0x40486312}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:57 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030023ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:29:57 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000004400000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:57 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x3}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 548.795475] EXT4-fs (loop0): invalid inodes per group: 8192 [ 548.795475] [ 548.799826] binder_transaction: 75 callbacks suppressed [ 548.799841] binder: 4210:4215 transaction failed 29189/-22, size 0-0 line 2834 [ 548.830589] binder: 4237:4243 BC_FREE_BUFFER u0000000000000000 no match [ 548.857077] binder: 4237:4243 got reply transaction with no transaction stack [ 548.865232] EXT4-fs (loop0): invalid inodes per group: 8192 [ 548.865232] [ 548.877833] binder: 4249:4252 transaction failed 29201/-22, size 0-0 line 2834 22:29:58 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000741000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 548.915939] binder: 4244:4254 transaction failed 29189/-22, size 0-0 line 2834 [ 548.917280] binder: 4237:4243 transaction failed 29201/-71, size 0-0 line 2741 [ 548.939637] binder: 4249:4252 transaction failed 29201/-22, size 0-0 line 2834 22:29:58 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030007ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:29:58 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper={0x4008630a}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:58 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x1200000000000000}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 548.986885] binder: 4244:4259 transaction failed 29189/-22, size 0-0 line 2834 22:29:58 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000d00000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 549.100758] EXT4-fs (loop0): invalid inodes per group: 8192 [ 549.100758] [ 549.123869] binder: 4262:4279 transaction failed 29189/-22, size 0-0 line 2834 [ 549.132029] binder: 4274:4275 transaction failed 29201/-22, size 0-0 line 2834 [ 549.149993] binder: BC_ATTEMPT_ACQUIRE not supported 22:29:58 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000200)={&(0x7f0000000180), 0xc, &(0x7f00000001c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="640000001e00010d0000000000000000000000000000000000000000000000000000000000000000e000000200000000000000000000000000000000000000002400090000000000000000000000000000000000000000000000000000000000d900000045f6fdf5f521bbc4bd23f69c4d29b3eb945ccc21490b335af71143a67b5f69b8cea18a08c538e5129c8f6c9f7196e214ca4ca09aa728fbcbcbfeb2fb5dab0fde40faecbdcc4a669c3a7ae96854f0ba6c0900a9e260194259eb7e6d2053ac641b2c9baaf0cafc0a0cd25ba8ad0afed22dd1d81d2157117f05c7ac43207d0444d88494874b68a813ce3729d7bee0c58251cc4ddf7c3b82e838ac972e53da22f7e7a7f8cd4dd80a0861c4c30ed0aed02a55cdaa98404d1a36bd54e3ca24c61272a16c520508e5ef00fd58927a36dc0100000000000000d5673edcf45f8295919d22da6eadcd24603437fcc0c556142d45ff1ff57e1076f68ee1653fb86ebe89e2981a29c328f947b2c55d3bd818b93cbad2a4b737534727b4d91f0139560ead21dd"], 0x1}}, 0x0) [ 549.177223] binder: 4276:4281 ioctl c0306201 20000140 returned -22 [ 549.183887] binder_release_work: 77 callbacks suppressed [ 549.183893] binder: undelivered TRANSACTION_ERROR: 29201 [ 549.221590] EXT4-fs (loop0): invalid inodes per group: 8192 [ 549.221590] [ 549.239163] binder: 4282:4292 transaction failed 29189/-22, size 0-0 line 2834 22:29:58 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4c00000000000000}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 549.268451] binder: 4262:4296 transaction failed 29189/-22, size 0-0 line 2834 [ 549.300516] binder: undelivered TRANSACTION_ERROR: 29189 [ 549.306256] binder: undelivered TRANSACTION_ERROR: 29189 22:29:58 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper={0x40046307}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:58 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030048ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:29:58 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCGARP(r0, 0x8955, &(0x7f0000000100)={{0x2, 0x0, @remote}, {0x0, @link_local}, 0x400000000001a, {0x2, 0x0, @local}, "6c6f00d2e2cd7c0000fdfdffff00"}) readahead(0xffffffffffffffff, 0x0, 0x0) [ 549.349932] binder: undelivered TRANSACTION_ERROR: 29189 [ 549.355868] binder: undelivered TRANSACTION_ERROR: 29189 22:29:58 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000004c1000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:58 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000003f1000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 549.391080] binder: undelivered TRANSACTION_ERROR: 29201 22:29:58 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x48000000}, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 549.465324] EXT4-fs (loop0): invalid inodes per group: 8192 [ 549.465324] 22:29:58 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x40000000000002, 0x0, @ipv4={[], [], @loopback}}, 0x3b) sendto$inet6(r1, &(0x7f0000f6f000), 0xfffffffffffffea7, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) 22:29:58 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper={0x40086310}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 549.537097] binder: undelivered TRANSACTION_ERROR: 29201 [ 549.546729] binder: undelivered TRANSACTION_ERROR: 29201 [ 549.577765] EXT4-fs (loop0): invalid inodes per group: 8192 [ 549.577765] 22:29:58 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40106309, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 549.623163] binder: 4335:4339 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 549.646238] binder: undelivered TRANSACTION_ERROR: 29189 [ 549.654481] binder: undelivered TRANSACTION_ERROR: 29189 22:29:58 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper={0x6312}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:58 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000481000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:58 executing program 5: syz_emit_ethernet(0x2a, &(0x7f0000000240)={@local, @local, [], {@arp={0x806, @ether_ipv4={0x1, 0x800, 0x6, 0x4, 0x1, @dev, @empty=0x60000000, @random="eb5de09d9520", @dev}}}}, &(0x7f0000000380)) [ 549.734673] binder: 4350:4353 BC_ACQUIRE_DONE u0000000000000004 no match 22:29:58 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000480000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:58 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc803004cec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 549.836509] binder: 4350:4353 unknown command 0 [ 549.842164] binder: 4357:4363 unknown command 25362 [ 549.869747] binder: 4350:4353 ioctl c0306201 20000140 returned -22 [ 549.871042] binder: 4357:4363 ioctl c0306201 20000140 returned -22 22:29:59 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406307, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:59 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper={0x6356}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 549.946427] EXT4-fs (loop0): invalid inodes per group: 8192 [ 549.946427] 22:29:59 executing program 5: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl(r0, 0x20000000008912, &(0x7f0000000040)="0a5c2d02402b6285717070") socketpair$unix(0x1, 0x10000000000005, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(r1) openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x801, 0x0) io_setup(0x6, &(0x7f0000000080)=0x0) io_submit(r2, 0x1400, &(0x7f0000000240)=[&(0x7f0000000280)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r1, &(0x7f0000000140), 0x2}]) 22:29:59 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001100000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 550.034835] EXT4-fs (loop0): invalid inodes per group: 8192 [ 550.034835] [ 550.077901] binder: 4391:4394 unknown command 25430 [ 550.088906] binder_transaction: 26 callbacks suppressed [ 550.088915] binder: 4364:4397 got transaction to invalid handle [ 550.101677] binder: 4395:4396 unknown command 1077961479 22:29:59 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc803002dec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:29:59 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000600000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 550.131107] binder: 4391:4394 ioctl c0306201 20000140 returned -22 [ 550.139382] binder: 4395:4396 ioctl c0306201 20000140 returned -22 [ 550.146905] binder: 4395:4396 unknown command 1077961479 [ 550.186776] binder: 4395:4396 ioctl c0306201 20000140 returned -22 22:29:59 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r0, 0x40000000af01, &(0x7f0000000380)) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) clone(0x210007fa, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, &(0x7f0000000100)) ioctl$IOC_PR_CLEAR(0xffffffffffffffff, 0x401070cd, &(0x7f00000000c0)) preadv(r0, &(0x7f0000000540)=[{&(0x7f00000005c0)=""/243, 0xf3}], 0x1, 0x0) close(r1) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) 22:29:59 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper={0x40046304}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:59 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x4040630a, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 550.264955] EXT4-fs (loop0): invalid inodes per group: 8192 [ 550.264955] [ 550.327465] EXT4-fs (loop0): invalid inodes per group: 8192 [ 550.327465] [ 550.354898] binder: 4408:4412 got transaction to invalid handle [ 550.360166] binder: 4427:4433 unknown command 1077961482 22:29:59 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r0, 0x40000000af01, &(0x7f0000000380)) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) clone(0x210007fa, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, &(0x7f0000000100)) ioctl$IOC_PR_CLEAR(0xffffffffffffffff, 0x401070cd, &(0x7f00000000c0)) preadv(r0, &(0x7f0000000540)=[{&(0x7f00000005c0)=""/243, 0xf3}], 0x1, 0x0) close(r1) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) 22:29:59 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000003d00000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 550.375990] binder: 4427:4433 ioctl c0306201 20000140 returned -22 22:29:59 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper={0x40086303}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:59 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406368, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:59 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030060ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 550.527598] binder: 4408:4422 got transaction to invalid handle [ 550.546251] binder: 4458:4459 unknown command 1077961576 22:29:59 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000051000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:29:59 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000481000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 550.580645] binder: 4458:4459 ioctl c0306201 20000140 returned -22 22:29:59 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r0, 0x40000000af01, &(0x7f0000000380)) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) clone(0x210007fa, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, &(0x7f0000000100)) ioctl$IOC_PR_CLEAR(0xffffffffffffffff, 0x401070cd, &(0x7f00000000c0)) preadv(r0, &(0x7f0000000540)=[{&(0x7f00000005c0)=""/243, 0xf3}], 0x1, 0x0) close(r1) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) 22:29:59 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper={0x634d}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:29:59 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x400c630e, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 550.658730] EXT4-fs (loop0): invalid inodes per group: 8192 [ 550.658730] 22:29:59 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r0, 0x40000000af01, &(0x7f0000000380)) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) clone(0x210007fa, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, &(0x7f0000000100)) ioctl$IOC_PR_CLEAR(0xffffffffffffffff, 0x401070cd, &(0x7f00000000c0)) preadv(r0, &(0x7f0000000540)=[{&(0x7f00000005c0)=""/243, 0xf3}], 0x1, 0x0) close(r1) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000180)={0x0, r1}) [ 550.782548] EXT4-fs (loop0): invalid inodes per group: 8192 [ 550.782548] [ 550.800429] binder: 4482:4492 unknown command 25421 [ 550.813849] binder: 4491:4493 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 [ 550.826893] binder: 4482:4492 ioctl c0306201 20000140 returned -22 [ 550.834487] binder: 4491:4493 unknown command 0 [ 550.849905] binder: 4491:4493 ioctl c0306201 20000140 returned -22 22:30:00 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000021000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:00 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030074ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:00 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper={0x40046302}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 550.896377] binder_thread_write: 42 callbacks suppressed [ 550.896392] binder: 4491:4493 Acquire 1 refcount change on invalid ref 0 ret -22 22:30:00 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r0, 0x40000000af01, &(0x7f0000000380)) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) clone(0x210007fa, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, &(0x7f0000000100)) ioctl$IOC_PR_CLEAR(0xffffffffffffffff, 0x401070cd, &(0x7f00000000c0)) preadv(r0, &(0x7f0000000540)=[{&(0x7f00000005c0)=""/243, 0xf3}], 0x1, 0x0) close(r1) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) [ 550.968943] EXT4-fs (loop0): invalid inodes per group: 8192 [ 550.968943] [ 550.988681] binder: 4491:4493 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 [ 551.003804] binder: 4491:4493 unknown command 0 22:30:00 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000700001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 551.012983] binder: 4516:4517 Acquire 1 refcount change on invalid ref 4 ret -22 [ 551.041332] binder: 4491:4493 ioctl c0306201 20000140 returned -22 [ 551.050270] binder: BC_ACQUIRE_RESULT not supported [ 551.059031] binder: 4516:4517 ioctl c0306201 20000140 returned -22 22:30:00 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40486312, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 551.089271] EXT4-fs (loop0): invalid inodes per group: 8192 [ 551.089271] 22:30:00 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper={0x40106308}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:00 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000500000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:00 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r0, 0x40000000af01, &(0x7f0000000380)) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) clone(0x210007fa, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, &(0x7f0000000100)) ioctl$IOC_PR_CLEAR(0xffffffffffffffff, 0x401070cd, &(0x7f00000000c0)) preadv(r0, &(0x7f0000000540)=[{&(0x7f00000005c0)=""/243, 0xf3}], 0x1, 0x0) close(r1) socket$packet(0x11, 0x3, 0x300) 22:30:00 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030005ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 551.214200] binder: 4545:4546 Acquire 1 refcount change on invalid ref 0 ret -22 [ 551.222040] binder: 4545:4546 got reply transaction with no transaction stack 22:30:00 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r0, 0x40000000af01, &(0x7f0000000380)) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) clone(0x210007fa, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, &(0x7f0000000100)) ioctl$IOC_PR_CLEAR(0xffffffffffffffff, 0x401070cd, &(0x7f00000000c0)) preadv(r0, &(0x7f0000000540)=[{&(0x7f00000005c0)=""/243, 0xf3}], 0x1, 0x0) close(r1) [ 551.276626] binder: 4550:4555 Acquire 1 refcount change on invalid ref 4 ret -22 [ 551.313453] EXT4-fs (loop0): invalid inodes per group: 8192 [ 551.313453] 22:30:00 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40046302, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:00 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000300001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 551.339716] binder: 4550:4555 BC_INCREFS_DONE u0000000000000000 no match 22:30:00 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper={0x40406301}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:00 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r0, 0x40000000af01, &(0x7f0000000380)) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) clone(0x210007fa, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, &(0x7f0000000100)) ioctl$IOC_PR_CLEAR(0xffffffffffffffff, 0x401070cd, &(0x7f00000000c0)) preadv(r0, &(0x7f0000000540)=[{&(0x7f00000005c0)=""/243, 0xf3}], 0x1, 0x0) [ 551.404214] EXT4-fs (loop0): invalid inodes per group: 8192 [ 551.404214] 22:30:00 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000900000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:00 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030006ec000044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 551.475387] binder: 4583:4584 Acquire 1 refcount change on invalid ref 4 ret -22 [ 551.491158] binder: 4579:4581 Acquire 1 refcount change on invalid ref 0 ret -22 [ 551.552875] binder: BC_ACQUIRE_RESULT not supported [ 551.562039] binder: 4583:4584 got reply transaction with no transaction stack [ 551.576352] binder: 4579:4581 ioctl c0306201 20000140 returned -22 22:30:00 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r0, 0x40000000af01, &(0x7f0000000380)) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) clone(0x210007fa, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, &(0x7f0000000100)) preadv(r0, &(0x7f0000000540)=[{&(0x7f00000005c0)=""/243, 0xf3}], 0x1, 0x0) 22:30:00 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0xffffff7f00000000, 0xfffffdfd, &(0x7f0000000180)}) [ 551.608361] EXT4-fs (loop0): invalid inodes per group: 8192 [ 551.608361] 22:30:00 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x400c630f, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 551.717085] binder: 4617:4622 Acquire 1 refcount change on invalid ref 0 ret -22 [ 551.726186] EXT4-fs (loop0): invalid inodes per group: 8192 [ 551.726186] [ 551.743864] binder: 4619:4626 Acquire 1 refcount change on invalid ref 4 ret -22 22:30:00 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000001200001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:00 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000002f00000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 551.775338] binder_thread_write: 12 callbacks suppressed [ 551.775350] binder: 4619:4626 BC_FREE_BUFFER u0000000000000000 no match [ 551.776316] binder: 4617:4622 BC_CLEAR_DEATH_NOTIFICATION invalid ref 4 [ 551.799708] binder: 4619:4626 ERROR: BC_REGISTER_LOOPER called without request [ 551.811642] binder: 4617:4622 unknown command 0 22:30:01 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec041044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:01 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x6000000, 0xfffffdfd, &(0x7f0000000180)}) [ 551.889671] binder: 4617:4622 ioctl c0306201 20000140 returned -22 [ 551.928113] EXT4-fs (loop0): invalid inodes per group: 8192 [ 551.928113] 22:30:01 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406312, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 551.982256] binder: 4647:4649 Acquire 1 refcount change on invalid ref 4 ret -22 22:30:01 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000601000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 552.023321] EXT4-fs (loop0): invalid inodes per group: 8192 [ 552.023321] [ 552.030196] binder: 4647:4649 BC_FREE_BUFFER u0000000000000000 no match [ 552.049300] binder: 4659:4660 Acquire 1 refcount change on invalid ref 0 ret -22 [ 552.059882] binder: 4647:4649 ERROR: BC_REGISTER_LOOPER called without request 22:30:01 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000006800001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 552.086918] binder: 4659:4660 unknown command 1077961490 [ 552.100717] binder: 4659:4660 ioctl c0306201 20000140 returned -22 22:30:01 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x6c000000, 0xfffffdfd, &(0x7f0000000180)}) 22:30:01 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec006844000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 552.246219] binder: 4680:4689 BC_FREE_BUFFER u0000000000000000 no match [ 552.262510] EXT4-fs (loop0): invalid inodes per group: 8192 [ 552.262510] [ 552.278268] binder: 4680:4689 ERROR: BC_REGISTER_LOOPER called without request [ 552.287706] binder: 4680:4689 BC_FREE_BUFFER u0000000000000000 no match [ 552.295764] binder: 4680:4689 ERROR: BC_REGISTER_LOOPER called without request 22:30:01 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r0, 0x40000000af01, &(0x7f0000000380)) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) clone(0x210007fa, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$IOC_PR_CLEAR(0xffffffffffffffff, 0x401070cd, &(0x7f00000000c0)) preadv(r0, &(0x7f0000000540)=[{&(0x7f00000005c0)=""/243, 0xf3}], 0x1, 0x0) 22:30:01 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406374, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:01 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000a00000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:01 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x2000000, 0xfffffdfd, &(0x7f0000000180)}) 22:30:01 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000060000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:01 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec6c0044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 552.548061] binder: 4705:4706 BC_FREE_BUFFER u0000000000000000 no match [ 552.555678] binder: 4714:4715 unknown command 1077961588 [ 552.565537] EXT4-fs (loop0): invalid inodes per group: 8192 [ 552.565537] [ 552.577823] binder: 4714:4715 ioctl c0306201 20000140 returned -22 [ 552.582402] binder: 4705:4706 ERROR: BC_REGISTER_LOOPER called without request 22:30:01 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40046307, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:01 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x300, 0xfffffdfd, &(0x7f0000000180)}) [ 552.640582] binder: 4709:4710 got transaction to invalid handle [ 552.654793] EXT4-fs (loop0): invalid inodes per group: 8192 [ 552.654793] 22:30:01 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000700000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:01 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec080044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 552.748221] binder: 4743:4744 unknown command 0 [ 552.758296] binder: 4739:4740 BC_FREE_BUFFER u0000000000000000 no match [ 552.765430] binder: 4709:4749 got transaction to invalid handle [ 552.784785] binder: 4743:4744 ioctl c0306201 20000140 returned -22 [ 552.802831] binder: 4739:4740 ERROR: BC_REGISTER_LOOPER called without request 22:30:02 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000006c0000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:02 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40086310, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 552.934029] EXT4-fs (loop0): invalid inodes per group: 8192 [ 552.934029] [ 552.962592] binder: 4768:4769 BC_DEAD_BINDER_DONE 0000000000000004 not found [ 552.970887] binder: 4768:4769 unknown command 0 [ 552.975822] binder: 4768:4769 ioctl c0306201 20000140 returned -22 [ 553.030622] binder: 4764:4765 got transaction to invalid handle [ 553.041559] EXT4-fs (loop0): invalid inodes per group: 8192 [ 553.041559] [ 553.090292] binder: 4764:4770 got transaction to invalid handle 22:30:02 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x60, 0xfffffdfd, &(0x7f0000000180)}) 22:30:02 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000a1000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:02 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406302, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:02 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec000344000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:02 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r0, 0x40000000af01, &(0x7f0000000380)) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, &(0x7f0000000100)) ioctl$IOC_PR_CLEAR(0xffffffffffffffff, 0x401070cd, &(0x7f00000000c0)) preadv(r0, &(0x7f0000000540)=[{&(0x7f00000005c0)=""/243, 0xf3}], 0x1, 0x0) 22:30:02 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000201000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 553.430791] binder: 4785:4786 unknown command 1077961474 [ 553.448533] EXT4-fs (loop0): invalid inodes per group: 8192 [ 553.448533] [ 553.453045] binder: 4785:4786 ioctl c0306201 20000140 returned -22 [ 553.463060] binder: 4789:4792 BC_FREE_BUFFER u0000000000000000 no match [ 553.487909] binder: 4789:4792 ERROR: BC_REGISTER_LOOPER called without request 22:30:02 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x7a00000000000000, 0xfffffdfd, &(0x7f0000000180)}) 22:30:02 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x4040634c, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 553.561087] EXT4-fs (loop0): invalid inodes per group: 8192 [ 553.561087] 22:30:02 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000007a1000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 553.613456] binder: 4818:4820 BC_FREE_BUFFER u0000000000000000 no match [ 553.627906] binder: 4818:4820 ERROR: BC_REGISTER_LOOPER called without request 22:30:02 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x7a000000, 0xfffffdfd, &(0x7f0000000180)}) 22:30:02 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000681000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:02 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec040044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 553.675906] binder: 4824:4825 unknown command 1077961548 [ 553.685276] binder: 4824:4825 ioctl c0306201 20000140 returned -22 22:30:02 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406305, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 553.743222] binder: 4833:4834 BC_FREE_BUFFER u0000000000000000 no match [ 553.780266] binder: 4833:4834 ERROR: BC_REGISTER_LOOPER called without request [ 553.819590] binder: 4844:4845 unknown command 1077961477 [ 553.825724] binder_transaction: 52 callbacks suppressed [ 553.825741] binder: 4827:4847 transaction failed 29189/-22, size 0-0 line 2834 [ 553.853894] EXT4-fs (loop0): invalid inodes per group: 8192 [ 553.853894] [ 553.859674] binder: 4835:4853 transaction failed 29189/-22, size 0-0 line 2834 22:30:03 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x10000000, 0xfffffdfd, &(0x7f0000000180)}) 22:30:03 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec050044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 553.870874] binder: 4844:4845 ioctl c0306201 20000140 returned -22 22:30:03 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000121000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 553.946667] binder: 4855:4856 BC_FREE_BUFFER u0000000000000000 no match [ 554.005137] EXT4-fs (loop0): invalid inodes per group: 8192 [ 554.005137] [ 554.015985] binder: 4861:4870 transaction failed 29189/-22, size 0-0 line 2834 [ 554.018097] binder: 4855:4856 ERROR: BC_REGISTER_LOOPER called without request [ 554.045551] binder: 4835:4842 transaction failed 29189/-22, size 0-0 line 2834 [ 554.070780] binder: 4861:4874 transaction failed 29189/-22, size 0-0 line 2834 [ 554.088667] EXT4-fs (loop0): invalid inodes per group: 8192 [ 554.088667] 22:30:03 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r0, 0x40000000af01, &(0x7f0000000380)) clone(0x210007fa, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, &(0x7f0000000100)) ioctl$IOC_PR_CLEAR(0xffffffffffffffff, 0x401070cd, &(0x7f00000000c0)) preadv(r0, &(0x7f0000000540)=[{&(0x7f00000005c0)=""/243, 0xf3}], 0x1, 0x0) 22:30:03 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406360, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:03 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000006c00001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:03 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0xfdfdffff, 0xfffffdfd, &(0x7f0000000180)}) 22:30:03 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000681000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:03 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec600044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 554.387973] EXT4-fs (loop0): invalid inodes per group: 8192 [ 554.387973] [ 554.394520] binder: 4896:4898 unknown command 1077961568 [ 554.426776] binder: 4888:4907 transaction failed 29189/-22, size 0-0 line 2834 [ 554.434537] binder: 4896:4898 ioctl c0306201 20000140 returned -22 22:30:03 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x4800, 0xfffffdfd, &(0x7f0000000180)}) [ 554.461267] binder: 4885:4910 transaction failed 29189/-22, size 0-0 line 2834 [ 554.472886] binder: 4888:4912 transaction failed 29189/-22, size 0-0 line 2834 22:30:03 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec230044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:03 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x630d, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 554.540042] binder_release_work: 51 callbacks suppressed [ 554.540049] binder: undelivered TRANSACTION_ERROR: 29189 22:30:03 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000e00000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:03 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x2000, 0xfffffdfd, &(0x7f0000000180)}) [ 554.592830] binder: undelivered TRANSACTION_ERROR: 29189 [ 554.607953] binder: 4885:4927 transaction failed 29189/-22, size 0-0 line 2834 [ 554.620181] binder: 4928:4929 unknown command 4 [ 554.628658] EXT4-fs (loop0): invalid inodes per group: 8192 [ 554.628658] [ 554.636949] binder: undelivered TRANSACTION_ERROR: 29189 22:30:03 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000003001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 554.655180] binder: 4928:4929 ioctl c0306201 20000140 returned -22 [ 554.665452] binder: undelivered TRANSACTION_ERROR: 29189 [ 554.749785] binder: 4935:4942 transaction failed 29189/-22, size 0-0 line 2834 [ 554.764294] EXT4-fs (loop0): invalid inodes per group: 8192 [ 554.764294] [ 554.794657] binder: undelivered TRANSACTION_ERROR: 29189 [ 554.800345] binder: undelivered TRANSACTION_ERROR: 29189 [ 554.949907] binder: undelivered TRANSACTION_ERROR: 29189 [ 554.955429] binder: undelivered TRANSACTION_ERROR: 29189 22:30:04 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x200000000) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) clone(0x210007fa, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, &(0x7f0000000100)) ioctl$IOC_PR_CLEAR(0xffffffffffffffff, 0x401070cd, &(0x7f00000000c0)) preadv(r0, &(0x7f0000000540)=[{&(0x7f00000005c0)=""/243, 0xf3}], 0x1, 0x0) 22:30:04 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x300000000000000, 0xfffffdfd, &(0x7f0000000180)}) 22:30:04 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40106308, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:04 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000022300000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:04 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec000a44000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:04 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001200000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 555.290081] binder: 4968:4971 BC_INCREFS_DONE u0000000000000004 no match [ 555.303965] EXT4-fs (loop0): invalid inodes per group: 8192 [ 555.303965] [ 555.328346] binder: 4968:4971 unknown command 0 22:30:04 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x6c00000000000000, 0xfffffdfd, &(0x7f0000000180)}) [ 555.348047] binder: 4968:4971 ioctl c0306201 20000140 returned -22 22:30:04 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40486311, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 555.399201] EXT4-fs (loop0): invalid inodes per group: 8192 [ 555.399201] [ 555.421274] binder: undelivered TRANSACTION_ERROR: 29189 [ 555.434453] binder: undelivered TRANSACTION_ERROR: 29189 22:30:04 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x4800000000000000, 0xfffffdfd, &(0x7f0000000180)}) 22:30:04 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000741000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:04 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec0dac44000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 555.541969] binder: 5005:5007 got transaction to invalid handle 22:30:04 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406301, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 555.613663] EXT4-fs (loop0): invalid inodes per group: 8192 [ 555.613663] [ 555.708536] binder: 5026:5027 got reply transaction with no transaction stack [ 555.738553] binder: 5026:5027 got reply transaction with no transaction stack 22:30:05 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, &(0x7f0000000380)) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) clone(0x210007fa, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, &(0x7f0000000100)) ioctl$IOC_PR_CLEAR(0xffffffffffffffff, 0x401070cd, &(0x7f00000000c0)) preadv(r0, &(0x7f0000000540)=[{&(0x7f00000005c0)=""/243, 0xf3}], 0x1, 0x0) 22:30:05 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000100000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:05 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x4000000, 0xfffffdfd, &(0x7f0000000180)}) 22:30:05 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec006044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:05 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000071000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:05 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x630b, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 556.189915] binder_thread_write: 27 callbacks suppressed [ 556.189931] binder: 5035:5038 Acquire 1 refcount change on invalid ref 4 ret -22 [ 556.203281] binder: 5034:5036 Acquire 1 refcount change on invalid ref 0 ret -22 [ 556.211959] binder: 5034:5036 unknown command 4 [ 556.224073] EXT4-fs (loop0): invalid inodes per group: 8192 [ 556.224073] [ 556.224970] binder: 5034:5036 ioctl c0306201 20000140 returned -22 22:30:05 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x68000000, 0xfffffdfd, &(0x7f0000000180)}) 22:30:05 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406306, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:05 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000004400000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 556.323015] EXT4-fs (loop0): invalid inodes per group: 8192 [ 556.323015] [ 556.375124] binder: 5062:5064 Acquire 1 refcount change on invalid ref 4 ret -22 22:30:05 executing program 5: ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(0xffffffffffffffff, 0x40000000af01, &(0x7f0000000380)) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) clone(0x210007fa, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, &(0x7f0000000100)) ioctl$IOC_PR_CLEAR(0xffffffffffffffff, 0x401070cd, &(0x7f00000000c0)) preadv(0xffffffffffffffff, &(0x7f0000000540)=[{&(0x7f00000005c0)=""/243, 0xf3}], 0x1, 0x0) 22:30:05 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec0a0044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:05 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000006800001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:05 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x74, 0xfffffdfd, &(0x7f0000000180)}) [ 556.487684] binder: 5071:5074 Acquire 1 refcount change on invalid ref 0 ret -22 [ 556.547932] binder: 5071:5074 unknown command 1077961478 [ 556.564302] binder: 5071:5074 ioctl c0306201 20000140 returned -22 22:30:05 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(r0, 0x40000000af01, &(0x7f0000000380)) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) clone(0x210007fa, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, &(0x7f0000000100)) ioctl$IOC_PR_CLEAR(0xffffffffffffffff, 0x401070cd, &(0x7f00000000c0)) preadv(r0, &(0x7f0000000540)=[{&(0x7f00000005c0)=""/243, 0xf3}], 0x1, 0x0) [ 556.603404] EXT4-fs (loop0): invalid inodes per group: 8192 [ 556.603404] 22:30:05 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x4008630a, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:05 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000800000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 556.652170] binder: 5090:5099 Acquire 1 refcount change on invalid ref 4 ret -22 [ 556.690199] EXT4-fs (loop0): invalid inodes per group: 8192 [ 556.690199] 22:30:05 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x68, 0xfffffdfd, &(0x7f0000000180)}) 22:30:05 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec070044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 556.783096] binder: 5115:5116 Acquire 1 refcount change on invalid ref 0 ret -22 [ 556.820072] binder: 5120:5121 Acquire 1 refcount change on invalid ref 4 ret -22 22:30:06 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)) ioctl$int_in(r0, 0x40000000af01, &(0x7f0000000380)) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) clone(0x210007fa, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, &(0x7f0000000100)) ioctl$IOC_PR_CLEAR(0xffffffffffffffff, 0x401070cd, &(0x7f00000000c0)) preadv(r0, &(0x7f0000000540)=[{&(0x7f00000005c0)=""/243, 0xf3}], 0x1, 0x0) [ 556.834037] binder: BC_ATTEMPT_ACQUIRE not supported [ 556.851618] binder: 5115:5116 ioctl c0306201 20000140 returned -22 [ 556.865713] EXT4-fs (loop0): invalid inodes per group: 8192 [ 556.865713] 22:30:06 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000074001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 556.881227] binder_thread_write: 9 callbacks suppressed [ 556.881239] binder: 5120:5121 BC_FREE_BUFFER u0000000000000000 no match 22:30:06 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406304, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:06 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000c00000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 556.954604] binder_thread_write: 10 callbacks suppressed [ 556.954613] binder: 5120:5121 ERROR: BC_REGISTER_LOOPER called without request [ 557.021779] binder: 5145:5150 Acquire 1 refcount change on invalid ref 0 ret -22 [ 557.061693] binder: 5145:5150 unknown command 1077961476 22:30:06 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec100444000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:06 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0xfdfdffff00000000, 0xfffffdfd, &(0x7f0000000180)}) 22:30:06 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(0xffffffffffffffff, 0x40000000af01, &(0x7f0000000380)) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) clone(0x210007fa, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, &(0x7f0000000100)) ioctl$IOC_PR_CLEAR(0xffffffffffffffff, 0x401070cd, &(0x7f00000000c0)) preadv(r0, &(0x7f0000000540)=[{&(0x7f00000005c0)=""/243, 0xf3}], 0x1, 0x0) [ 557.086494] binder: 5145:5150 ioctl c0306201 20000140 returned -22 22:30:06 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406348, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:06 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000a00000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 557.211286] binder: 5167:5175 Acquire 1 refcount change on invalid ref 4 ret -22 [ 557.219324] EXT4-fs (loop0): invalid inodes per group: 8192 [ 557.219324] 22:30:06 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000012001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:06 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(0xffffffffffffffff, 0x40000000af01, &(0x7f0000000380)) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) clone(0x210007fa, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, &(0x7f0000000100)) ioctl$IOC_PR_CLEAR(0xffffffffffffffff, 0x401070cd, &(0x7f00000000c0)) preadv(r0, &(0x7f0000000540)=[{&(0x7f00000005c0)=""/243, 0xf3}], 0x1, 0x0) [ 557.252519] binder: 5167:5175 BC_FREE_BUFFER u0000000000000000 no match [ 557.299703] binder: 5167:5175 ERROR: BC_REGISTER_LOOPER called without request [ 557.310920] binder: 5181:5184 Acquire 1 refcount change on invalid ref 0 ret -22 [ 557.338089] binder: 5181:5184 unknown command 1077961544 22:30:06 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(0xffffffffffffffff, 0x0, &(0x7f0000000380)) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) clone(0x210007fa, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, &(0x7f0000000100)) ioctl$IOC_PR_CLEAR(0xffffffffffffffff, 0x401070cd, &(0x7f00000000c0)) preadv(r0, &(0x7f0000000540)=[{&(0x7f00000005c0)=""/243, 0xf3}], 0x1, 0x0) [ 557.354623] EXT4-fs (loop0): invalid inodes per group: 8192 [ 557.354623] [ 557.369639] binder: 5181:5184 ioctl c0306201 20000140 returned -22 22:30:06 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec000744000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:06 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x6c00, 0xfffffdfd, &(0x7f0000000180)}) 22:30:06 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40086303, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:06 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000d00000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 557.521815] EXT4-fs (loop0): invalid inodes per group: 8192 [ 557.521815] [ 557.529118] binder: 5215:5216 BC_FREE_BUFFER u0000000000000004 no match [ 557.530939] binder: 5210:5217 BC_FREE_BUFFER u0000000000000000 no match [ 557.568568] binder: 5215:5216 unknown command 0 [ 557.575350] binder: 5210:5217 ERROR: BC_REGISTER_LOOPER called without request [ 557.577912] binder: 5215:5216 ioctl c0306201 20000140 returned -22 22:30:06 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40400a00, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:06 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000c00000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:06 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x500000000000000, 0xfffffdfd, &(0x7f0000000180)}) [ 557.628179] EXT4-fs (loop0): invalid inodes per group: 8192 [ 557.628179] 22:30:06 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ecfc0044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:06 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001200000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 557.726682] binder: 5234:5236 unknown command 1077938688 [ 557.754020] binder: 5240:5241 BC_FREE_BUFFER u0000000000000000 no match [ 557.758157] binder: 5234:5236 ioctl c0306201 20000140 returned -22 22:30:07 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x60000000, 0xfffffdfd, &(0x7f0000000180)}) [ 557.787610] binder: 5240:5241 ERROR: BC_REGISTER_LOOPER called without request [ 557.816041] EXT4-fs (loop0): invalid inodes per group: 8192 [ 557.816041] 22:30:07 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40402500, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 557.881361] EXT4-fs (loop0): invalid inodes per group: 8192 [ 557.881361] [ 557.924435] binder: 5259:5262 unknown command 1077945600 [ 557.930798] binder: 5259:5262 ioctl c0306201 20000140 returned -22 [ 557.943679] binder: 5264:5265 BC_FREE_BUFFER u0000000000000000 no match [ 557.967905] binder: 5264:5265 ERROR: BC_REGISTER_LOOPER called without request 22:30:07 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(0xffffffffffffffff, 0x40000000af01, &(0x7f0000000380)) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, &(0x7f0000000100)) ioctl$IOC_PR_CLEAR(0xffffffffffffffff, 0x401070cd, &(0x7f00000000c0)) preadv(r0, &(0x7f0000000540)=[{&(0x7f00000005c0)=""/243, 0xf3}], 0x1, 0x0) 22:30:07 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec002044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:07 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40046304, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:07 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000007a00001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:07 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000900000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:07 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x500, 0xfffffdfd, &(0x7f0000000180)}) [ 558.300764] binder: 5282:5283 BC_FREE_BUFFER u0000000000000000 no match [ 558.314350] binder: 5286:5287 unknown command 0 [ 558.319068] binder: 5286:5287 ioctl c0306201 20000140 returned -22 [ 558.330520] binder: 5282:5283 ERROR: BC_REGISTER_LOOPER called without request [ 558.348027] EXT4-fs (loop0): invalid inodes per group: 8192 [ 558.348027] 22:30:07 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x4c00, 0xfffffdfd, &(0x7f0000000180)}) 22:30:07 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x4040636c, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:07 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000400000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 558.474095] EXT4-fs (loop0): invalid inodes per group: 8192 [ 558.474095] [ 558.504415] binder: 5313:5315 BC_FREE_BUFFER u0000000000000000 no match [ 558.528523] binder: 5313:5315 ERROR: BC_REGISTER_LOOPER called without request [ 558.554806] binder: 5318:5320 unknown command 1077961580 22:30:07 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec00fc44000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:07 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(0xffffffffffffffff, 0x40000000af01, &(0x7f0000000380)) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, &(0x7f0000000100)) ioctl$IOC_PR_CLEAR(0xffffffffffffffff, 0x401070cd, &(0x7f00000000c0)) preadv(r0, &(0x7f0000000540)=[{&(0x7f00000005c0)=""/243, 0xf3}], 0x1, 0x0) [ 558.576977] binder: 5318:5320 ioctl c0306201 20000140 returned -22 22:30:07 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x7400, 0xfffffdfd, &(0x7f0000000180)}) 22:30:07 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000400001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 558.631907] binder: 5318:5320 unknown command 1077961580 [ 558.712416] binder: 5318:5320 ioctl c0306201 20000140 returned -22 [ 558.720536] EXT4-fs (loop0): invalid inodes per group: 8192 [ 558.720536] [ 558.738075] binder: 5344:5346 BC_FREE_BUFFER u0000000000000000 no match 22:30:07 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000600000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:07 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x4040637a, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 558.766044] binder: 5344:5346 ERROR: BC_REGISTER_LOOPER called without request [ 558.811974] EXT4-fs (loop0): invalid inodes per group: 8192 [ 558.811974] [ 558.848848] binder: 5359:5361 unknown command 1077961594 22:30:08 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x4c00000000000000, 0xfffffdfd, &(0x7f0000000180)}) [ 558.879750] binder: 5359:5361 ioctl c0306201 20000140 returned -22 [ 558.888240] binder_transaction: 38 callbacks suppressed [ 558.888257] binder: 5356:5363 transaction failed 29189/-22, size 0-0 line 2834 22:30:08 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec7a0044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:08 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(0xffffffffffffffff, 0x40000000af01, &(0x7f0000000380)) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, &(0x7f0000000100)) ioctl$IOC_PR_CLEAR(0xffffffffffffffff, 0x401070cd, &(0x7f00000000c0)) preadv(r0, &(0x7f0000000540)=[{&(0x7f00000005c0)=""/243, 0xf3}], 0x1, 0x0) 22:30:08 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x630c, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 558.947605] binder: 5341:5371 transaction failed 29189/-22, size 0-0 line 2834 [ 558.959167] binder: 5369:5372 BC_FREE_BUFFER u0000000000000000 no match [ 558.980742] binder: 5369:5372 ERROR: BC_REGISTER_LOOPER called without request 22:30:08 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000020001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:08 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x48000000, 0xfffffdfd, &(0x7f0000000180)}) [ 559.030977] EXT4-fs (loop0): invalid inodes per group: 8192 [ 559.030977] [ 559.045228] binder: 5380:5383 unknown command 4 [ 559.053432] binder: 5356:5385 transaction failed 29189/-22, size 0-0 line 2834 [ 559.074694] binder: 5380:5383 ioctl c0306201 20000140 returned -22 [ 559.134007] binder: 5392:5393 ERROR: BC_REGISTER_LOOPER called without request [ 559.149658] EXT4-fs (loop0): invalid inodes per group: 8192 [ 559.149658] 22:30:08 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406303, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:08 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x4c000000, 0xfffffdfd, &(0x7f0000000180)}) 22:30:08 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec2d0044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 559.257545] binder: 5395:5398 transaction failed 29189/-22, size 0-0 line 2834 [ 559.261695] binder: 5407:5408 unknown command 1077961475 22:30:08 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(0xffffffffffffffff, 0x40000000af01, &(0x7f0000000380)) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) clone(0x210007fa, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, &(0x7f0000000100)) ioctl$IOC_PR_CLEAR(0xffffffffffffffff, 0x401070cd, &(0x7f00000000c0)) preadv(0xffffffffffffffff, &(0x7f0000000540)=[{&(0x7f00000005c0)=""/243, 0xf3}], 0x1, 0x0) 22:30:08 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000b00000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:08 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x600, 0xfffffdfd, &(0x7f0000000180)}) [ 559.307180] binder: 5407:5408 ioctl c0306201 20000140 returned -22 [ 559.340515] EXT4-fs (loop0): invalid inodes per group: 8192 [ 559.340515] 22:30:08 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 559.403591] binder: 5395:5424 transaction failed 29189/-22, size 0-0 line 2834 [ 559.431029] EXT4-fs (loop0): invalid inodes per group: 8192 [ 559.431029] 22:30:08 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x6800, 0xfffffdfd, &(0x7f0000000180)}) 22:30:08 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec201044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:08 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000003f001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 559.524429] binder: 5430:5433 got transaction to invalid handle [ 559.533132] binder: 5427:5435 transaction failed 29189/-22, size 0-0 line 2834 [ 559.550398] binder: 5430:5433 transaction failed 29201/-22, size 0-0 line 2834 [ 559.591378] binder: 5430:5433 got transaction to invalid handle [ 559.601628] binder: 5427:5439 transaction failed 29189/-22, size 0-0 line 2834 [ 559.629625] EXT4-fs (loop0): invalid inodes per group: 8192 [ 559.629625] 22:30:08 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x5, 0xfffffdfd, &(0x7f0000000180)}) [ 559.650041] binder_release_work: 38 callbacks suppressed [ 559.650049] binder: undelivered TRANSACTION_ERROR: 29201 [ 559.661502] binder: 5430:5433 transaction failed 29201/-22, size 0-0 line 2834 [ 559.686427] binder: 5441:5443 transaction failed 29189/-22, size 0-0 line 2834 [ 559.695739] binder: undelivered TRANSACTION_ERROR: 29189 22:30:08 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000002f00000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:08 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 559.725056] binder: undelivered TRANSACTION_ERROR: 29189 [ 559.752971] binder: undelivered TRANSACTION_ERROR: 29201 [ 559.788080] EXT4-fs (loop0): invalid inodes per group: 8192 [ 559.788080] [ 559.815352] binder: 5465:5466 got transaction to invalid handle [ 559.843568] binder: undelivered TRANSACTION_ERROR: 29189 [ 559.849082] binder: undelivered TRANSACTION_ERROR: 29189 22:30:09 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x6800000000000000, 0xfffffdfd, &(0x7f0000000180)}) 22:30:09 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000000a001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 559.886904] binder: undelivered TRANSACTION_ERROR: 29201 [ 560.013892] binder: undelivered TRANSACTION_ERROR: 29189 [ 560.199717] binder: undelivered TRANSACTION_ERROR: 29189 [ 560.205258] binder: undelivered TRANSACTION_ERROR: 29189 22:30:09 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:09 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec001f44000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:09 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0xffffff7f, 0xfffffdfd, &(0x7f0000000180)}) 22:30:09 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000005300000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:09 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000700000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:09 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(0xffffffffffffffff, 0x40000000af01, &(0x7f0000000380)) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) clone(0x210007fa, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, &(0x7f0000000100)) ioctl$IOC_PR_CLEAR(0xffffffffffffffff, 0x401070cd, &(0x7f00000000c0)) preadv(0xffffffffffffffff, &(0x7f0000000540)=[{&(0x7f00000005c0)=""/243, 0xf3}], 0x1, 0x0) [ 560.690532] binder: 5508:5509 got transaction to invalid handle [ 560.720406] EXT4-fs (loop0): invalid inodes per group: 8192 [ 560.720406] 22:30:09 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x7000000, 0xfffffdfd, &(0x7f0000000180)}) 22:30:09 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 560.801324] EXT4-fs (loop0): invalid inodes per group: 8192 [ 560.801324] 22:30:10 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000300000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 560.870126] binder: 5540:5541 got transaction to invalid handle 22:30:10 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec004844000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:10 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x6000, 0xfffffdfd, &(0x7f0000000180)}) 22:30:10 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x5600, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 561.096924] EXT4-fs (loop0): invalid inodes per group: 8192 [ 561.096924] [ 561.111797] IPVS: ftp: loaded support on port[0] = 21 [ 561.120897] binder: 5566:5567 got transaction to invalid handle [ 561.208532] EXT4-fs (loop0): invalid inodes per group: 8192 [ 561.208532] [ 562.775034] bridge0: port 1(bridge_slave_0) entered blocking state [ 562.781510] bridge0: port 1(bridge_slave_0) entered disabled state [ 562.788423] device bridge_slave_0 entered promiscuous mode [ 562.936751] bridge0: port 2(bridge_slave_1) entered blocking state [ 562.943215] bridge0: port 2(bridge_slave_1) entered disabled state [ 562.950388] device bridge_slave_1 entered promiscuous mode [ 562.960321] device bridge_slave_1 left promiscuous mode [ 562.965849] bridge0: port 2(bridge_slave_1) entered disabled state [ 563.020306] device bridge_slave_0 left promiscuous mode [ 563.025875] bridge0: port 1(bridge_slave_0) entered disabled state [ 563.762067] team0 (unregistering): Port device team_slave_1 removed [ 563.772509] team0 (unregistering): Port device team_slave_0 removed [ 563.783088] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 563.863653] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 563.929417] bond0 (unregistering): Released all slaves [ 563.985243] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 564.016355] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 564.104596] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 564.140262] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 564.357886] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 564.365692] team0: Port device team_slave_0 added [ 564.422398] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 564.429988] team0: Port device team_slave_1 added [ 564.475132] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 564.523241] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 564.569972] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 564.577101] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 564.593821] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 564.634376] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 564.642054] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 564.658588] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 565.129071] bridge0: port 2(bridge_slave_1) entered blocking state [ 565.135537] bridge0: port 2(bridge_slave_1) entered forwarding state [ 565.142250] bridge0: port 1(bridge_slave_0) entered blocking state [ 565.148610] bridge0: port 1(bridge_slave_0) entered forwarding state [ 565.157625] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 566.019747] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 566.351698] 8021q: adding VLAN 0 to HW filter on device bond0 [ 566.451306] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 566.548337] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 566.554595] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 566.566546] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 566.657151] 8021q: adding VLAN 0 to HW filter on device team0 22:30:16 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x7, 0xfffffdfd, &(0x7f0000000180)}) 22:30:16 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000500000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:16 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(0xffffffffffffffff, 0x40000000af01, &(0x7f0000000380)) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) clone(0x210007fa, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, &(0x7f0000000100)) ioctl$IOC_PR_CLEAR(0xffffffffffffffff, 0x401070cd, &(0x7f00000000c0)) preadv(r0, &(0x7f0000000540), 0x0, 0x0) 22:30:16 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x12, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:16 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec090044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:16 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000700000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 567.333073] binder_thread_write: 33 callbacks suppressed [ 567.333089] binder: 5870:5880 Acquire 1 refcount change on invalid ref 4 ret -22 [ 567.347853] binder: 5869:5879 Acquire 1 refcount change on invalid ref 0 ret -22 [ 567.355870] binder: 5869:5879 got transaction to invalid handle [ 567.363466] binder_transaction: 12 callbacks suppressed [ 567.363484] binder: 5869:5879 transaction failed 29201/-22, size 0-0 line 2834 [ 567.388655] binder: 5874:5886 transaction failed 29189/-22, size 0-0 line 2834 [ 567.399283] binder_thread_write: 10 callbacks suppressed [ 567.399295] binder: 5870:5880 BC_FREE_BUFFER u0000000000000000 no match [ 567.414378] binder: 5871:5892 transaction failed 29189/-22, size 0-0 line 2834 [ 567.422081] EXT4-fs (loop0): invalid inodes per group: 8192 [ 567.422081] 22:30:16 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(0xffffffffffffffff, 0x40000000af01, &(0x7f0000000380)) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) clone(0x210007fa, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, &(0x7f0000000100)) ioctl$IOC_PR_CLEAR(0xffffffffffffffff, 0x401070cd, &(0x7f00000000c0)) preadv(r0, &(0x7f0000000540), 0x0, 0x0) 22:30:16 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x56, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 567.434350] binder_release_work: 7 callbacks suppressed [ 567.434357] binder: undelivered TRANSACTION_ERROR: 29201 [ 567.438313] binder_thread_write: 9 callbacks suppressed [ 567.438322] binder: 5870:5880 ERROR: BC_REGISTER_LOOPER called without request [ 567.463665] binder: 5874:5894 transaction failed 29189/-22, size 0-0 line 2834 22:30:16 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x4c, 0xfffffdfd, &(0x7f0000000180)}) 22:30:16 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec020044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 567.526555] binder: 5901:5902 Acquire 1 refcount change on invalid ref 0 ret -22 [ 567.544220] binder: undelivered TRANSACTION_ERROR: 29189 [ 567.558237] binder: undelivered TRANSACTION_ERROR: 29189 [ 567.568125] binder: 5871:5910 transaction failed 29189/-22, size 0-0 line 2834 [ 567.607067] binder: undelivered TRANSACTION_ERROR: 29189 [ 567.624837] binder: 5901:5902 got transaction to invalid handle [ 567.631594] binder: undelivered TRANSACTION_ERROR: 29189 [ 567.637183] binder: 5913:5916 Acquire 1 refcount change on invalid ref 4 ret -22 22:30:16 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000a00000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:16 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$int_in(0xffffffffffffffff, 0x40000000af01, &(0x7f0000000380)) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) clone(0x210007fa, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, &(0x7f0000000100)) ioctl$IOC_PR_CLEAR(0xffffffffffffffff, 0x401070cd, &(0x7f00000000c0)) preadv(r0, &(0x7f0000000540), 0x0, 0x0) [ 567.664334] binder: 5901:5902 transaction failed 29201/-22, size 0-0 line 2834 [ 567.684797] EXT4-fs (loop0): invalid inodes per group: 8192 [ 567.684797] [ 567.703975] binder: undelivered TRANSACTION_ERROR: 29201 22:30:16 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000000000e003000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 567.714211] binder: 5913:5916 BC_FREE_BUFFER u0000000000000000 no match [ 567.747114] EXT4-fs (loop0): invalid inodes per group: 8192 [ 567.747114] [ 567.767447] binder: 5913:5916 ERROR: BC_REGISTER_LOOPER called without request [ 567.794480] binder: 5913:5916 Acquire 1 refcount change on invalid ref 4 ret -22 22:30:16 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 567.820021] binder: 5927:5938 transaction failed 29189/-22, size 0-0 line 2834 [ 567.850946] binder: 5922:5928 transaction failed 29189/-22, size 0-0 line 2834 22:30:17 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ecac0d44000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:17 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000006000)='/dev/snd/controlC#\x00', 0x0, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/audio\x00', 0x0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl(r1, 0x820001000008912, &(0x7f00000001c0)="0a5c2d0240316285717070") dup2(r1, r0) [ 567.865284] binder: 5913:5916 BC_FREE_BUFFER u0000000000000000 no match [ 567.903119] binder: 5913:5916 ERROR: BC_REGISTER_LOOPER called without request [ 567.906043] binder: 5945:5946 Acquire 1 refcount change on invalid ref 0 ret -22 [ 567.911153] binder: 5927:5942 transaction failed 29189/-22, size 0-0 line 2834 [ 567.945994] EXT4-fs (loop0): invalid inodes per group: 8192 [ 567.945994] [ 567.952742] binder: 5945:5946 got transaction to invalid handle [ 567.984471] binder: undelivered TRANSACTION_ERROR: 29189 [ 567.990146] binder: undelivered TRANSACTION_ERROR: 29189 22:30:17 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x700, 0xfffffdfd, &(0x7f0000000180)}) [ 567.997135] binder: 5945:5946 transaction failed 29201/-22, size 0-0 line 2834 [ 568.034451] binder: undelivered TRANSACTION_ERROR: 29189 22:30:17 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000500000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:17 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec007444000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:17 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000004c00001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 568.061836] binder: undelivered TRANSACTION_ERROR: 29189 [ 568.069288] binder: 5964:5965 Acquire 1 refcount change on invalid ref 4 ret -22 22:30:17 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(0xffffffffffffffff, 0x4004af61, &(0x7f0000000200)) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @dev}, 0x10) ioctl$SIOCSIFMTU(0xffffffffffffffff, 0x8922, &(0x7f0000000440)={'veth0_to_bond\x00'}) syz_open_dev$sndtimer(&(0x7f00000007c0)='/dev/snd/timer\x00', 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xd, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r2 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) bind$rds(0xffffffffffffffff, &(0x7f0000000740)={0x2, 0x0, @remote}, 0x10) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000780)=0x0) tgkill(0x0, r3, 0x0) shmget(0x1, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) shmat(0x0, &(0x7f0000ffb000/0x2000)=nil, 0x0) perf_event_open(&(0x7f0000000280)={0x2, 0x70, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x2, 0x4, 0xfffffffffffffffd, 0x9, 0x4, 0x0, 0x5, 0x0, 0xfffffffffffffff8, 0xed, 0x0, 0x2, 0x0, 0x3f, 0x0, 0xffffffff, 0xfffffffffffffffc, 0x0, 0x0, 0xffffffffffffffc0, 0x0, @perf_config_ext={0x20, 0xe9}, 0x0, 0x7fff, 0x0, 0x7, 0x1, 0x0, 0x9d2}, 0x0, 0x6, r0, 0x0) r4 = memfd_create(&(0x7f00000000c0)="000000008c00000000000000000000", 0x0) pwritev(r4, &(0x7f0000f50f90), 0x0, 0x81003) 22:30:17 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x300000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 568.159746] binder: 5964:5965 BC_FREE_BUFFER u0000000000000000 no match [ 568.188223] EXT4-fs (loop0): invalid inodes per group: 8192 [ 568.188223] [ 568.209926] binder: 5964:5965 ERROR: BC_REGISTER_LOOPER called without request [ 568.259988] EXT4-fs (loop0): invalid inodes per group: 8192 [ 568.259988] [ 568.286780] binder: 5984:5990 Acquire 1 refcount change on invalid ref 0 ret -22 22:30:17 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x3, 0xfffffdfd, &(0x7f0000000180)}) 22:30:17 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001100000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 568.384995] binder: 5984:5990 got transaction to invalid handle 22:30:17 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec000944000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:17 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(0xffffffffffffffff, 0x4004af61, &(0x7f0000000200)) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @dev}, 0x10) ioctl$SIOCSIFMTU(0xffffffffffffffff, 0x8922, &(0x7f0000000440)={'veth0_to_bond\x00'}) syz_open_dev$sndtimer(&(0x7f00000007c0)='/dev/snd/timer\x00', 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xd, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r2 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) bind$rds(0xffffffffffffffff, &(0x7f0000000740)={0x2, 0x0, @remote}, 0x10) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000780)=0x0) tgkill(0x0, r3, 0x0) shmget(0x1, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) shmat(0x0, &(0x7f0000ffb000/0x2000)=nil, 0x0) perf_event_open(&(0x7f0000000280)={0x2, 0x70, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x2, 0x4, 0xfffffffffffffffd, 0x9, 0x4, 0x0, 0x5, 0x0, 0xfffffffffffffff8, 0xed, 0x0, 0x2, 0x0, 0x3f, 0x0, 0xffffffff, 0xfffffffffffffffc, 0x0, 0x0, 0xffffffffffffffc0, 0x0, @perf_config_ext={0x20, 0xe9}, 0x0, 0x7fff, 0x0, 0x7, 0x1, 0x0, 0x9d2}, 0x0, 0x6, r0, 0x0) r4 = memfd_create(&(0x7f00000000c0)="000000008c00000000000000000000", 0x0) pwritev(r4, &(0x7f0000f50f90), 0x0, 0x81003) [ 568.457725] binder: 6004:6005 Acquire 1 refcount change on invalid ref 4 ret -22 22:30:17 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000500001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 568.547415] binder: 6004:6005 BC_FREE_BUFFER u0000000000000000 no match 22:30:17 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x4000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:17 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x6000000000000000, 0xfffffdfd, &(0x7f0000000180)}) [ 568.595414] binder: 6004:6005 ERROR: BC_REGISTER_LOOPER called without request 22:30:17 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec004c44000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:17 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(0xffffffffffffffff, 0x4004af61, &(0x7f0000000200)) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @dev}, 0x10) ioctl$SIOCSIFMTU(0xffffffffffffffff, 0x8922, &(0x7f0000000440)={'veth0_to_bond\x00'}) syz_open_dev$sndtimer(&(0x7f00000007c0)='/dev/snd/timer\x00', 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xd, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r2 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) bind$rds(0xffffffffffffffff, &(0x7f0000000740)={0x2, 0x0, @remote}, 0x10) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000780)=0x0) tgkill(0x0, r3, 0x0) shmget(0x1, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) shmat(0x0, &(0x7f0000ffb000/0x2000)=nil, 0x0) perf_event_open(&(0x7f0000000280)={0x2, 0x70, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x2, 0x4, 0xfffffffffffffffd, 0x9, 0x4, 0x0, 0x5, 0x0, 0xfffffffffffffff8, 0xed, 0x0, 0x2, 0x0, 0x3f, 0x0, 0xffffffff, 0xfffffffffffffffc, 0x0, 0x0, 0xffffffffffffffc0, 0x0, @perf_config_ext={0x20, 0xe9}, 0x0, 0x7fff, 0x0, 0x7, 0x1, 0x0, 0x9d2}, 0x0, 0x6, r0, 0x0) r4 = memfd_create(&(0x7f00000000c0)="000000008c00000000000000000000", 0x0) pwritev(r4, &(0x7f0000f50f90), 0x0, 0x81003) [ 568.713835] binder: 6032:6033 Acquire 1 refcount change on invalid ref 4 ret -22 [ 568.732560] binder: 6035:6036 got transaction to invalid handle 22:30:17 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000003d00000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 568.777339] binder: 6032:6033 BC_FREE_BUFFER u0000000000000000 no match [ 568.804063] EXT4-fs (loop0): invalid inodes per group: 8192 [ 568.804063] [ 568.815054] binder: 6035:6036 got transaction to invalid handle [ 568.821456] binder: 6032:6033 ERROR: BC_REGISTER_LOOPER called without request [ 568.902155] EXT4-fs (loop0): invalid inodes per group: 8192 [ 568.902155] 22:30:18 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x6800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:18 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000060001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:18 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x7a00, 0xfffffdfd, &(0x7f0000000180)}) 22:30:18 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec000644000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:18 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000200000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:18 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(0xffffffffffffffff, 0x4004af61, &(0x7f0000000200)) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @dev}, 0x10) ioctl$SIOCSIFMTU(0xffffffffffffffff, 0x8922, &(0x7f0000000440)={'veth0_to_bond\x00'}) syz_open_dev$sndtimer(&(0x7f00000007c0)='/dev/snd/timer\x00', 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xd, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r2 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) bind$rds(0xffffffffffffffff, &(0x7f0000000740)={0x2, 0x0, @remote}, 0x10) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000780)=0x0) tgkill(0x0, r3, 0x0) shmget(0x1, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) shmat(0x0, &(0x7f0000ffb000/0x2000)=nil, 0x0) perf_event_open(&(0x7f0000000280)={0x2, 0x70, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x2, 0x4, 0xfffffffffffffffd, 0x9, 0x4, 0x0, 0x5, 0x0, 0xfffffffffffffff8, 0xed, 0x0, 0x2, 0x0, 0x3f, 0x0, 0xffffffff, 0xfffffffffffffffc, 0x0, 0x0, 0xffffffffffffffc0, 0x0, @perf_config_ext={0x20, 0xe9}, 0x0, 0x7fff, 0x0, 0x7, 0x1, 0x0, 0x9d2}, 0x0, 0x6, r0, 0x0) r4 = memfd_create(&(0x7f00000000c0)="000000008c00000000000000000000", 0x0) pwritev(r4, &(0x7f0000f50f90), 0x0, 0x81003) [ 569.174734] binder: 6084:6087 BC_FREE_BUFFER u0000000000000000 no match [ 569.185277] EXT4-fs (loop0): invalid inodes per group: 8192 [ 569.185277] 22:30:18 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x4800000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 569.249126] binder: 6084:6087 ERROR: BC_REGISTER_LOOPER called without request 22:30:18 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000e00000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 569.329187] binder: 6103:6104 got transaction to invalid handle 22:30:18 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0xfffffdfd, 0xfffffdfd, &(0x7f0000000180)}) 22:30:18 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(0xffffffffffffffff, 0x4004af61, &(0x7f0000000200)) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @dev}, 0x10) ioctl$SIOCSIFMTU(0xffffffffffffffff, 0x8922, &(0x7f0000000440)={'veth0_to_bond\x00'}) syz_open_dev$sndtimer(&(0x7f00000007c0)='/dev/snd/timer\x00', 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xd, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r2 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) bind$rds(0xffffffffffffffff, &(0x7f0000000740)={0x2, 0x0, @remote}, 0x10) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000780)=0x0) tgkill(0x0, r3, 0x0) shmget(0x1, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) shmat(0x0, &(0x7f0000ffb000/0x2000)=nil, 0x0) perf_event_open(&(0x7f0000000280)={0x2, 0x70, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x2, 0x4, 0xfffffffffffffffd, 0x9, 0x4, 0x0, 0x5, 0x0, 0xfffffffffffffff8, 0xed, 0x0, 0x2, 0x0, 0x3f, 0x0, 0xffffffff, 0xfffffffffffffffc, 0x0, 0x0, 0xffffffffffffffc0, 0x0, @perf_config_ext={0x20, 0xe9}, 0x0, 0x7fff, 0x0, 0x7, 0x1, 0x0, 0x9d2}, 0x0, 0x6, r0, 0x0) memfd_create(&(0x7f00000000c0)="000000008c00000000000000000000", 0x0) 22:30:18 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x74000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:18 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001100000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:18 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec740044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 569.531166] binder: 6120:6121 BC_FREE_BUFFER u0000000000000000 no match 22:30:18 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000002302000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 569.603555] EXT4-fs (loop0): invalid inodes per group: 8192 [ 569.603555] [ 569.606346] binder: 6130:6132 got transaction to invalid handle [ 569.613349] binder: 6120:6121 ERROR: BC_REGISTER_LOOPER called without request 22:30:18 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(0xffffffffffffffff, 0x4004af61, &(0x7f0000000200)) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @dev}, 0x10) ioctl$SIOCSIFMTU(0xffffffffffffffff, 0x8922, &(0x7f0000000440)={'veth0_to_bond\x00'}) syz_open_dev$sndtimer(&(0x7f00000007c0)='/dev/snd/timer\x00', 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xd, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r2 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) bind$rds(0xffffffffffffffff, &(0x7f0000000740)={0x2, 0x0, @remote}, 0x10) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000780)=0x0) tgkill(0x0, r3, 0x0) shmget(0x1, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) shmat(0x0, &(0x7f0000ffb000/0x2000)=nil, 0x0) perf_event_open(&(0x7f0000000280)={0x2, 0x70, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x2, 0x4, 0xfffffffffffffffd, 0x9, 0x4, 0x0, 0x5, 0x0, 0xfffffffffffffff8, 0xed, 0x0, 0x2, 0x0, 0x3f, 0x0, 0xffffffff, 0xfffffffffffffffc, 0x0, 0x0, 0xffffffffffffffc0, 0x0, @perf_config_ext={0x20, 0xe9}, 0x0, 0x7fff, 0x0, 0x7, 0x1, 0x0, 0x9d2}, 0x0, 0x6, r0, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000f50f90), 0x0, 0x81003) 22:30:18 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x4c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:18 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec680044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:18 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x5000000, 0xfffffdfd, &(0x7f0000000180)}) [ 569.841624] binder: 6155:6156 got transaction to invalid handle 22:30:19 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(0xffffffffffffffff, 0x4004af61, &(0x7f0000000200)) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @dev}, 0x10) ioctl$SIOCSIFMTU(0xffffffffffffffff, 0x8922, &(0x7f0000000440)={'veth0_to_bond\x00'}) syz_open_dev$sndtimer(&(0x7f00000007c0)='/dev/snd/timer\x00', 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xd, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r2 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) bind$rds(0xffffffffffffffff, &(0x7f0000000740)={0x2, 0x0, @remote}, 0x10) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000780)=0x0) tgkill(0x0, r3, 0x0) shmget(0x1, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) shmat(0x0, &(0x7f0000ffb000/0x2000)=nil, 0x0) perf_event_open(&(0x7f0000000280)={0x2, 0x70, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x2, 0x4, 0xfffffffffffffffd, 0x9, 0x4, 0x0, 0x5, 0x0, 0xfffffffffffffff8, 0xed, 0x0, 0x2, 0x0, 0x3f, 0x0, 0xffffffff, 0xfffffffffffffffc, 0x0, 0x0, 0xffffffffffffffc0, 0x0, @perf_config_ext={0x20, 0xe9}, 0x0, 0x7fff, 0x0, 0x7, 0x1, 0x0, 0x9d2}, 0x0, 0x6, r0, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000f50f90), 0x0, 0x81003) [ 569.927296] binder: 6166:6169 BC_FREE_BUFFER u0000000000000000 no match 22:30:19 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000005400000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:19 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x7a00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:19 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000000000100a000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 569.967925] EXT4-fs (loop0): invalid inodes per group: 8192 [ 569.967925] [ 569.995843] binder: 6166:6169 ERROR: BC_REGISTER_LOOPER called without request 22:30:19 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x100000000000000, 0xfffffdfd, &(0x7f0000000180)}) [ 570.093473] binder: 6180:6185 got transaction to invalid handle 22:30:19 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec480044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:19 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x700000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:19 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(0xffffffffffffffff, 0x4004af61, &(0x7f0000000200)) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @dev}, 0x10) ioctl$SIOCSIFMTU(0xffffffffffffffff, 0x8922, &(0x7f0000000440)={'veth0_to_bond\x00'}) syz_open_dev$sndtimer(&(0x7f00000007c0)='/dev/snd/timer\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xd, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) bind$rds(0xffffffffffffffff, &(0x7f0000000740)={0x2, 0x0, @remote}, 0x10) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000780)=0x0) tgkill(0x0, r2, 0x0) shmget(0x1, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) shmat(0x0, &(0x7f0000ffb000/0x2000)=nil, 0x0) r3 = memfd_create(&(0x7f00000000c0)="000000008c00000000000000000000", 0x0) pwritev(r3, &(0x7f0000f50f90), 0x0, 0x81003) [ 570.215612] binder: 6196:6197 BC_FREE_BUFFER u0000000000000000 no match 22:30:19 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001002000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 570.309769] binder: 6196:6197 ERROR: BC_REGISTER_LOOPER called without request [ 570.326083] EXT4-fs (loop0): invalid inodes per group: 8192 [ 570.326083] 22:30:19 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:19 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000002f00000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:19 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x600000000000000, 0xfffffdfd, &(0x7f0000000180)}) [ 570.444724] EXT4-fs (loop0): invalid inodes per group: 8192 [ 570.444724] 22:30:19 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(0xffffffffffffffff, 0x4004af61, &(0x7f0000000200)) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @dev}, 0x10) ioctl$SIOCSIFMTU(0xffffffffffffffff, 0x8922, &(0x7f0000000440)={'veth0_to_bond\x00'}) syz_open_dev$sndtimer(&(0x7f00000007c0)='/dev/snd/timer\x00', 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xd, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r2 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) bind$rds(0xffffffffffffffff, &(0x7f0000000740)={0x2, 0x0, @remote}, 0x10) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000780)=0x0) tgkill(0x0, r3, 0x0) shmget(0x1, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) perf_event_open(&(0x7f0000000280)={0x2, 0x70, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x2, 0x4, 0xfffffffffffffffd, 0x9, 0x4, 0x0, 0x5, 0x0, 0xfffffffffffffff8, 0xed, 0x0, 0x2, 0x0, 0x3f, 0x0, 0xffffffff, 0xfffffffffffffffc, 0x0, 0x0, 0xffffffffffffffc0, 0x0, @perf_config_ext={0x20, 0xe9}, 0x0, 0x7fff, 0x0, 0x7, 0x1, 0x0, 0x9d2}, 0x0, 0x6, r0, 0x0) r4 = memfd_create(&(0x7f00000000c0)="000000008c00000000000000000000", 0x0) pwritev(r4, &(0x7f0000f50f90), 0x0, 0x81003) 22:30:19 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:19 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec002344000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:19 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000000000104c000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:19 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x2000000000000000, 0xfffffdfd, &(0x7f0000000180)}) 22:30:19 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x3f00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 570.717852] EXT4-fs (loop0): invalid inodes per group: 8192 [ 570.717852] 22:30:19 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(0xffffffffffffffff, 0x4004af61, &(0x7f0000000200)) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @dev}, 0x10) ioctl$SIOCSIFMTU(0xffffffffffffffff, 0x8922, &(0x7f0000000440)={'veth0_to_bond\x00'}) syz_open_dev$sndtimer(&(0x7f00000007c0)='/dev/snd/timer\x00', 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xd, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r2 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) bind$rds(0xffffffffffffffff, &(0x7f0000000740)={0x2, 0x0, @remote}, 0x10) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000780)=0x0) tgkill(0x0, r3, 0x0) shmat(0x0, &(0x7f0000ffb000/0x2000)=nil, 0x0) perf_event_open(&(0x7f0000000280)={0x2, 0x70, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x2, 0x4, 0xfffffffffffffffd, 0x9, 0x4, 0x0, 0x5, 0x0, 0xfffffffffffffff8, 0xed, 0x0, 0x2, 0x0, 0x3f, 0x0, 0xffffffff, 0xfffffffffffffffc, 0x0, 0x0, 0xffffffffffffffc0, 0x0, @perf_config_ext={0x20, 0xe9}, 0x0, 0x7fff, 0x0, 0x7, 0x1, 0x0, 0x9d2}, 0x0, 0x6, r0, 0x0) r4 = memfd_create(&(0x7f00000000c0)="000000008c00000000000000000000", 0x0) pwritev(r4, &(0x7f0000f50f90), 0x0, 0x81003) [ 570.785825] EXT4-fs (loop0): invalid inodes per group: 8192 [ 570.785825] 22:30:20 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000300000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:20 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x3000000, 0xfffffdfd, &(0x7f0000000180)}) 22:30:20 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec003f44000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:20 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:20 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000740001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:20 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x2, 0xfffffdfd, &(0x7f0000000180)}) 22:30:20 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(0xffffffffffffffff, 0x4004af61, &(0x7f0000000200)) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @dev}, 0x10) ioctl$SIOCSIFMTU(0xffffffffffffffff, 0x8922, &(0x7f0000000440)={'veth0_to_bond\x00'}) syz_open_dev$sndtimer(&(0x7f00000007c0)='/dev/snd/timer\x00', 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xd, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r2 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) bind$rds(0xffffffffffffffff, &(0x7f0000000740)={0x2, 0x0, @remote}, 0x10) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000780)) shmget(0x1, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) shmat(0x0, &(0x7f0000ffb000/0x2000)=nil, 0x0) perf_event_open(&(0x7f0000000280)={0x2, 0x70, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x2, 0x4, 0xfffffffffffffffd, 0x9, 0x4, 0x0, 0x5, 0x0, 0xfffffffffffffff8, 0xed, 0x0, 0x2, 0x0, 0x3f, 0x0, 0xffffffff, 0xfffffffffffffffc, 0x0, 0x0, 0xffffffffffffffc0, 0x0, @perf_config_ext={0x20, 0xe9}, 0x0, 0x7fff, 0x0, 0x7, 0x1, 0x0, 0x9d2}, 0x0, 0x6, r0, 0x0) r3 = memfd_create(&(0x7f00000000c0)="000000008c00000000000000000000", 0x0) pwritev(r3, &(0x7f0000f50f90), 0x0, 0x81003) 22:30:20 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x12, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 571.077525] EXT4-fs (loop0): invalid inodes per group: 8192 [ 571.077525] 22:30:20 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x48, 0xfffffdfd, &(0x7f0000000180)}) [ 571.202214] EXT4-fs (loop0): invalid inodes per group: 8192 [ 571.202214] 22:30:20 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000004c001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:20 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x4c00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:20 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001074f5bc99000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:20 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(0xffffffffffffffff, 0x4004af61, &(0x7f0000000200)) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @dev}, 0x10) ioctl$SIOCSIFMTU(0xffffffffffffffff, 0x8922, &(0x7f0000000440)={'veth0_to_bond\x00'}) syz_open_dev$sndtimer(&(0x7f00000007c0)='/dev/snd/timer\x00', 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xd, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r2 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) bind$rds(0xffffffffffffffff, &(0x7f0000000740)={0x2, 0x0, @remote}, 0x10) shmget(0x1, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) shmat(0x0, &(0x7f0000ffb000/0x2000)=nil, 0x0) perf_event_open(&(0x7f0000000280)={0x2, 0x70, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x2, 0x4, 0xfffffffffffffffd, 0x9, 0x4, 0x0, 0x5, 0x0, 0xfffffffffffffff8, 0xed, 0x0, 0x2, 0x0, 0x3f, 0x0, 0xffffffff, 0xfffffffffffffffc, 0x0, 0x0, 0xffffffffffffffc0, 0x0, @perf_config_ext={0x20, 0xe9}, 0x0, 0x7fff, 0x0, 0x7, 0x1, 0x0, 0x9d2}, 0x0, 0x6, r0, 0x0) r3 = memfd_create(&(0x7f00000000c0)="000000008c00000000000000000000", 0x0) pwritev(r3, &(0x7f0000f50f90), 0x0, 0x81003) 22:30:20 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec007a44000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:20 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x1000000000000000, 0xfffffdfd, &(0x7f0000000180)}) 22:30:20 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x6800000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 571.476507] EXT4-fs (loop0): invalid inodes per group: 8192 [ 571.476507] 22:30:20 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x20000000, 0xfffffdfd, &(0x7f0000000180)}) 22:30:20 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000002000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:20 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec0fff44000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:20 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(0xffffffffffffffff, 0x4004af61, &(0x7f0000000200)) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @dev}, 0x10) ioctl$SIOCSIFMTU(0xffffffffffffffff, 0x8922, &(0x7f0000000440)={'veth0_to_bond\x00'}) syz_open_dev$sndtimer(&(0x7f00000007c0)='/dev/snd/timer\x00', 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xd, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r2 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) bind$rds(0xffffffffffffffff, &(0x7f0000000740)={0x2, 0x0, @remote}, 0x10) shmget(0x1, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) shmat(0x0, &(0x7f0000ffb000/0x2000)=nil, 0x0) perf_event_open(&(0x7f0000000280)={0x2, 0x70, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x2, 0x4, 0xfffffffffffffffd, 0x9, 0x4, 0x0, 0x5, 0x0, 0xfffffffffffffff8, 0xed, 0x0, 0x2, 0x0, 0x3f, 0x0, 0xffffffff, 0xfffffffffffffffc, 0x0, 0x0, 0xffffffffffffffc0, 0x0, @perf_config_ext={0x20, 0xe9}, 0x0, 0x7fff, 0x0, 0x7, 0x1, 0x0, 0x9d2}, 0x0, 0x6, r0, 0x0) r3 = memfd_create(&(0x7f00000000c0)="000000008c00000000000000000000", 0x0) pwritev(r3, &(0x7f0000f50f90), 0x0, 0x81003) 22:30:20 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000600000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:20 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:20 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x1000000, 0xfffffdfd, &(0x7f0000000180)}) 22:30:21 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec006c44000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:21 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0xffffff7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:21 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(0xffffffffffffffff, 0x4004af61, &(0x7f0000000200)) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @dev}, 0x10) ioctl$SIOCSIFMTU(0xffffffffffffffff, 0x8922, &(0x7f0000000440)={'veth0_to_bond\x00'}) syz_open_dev$sndtimer(&(0x7f00000007c0)='/dev/snd/timer\x00', 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xd, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r2 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000780)) shmget(0x1, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) shmat(0x0, &(0x7f0000ffb000/0x2000)=nil, 0x0) perf_event_open(&(0x7f0000000280)={0x2, 0x70, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x2, 0x4, 0xfffffffffffffffd, 0x9, 0x4, 0x0, 0x5, 0x0, 0xfffffffffffffff8, 0xed, 0x0, 0x2, 0x0, 0x3f, 0x0, 0xffffffff, 0xfffffffffffffffc, 0x0, 0x0, 0xffffffffffffffc0, 0x0, @perf_config_ext={0x20, 0xe9}, 0x0, 0x7fff, 0x0, 0x7, 0x1, 0x0, 0x9d2}, 0x0, 0x6, r0, 0x0) r3 = memfd_create(&(0x7f00000000c0)="000000008c00000000000000000000", 0x0) pwritev(r3, &(0x7f0000f50f90), 0x0, 0x81003) 22:30:21 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x4, 0xfffffdfd, &(0x7f0000000180)}) 22:30:21 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001060000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 571.971979] EXT4-fs (loop0): invalid inodes per group: 8192 [ 571.971979] 22:30:21 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000007400001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:21 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec4c0044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:21 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x6c, 0xfffffdfd, &(0x7f0000000180)}) 22:30:21 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x48, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:21 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(0xffffffffffffffff, 0x4004af61, &(0x7f0000000200)) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @dev}, 0x10) ioctl$SIOCSIFMTU(0xffffffffffffffff, 0x8922, &(0x7f0000000440)={'veth0_to_bond\x00'}) syz_open_dev$sndtimer(&(0x7f00000007c0)='/dev/snd/timer\x00', 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xd, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) ioctl$LOOP_SET_FD(r1, 0x4c00, 0xffffffffffffffff) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000780)) shmget(0x1, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) shmat(0x0, &(0x7f0000ffb000/0x2000)=nil, 0x0) perf_event_open(&(0x7f0000000280)={0x2, 0x70, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x2, 0x4, 0xfffffffffffffffd, 0x9, 0x4, 0x0, 0x5, 0x0, 0xfffffffffffffff8, 0xed, 0x0, 0x2, 0x0, 0x3f, 0x0, 0xffffffff, 0xfffffffffffffffc, 0x0, 0x0, 0xffffffffffffffc0, 0x0, @perf_config_ext={0x20, 0xe9}, 0x0, 0x7fff, 0x0, 0x7, 0x1, 0x0, 0x9d2}, 0x0, 0x6, r0, 0x0) r2 = memfd_create(&(0x7f00000000c0)="000000008c00000000000000000000", 0x0) pwritev(r2, &(0x7f0000f50f90), 0x0, 0x81003) 22:30:21 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001012000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:21 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(0xffffffffffffffff, 0x4004af61, &(0x7f0000000200)) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @dev}, 0x10) ioctl$SIOCSIFMTU(0xffffffffffffffff, 0x8922, &(0x7f0000000440)={'veth0_to_bond\x00'}) syz_open_dev$sndtimer(&(0x7f00000007c0)='/dev/snd/timer\x00', 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xd, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, r1) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000780)) shmget(0x1, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) shmat(0x0, &(0x7f0000ffb000/0x2000)=nil, 0x0) perf_event_open(&(0x7f0000000280)={0x2, 0x70, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x2, 0x4, 0xfffffffffffffffd, 0x9, 0x4, 0x0, 0x5, 0x0, 0xfffffffffffffff8, 0xed, 0x0, 0x2, 0x0, 0x3f, 0x0, 0xffffffff, 0xfffffffffffffffc, 0x0, 0x0, 0xffffffffffffffc0, 0x0, @perf_config_ext={0x20, 0xe9}, 0x0, 0x7fff, 0x0, 0x7, 0x1, 0x0, 0x9d2}, 0x0, 0x6, r0, 0x0) r2 = memfd_create(&(0x7f00000000c0)="000000008c00000000000000000000", 0x0) pwritev(r2, &(0x7f0000f50f90), 0x0, 0x81003) 22:30:21 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x12000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:21 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x74000000, 0xfffffdfd, &(0x7f0000000180)}) [ 572.294056] EXT4-fs (loop0): invalid inodes per group: 8192 [ 572.294056] 22:30:21 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec060044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 572.417930] binder_transaction: 66 callbacks suppressed [ 572.417948] binder: 6461:6469 transaction failed 29189/-22, size 0-0 line 2834 [ 572.439652] binder_thread_write: 37 callbacks suppressed [ 572.439672] binder: 6470:6473 Acquire 1 refcount change on invalid ref 0 ret -22 [ 572.439913] binder_release_work: 65 callbacks suppressed [ 572.439920] binder: undelivered TRANSACTION_ERROR: 29189 22:30:21 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000068001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 572.460066] binder_transaction: 15 callbacks suppressed [ 572.460074] binder: 6470:6473 got transaction to invalid handle [ 572.495511] binder: 6475:6477 Acquire 1 refcount change on invalid ref 4 ret -22 22:30:21 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(0xffffffffffffffff, 0x4004af61, &(0x7f0000000200)) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @dev}, 0x10) ioctl$SIOCSIFMTU(0xffffffffffffffff, 0x8922, &(0x7f0000000440)={'veth0_to_bond\x00'}) syz_open_dev$sndtimer(&(0x7f00000007c0)='/dev/snd/timer\x00', 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xd, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, r1) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000780)) shmget(0x1, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) shmat(0x0, &(0x7f0000ffb000/0x2000)=nil, 0x0) perf_event_open(&(0x7f0000000280)={0x2, 0x70, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x2, 0x4, 0xfffffffffffffffd, 0x9, 0x4, 0x0, 0x5, 0x0, 0xfffffffffffffff8, 0xed, 0x0, 0x2, 0x0, 0x3f, 0x0, 0xffffffff, 0xfffffffffffffffc, 0x0, 0x0, 0xffffffffffffffc0, 0x0, @perf_config_ext={0x20, 0xe9}, 0x0, 0x7fff, 0x0, 0x7, 0x1, 0x0, 0x9d2}, 0x0, 0x6, r0, 0x0) r2 = memfd_create(&(0x7f00000000c0)="000000008c00000000000000000000", 0x0) pwritev(r2, &(0x7f0000f50f90), 0x0, 0x81003) [ 572.539937] binder: 6461:6483 transaction failed 29189/-22, size 0-0 line 2834 [ 572.546709] binder: 6470:6473 transaction failed 29201/-22, size 0-0 line 2834 [ 572.562373] EXT4-fs (loop0): invalid inodes per group: 8192 [ 572.562373] [ 572.571861] binder_thread_write: 12 callbacks suppressed [ 572.571874] binder: 6475:6477 BC_FREE_BUFFER u0000000000000000 no match [ 572.586278] binder: undelivered TRANSACTION_ERROR: 29189 [ 572.602227] binder: undelivered TRANSACTION_ERROR: 29189 [ 572.611256] binder: undelivered TRANSACTION_ERROR: 29201 22:30:21 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000480001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:21 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x4800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:21 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec102044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 572.656712] binder: 6480:6495 transaction failed 29189/-22, size 0-0 line 2834 [ 572.711429] binder: 6498:6499 Acquire 1 refcount change on invalid ref 0 ret -22 [ 572.720551] binder_thread_write: 12 callbacks suppressed [ 572.720560] binder: 6475:6477 ERROR: BC_REGISTER_LOOPER called without request 22:30:21 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(0xffffffffffffffff, 0x4004af61, &(0x7f0000000200)) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @dev}, 0x10) ioctl$SIOCSIFMTU(0xffffffffffffffff, 0x8922, &(0x7f0000000440)={'veth0_to_bond\x00'}) syz_open_dev$sndtimer(&(0x7f00000007c0)='/dev/snd/timer\x00', 0x0, 0x0) r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000780)) shmget(0x1, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) shmat(0x0, &(0x7f0000ffb000/0x2000)=nil, 0x0) perf_event_open(&(0x7f0000000280)={0x2, 0x70, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x2, 0x4, 0xfffffffffffffffd, 0x9, 0x4, 0x0, 0x5, 0x0, 0xfffffffffffffff8, 0xed, 0x0, 0x2, 0x0, 0x3f, 0x0, 0xffffffff, 0xfffffffffffffffc, 0x0, 0x0, 0xffffffffffffffc0, 0x0, @perf_config_ext={0x20, 0xe9}, 0x0, 0x7fff, 0x0, 0x7, 0x1, 0x0, 0x9d2}, 0x0, 0x6, 0xffffffffffffffff, 0x0) r2 = memfd_create(&(0x7f00000000c0)="000000008c00000000000000000000", 0x0) pwritev(r2, &(0x7f0000f50f90), 0x0, 0x81003) [ 572.764883] binder: 6498:6499 got transaction to invalid handle [ 572.796276] binder: 6498:6499 transaction failed 29201/-22, size 0-0 line 2834 [ 572.796677] binder: 6503:6509 transaction failed 29189/-22, size 0-0 line 2834 [ 572.818092] binder: 6480:6510 transaction failed 29189/-22, size 0-0 line 2834 [ 572.859899] binder: 6498:6499 Acquire 1 refcount change on invalid ref 0 ret -22 [ 572.872242] binder: undelivered TRANSACTION_ERROR: 29189 [ 572.877743] binder: undelivered TRANSACTION_ERROR: 29189 [ 572.878687] binder: 6503:6514 transaction failed 29189/-22, size 0-0 line 2834 [ 572.889918] binder: 6498:6499 got transaction to invalid handle [ 572.896885] binder: undelivered TRANSACTION_ERROR: 29201 22:30:22 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x7400000000000000, 0xfffffdfd, &(0x7f0000000180)}) 22:30:22 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000007a001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:22 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 572.926927] binder: 6498:6499 transaction failed 29201/-22, size 0-0 line 2834 [ 572.936088] binder: undelivered TRANSACTION_ERROR: 29201 [ 572.954354] EXT4-fs (loop0): invalid inodes per group: 8192 [ 572.954354] [ 572.961198] binder: undelivered TRANSACTION_ERROR: 29189 [ 572.967219] binder: undelivered TRANSACTION_ERROR: 29189 22:30:22 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001068000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:22 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec000544000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 573.029283] binder: 6524:6526 Acquire 1 refcount change on invalid ref 4 ret -22 [ 573.058323] binder: 6531:6532 Acquire 1 refcount change on invalid ref 0 ret -22 [ 573.059439] binder: 6524:6526 BC_FREE_BUFFER u0000000000000000 no match [ 573.074746] binder: 6524:6526 ERROR: BC_REGISTER_LOOPER called without request [ 573.097152] binder: 6531:6532 got transaction to invalid handle 22:30:22 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(0xffffffffffffffff, 0x4004af61, &(0x7f0000000200)) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @dev}, 0x10) ioctl$SIOCSIFMTU(0xffffffffffffffff, 0x8922, &(0x7f0000000440)={'veth0_to_bond\x00'}) r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000780)) shmget(0x1, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) shmat(0x0, &(0x7f0000ffb000/0x2000)=nil, 0x0) perf_event_open(&(0x7f0000000280)={0x2, 0x70, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x2, 0x4, 0xfffffffffffffffd, 0x9, 0x4, 0x0, 0x5, 0x0, 0xfffffffffffffff8, 0xed, 0x0, 0x2, 0x0, 0x3f, 0x0, 0xffffffff, 0xfffffffffffffffc, 0x0, 0x0, 0xffffffffffffffc0, 0x0, @perf_config_ext={0x20, 0xe9}, 0x0, 0x7fff, 0x0, 0x7, 0x1, 0x0, 0x9d2}, 0x0, 0x6, 0xffffffffffffffff, 0x0) r2 = memfd_create(&(0x7f00000000c0)="000000008c00000000000000000000", 0x0) pwritev(r2, &(0x7f0000f50f90), 0x0, 0x81003) [ 573.130073] binder: 6531:6532 transaction failed 29201/-22, size 0-0 line 2834 22:30:22 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x6c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:22 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x200000000000000, 0xfffffdfd, &(0x7f0000000180)}) [ 573.215576] EXT4-fs (loop0): invalid inodes per group: 8192 [ 573.215576] [ 573.288935] binder: 6559:6563 Acquire 1 refcount change on invalid ref 0 ret -22 22:30:22 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000006001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:22 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001004000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:22 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec002d44000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 573.329080] binder: 6561:6562 Acquire 1 refcount change on invalid ref 4 ret -22 [ 573.339807] binder: 6559:6563 got transaction to invalid handle [ 573.361706] binder: 6561:6562 BC_FREE_BUFFER u0000000000000000 no match 22:30:22 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x400000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 573.379777] binder: 6561:6562 ERROR: BC_REGISTER_LOOPER called without request 22:30:22 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(0xffffffffffffffff, 0x4004af61, &(0x7f0000000200)) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @dev}, 0x10) r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000780)) shmget(0x1, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) shmat(0x0, &(0x7f0000ffb000/0x2000)=nil, 0x0) perf_event_open(&(0x7f0000000280)={0x2, 0x70, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x2, 0x4, 0xfffffffffffffffd, 0x9, 0x4, 0x0, 0x5, 0x0, 0xfffffffffffffff8, 0xed, 0x0, 0x2, 0x0, 0x3f, 0x0, 0xffffffff, 0xfffffffffffffffc, 0x0, 0x0, 0xffffffffffffffc0, 0x0, @perf_config_ext={0x20, 0xe9}, 0x0, 0x7fff, 0x0, 0x7, 0x1, 0x0, 0x9d2}, 0x0, 0x6, 0xffffffffffffffff, 0x0) r2 = memfd_create(&(0x7f00000000c0)="000000008c00000000000000000000", 0x0) pwritev(r2, &(0x7f0000f50f90), 0x0, 0x81003) 22:30:22 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x10, 0xfffffdfd, &(0x7f0000000180)}) 22:30:22 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000070001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 573.581700] EXT4-fs (loop0): invalid inodes per group: 8192 [ 573.581700] [ 573.595146] binder: 6594:6596 Acquire 1 refcount change on invalid ref 0 ret -22 [ 573.607203] binder: 6600:6602 Acquire 1 refcount change on invalid ref 4 ret -22 [ 573.622310] binder: 6594:6596 got transaction to invalid handle [ 573.636621] EXT4-fs (loop0): invalid inodes per group: 8192 [ 573.636621] [ 573.648943] binder: 6594:6596 got transaction to invalid handle [ 573.656880] binder: 6600:6602 BC_FREE_BUFFER u0000000000000000 no match [ 573.679430] binder: 6600:6602 ERROR: BC_REGISTER_LOOPER called without request 22:30:22 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x3000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:22 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000e00000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:22 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec030044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:22 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x700000000000000, 0xfffffdfd, &(0x7f0000000180)}) 22:30:22 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000010004c0001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:22 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(0xffffffffffffffff, 0x4004af61, &(0x7f0000000200)) r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000780)) shmget(0x1, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) shmat(0x0, &(0x7f0000ffb000/0x2000)=nil, 0x0) perf_event_open(&(0x7f0000000280)={0x2, 0x70, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x2, 0x4, 0xfffffffffffffffd, 0x9, 0x4, 0x0, 0x5, 0x0, 0xfffffffffffffff8, 0xed, 0x0, 0x2, 0x0, 0x3f, 0x0, 0xffffffff, 0xfffffffffffffffc, 0x0, 0x0, 0xffffffffffffffc0, 0x0, @perf_config_ext={0x20, 0xe9}, 0x0, 0x7fff, 0x0, 0x7, 0x1, 0x0, 0x9d2}, 0x0, 0x6, 0xffffffffffffffff, 0x0) r2 = memfd_create(&(0x7f00000000c0)="000000008c00000000000000000000", 0x0) pwritev(r2, &(0x7f0000f50f90), 0x0, 0x81003) [ 573.851468] binder: 6624:6630 BC_FREE_BUFFER u0000000000000000 no match [ 573.869771] binder: 6624:6630 ERROR: BC_REGISTER_LOOPER called without request [ 573.882939] binder: 6629:6635 got transaction to invalid handle 22:30:23 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec004044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 573.915200] binder: 6624:6630 BC_FREE_BUFFER u0000000000000000 no match [ 573.928654] EXT4-fs (loop0): invalid inodes per group: 8192 [ 573.928654] [ 573.947407] binder: 6624:6630 ERROR: BC_REGISTER_LOOPER called without request 22:30:23 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x7a00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:23 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x400000000000000, 0xfffffdfd, &(0x7f0000000180)}) 22:30:23 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(0xffffffffffffffff, 0x4004af61, &(0x7f0000000200)) r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000780)) shmget(0x1, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) shmat(0x0, &(0x7f0000ffb000/0x2000)=nil, 0x0) perf_event_open(&(0x7f0000000280)={0x2, 0x70, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x2, 0x4, 0xfffffffffffffffd, 0x9, 0x4, 0x0, 0x5, 0x0, 0xfffffffffffffff8, 0xed, 0x0, 0x2, 0x0, 0x3f, 0x0, 0xffffffff, 0xfffffffffffffffc, 0x0, 0x0, 0xffffffffffffffc0, 0x0, @perf_config_ext={0x20, 0xe9}, 0x0, 0x7fff, 0x0, 0x7, 0x1, 0x0, 0x9d2}, 0x0, 0x6, 0xffffffffffffffff, 0x0) r2 = memfd_create(&(0x7f00000000c0)="000000008c00000000000000000000", 0x0) pwritev(r2, &(0x7f0000f50f90), 0x0, 0x81003) [ 574.133031] binder: 6662:6665 got transaction to invalid handle 22:30:23 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000009000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:23 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000022300000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:23 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec000300000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:23 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @dev}, 0x10) r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000780)) shmget(0x1, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) shmat(0x0, &(0x7f0000ffb000/0x2000)=nil, 0x0) perf_event_open(&(0x7f0000000280)={0x2, 0x70, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x2, 0x4, 0xfffffffffffffffd, 0x9, 0x4, 0x0, 0x5, 0x0, 0xfffffffffffffff8, 0xed, 0x0, 0x2, 0x0, 0x3f, 0x0, 0xffffffff, 0xfffffffffffffffc, 0x0, 0x0, 0xffffffffffffffc0, 0x0, @perf_config_ext={0x20, 0xe9}, 0x0, 0x7fff, 0x0, 0x7, 0x1, 0x0, 0x9d2}, 0x0, 0x6, 0xffffffffffffffff, 0x0) r2 = memfd_create(&(0x7f00000000c0)="000000008c00000000000000000000", 0x0) pwritev(r2, &(0x7f0000f50f90), 0x0, 0x81003) 22:30:23 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:23 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x6, 0xfffffdfd, &(0x7f0000000180)}) [ 574.353702] EXT4-fs (loop0): invalid inodes per group: 8192 [ 574.353702] [ 574.373142] binder: 6692:6696 got transaction to invalid handle [ 574.385096] binder: 6697:6698 BC_FREE_BUFFER u0000000000000000 no match 22:30:23 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0xa00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:23 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec000007000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 574.438212] binder: 6697:6698 ERROR: BC_REGISTER_LOOPER called without request 22:30:23 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000063000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:23 executing program 5: bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @dev}, 0x10) r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000780)) shmget(0x1, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) shmat(0x0, &(0x7f0000ffb000/0x2000)=nil, 0x0) perf_event_open(&(0x7f0000000280)={0x2, 0x70, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x2, 0x4, 0xfffffffffffffffd, 0x9, 0x4, 0x0, 0x5, 0x0, 0xfffffffffffffff8, 0xed, 0x0, 0x2, 0x0, 0x3f, 0x0, 0xffffffff, 0xfffffffffffffffc, 0x0, 0x0, 0xffffffffffffffc0, 0x0, @perf_config_ext={0x20, 0xe9}, 0x0, 0x7fff, 0x0, 0x7, 0x1, 0x0, 0x9d2}, 0x0, 0x6, 0xffffffffffffffff, 0x0) r2 = memfd_create(&(0x7f00000000c0)="000000008c00000000000000000000", 0x0) pwritev(r2, &(0x7f0000f50f90), 0x0, 0x81003) 22:30:23 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000200000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:23 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x7a, 0xfffffdfd, &(0x7f0000000180)}) [ 574.585502] binder: 6712:6722 BC_FREE_BUFFER u0000000000000000 no match 22:30:23 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec007444000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:23 executing program 5: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @dev}, 0x10) r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000780)) shmget(0x1, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) shmat(0x0, &(0x7f0000ffb000/0x2000)=nil, 0x0) perf_event_open(&(0x7f0000000280)={0x2, 0x70, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x2, 0x4, 0xfffffffffffffffd, 0x9, 0x4, 0x0, 0x5, 0x0, 0xfffffffffffffff8, 0xed, 0x0, 0x2, 0x0, 0x3f, 0x0, 0xffffffff, 0xfffffffffffffffc, 0x0, 0x0, 0xffffffffffffffc0, 0x0, @perf_config_ext={0x20, 0xe9}, 0x0, 0x7fff, 0x0, 0x7, 0x1, 0x0, 0x9d2}, 0x0, 0x6, 0xffffffffffffffff, 0x0) r2 = memfd_create(&(0x7f00000000c0)="000000008c00000000000000000000", 0x0) pwritev(r2, &(0x7f0000f50f90), 0x0, 0x81003) 22:30:23 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x1000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 574.679780] binder: 6712:6722 ERROR: BC_REGISTER_LOOPER called without request 22:30:23 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000000000100000039b000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 574.766015] binder: 6712:6722 BC_FREE_BUFFER u0000000000000000 no match [ 574.774821] binder: 6712:6722 ERROR: BC_REGISTER_LOOPER called without request 22:30:24 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @dev}, 0x10) r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000780)) shmget(0x1, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) shmat(0x0, &(0x7f0000ffb000/0x2000)=nil, 0x0) perf_event_open(&(0x7f0000000280)={0x2, 0x70, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x2, 0x4, 0xfffffffffffffffd, 0x9, 0x4, 0x0, 0x5, 0x0, 0xfffffffffffffff8, 0xed, 0x0, 0x2, 0x0, 0x3f, 0x0, 0xffffffff, 0xfffffffffffffffc, 0x0, 0x0, 0xffffffffffffffc0, 0x0, @perf_config_ext={0x20, 0xe9}, 0x0, 0x7fff, 0x0, 0x7, 0x1, 0x0, 0x9d2}, 0x0, 0x6, 0xffffffffffffffff, 0x0) r2 = memfd_create(&(0x7f00000000c0)="000000008c00000000000000000000", 0x0) pwritev(r2, &(0x7f0000f50f90), 0x0, 0x81003) [ 574.814594] EXT4-fs (loop0): invalid inodes per group: 8192 [ 574.814594] 22:30:24 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x4c000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:24 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x15c, 0xfffffdfd, &(0x7f0000000180)}) fdatasync(r0) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$RTC_WIE_OFF(r1, 0x7010) 22:30:24 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000300001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 574.927252] EXT4-fs (loop0): invalid inodes per group: 8192 [ 574.927252] 22:30:24 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @dev}, 0x10) r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000780)) shmget(0x1, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) shmat(0x0, &(0x7f0000ffb000/0x2000)=nil, 0x0) perf_event_open(&(0x7f0000000280)={0x2, 0x70, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x2, 0x4, 0xfffffffffffffffd, 0x9, 0x4, 0x0, 0x5, 0x0, 0xfffffffffffffff8, 0xed, 0x0, 0x2, 0x0, 0x3f, 0x0, 0xffffffff, 0xfffffffffffffffc, 0x0, 0x0, 0xffffffffffffffc0, 0x0, @perf_config_ext={0x20, 0xe9}, 0x0, 0x7fff, 0x0, 0x7, 0x1, 0x0, 0x9d2}, 0x0, 0x6, 0xffffffffffffffff, 0x0) r2 = memfd_create(&(0x7f00000000c0)="000000008c00000000000000000000", 0x0) pwritev(r2, &(0x7f0000f50f90), 0x0, 0x81003) [ 574.970385] binder: 6770:6773 BC_FREE_BUFFER u0000000000000000 no match 22:30:24 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x300, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 575.037329] binder: 6770:6773 ERROR: BC_REGISTER_LOOPER called without request 22:30:24 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec002d44000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:24 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001048000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:24 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$mouse(&(0x7f0000000040)='/dev/input/mouse#\x00', 0xffffffff, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r1, 0x10e, 0xa, &(0x7f0000000080)=0x8, 0x4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_int(r3, 0x1, 0x1, &(0x7f000059dffc), &(0x7f0000000080)=0x1027e) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="c96b30bdd5ad05638476132b22ed8b050b01400400", @ANYRES64=0x0, @ANYBLOB='\vc\x00\x00'], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:24 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x7400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:24 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec002344000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:24 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @dev}, 0x10) r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000780)) shmget(0x1, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) shmat(0x0, &(0x7f0000ffb000/0x2000)=nil, 0x0) perf_event_open(&(0x7f0000000280)={0x2, 0x70, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x2, 0x4, 0xfffffffffffffffd, 0x9, 0x4, 0x0, 0x5, 0x0, 0xfffffffffffffff8, 0xed, 0x0, 0x2, 0x0, 0x3f, 0x0, 0xffffffff, 0xfffffffffffffffc, 0x0, 0x0, 0xffffffffffffffc0, 0x0, @perf_config_ext={0x20, 0xe9}, 0x0, 0x7fff, 0x0, 0x7, 0x1, 0x0, 0x9d2}, 0x0, 0x6, 0xffffffffffffffff, 0x0) r2 = memfd_create(&(0x7f00000000c0)="000000008c00000000000000000000", 0x0) pwritev(r2, &(0x7f0000f50f90), 0x0, 0x81003) 22:30:24 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000006c00001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 575.260440] binder: 6804:6812 unknown command -1120900151 [ 575.286741] binder: 6804:6812 ioctl c0306201 20000140 returned -22 22:30:24 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x6000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:24 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000600001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 575.358462] EXT4-fs (loop0): invalid inodes per group: 8192 [ 575.358462] 22:30:24 executing program 1: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000180)='/dev/zero\x00', 0x101002, 0x0) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffff9c, 0xc00c642d, &(0x7f0000000040)={0x0, 0x0, 0xffffffffffffff9c}) r2 = syz_open_dev$media(&(0x7f0000000080)='/dev/media#\x00', 0x1, 0x80) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f00000000c0)={r1, 0x80000, r2}) syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$KDSETLED(r0, 0x4b32, 0x2) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000240)={0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0xffffffffffffff1b, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES64=r3, @ANYBLOB="03630840", @ANYRES64=0x0, @ANYBLOB="0f630c40020000000400000000000000"], 0x0, 0xfffffdfd, &(0x7f00000001c0)}) 22:30:24 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec000844000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:24 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @dev}, 0x10) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, r0) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000780)) shmget(0x1, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) shmat(0x0, &(0x7f0000ffb000/0x2000)=nil, 0x0) perf_event_open(&(0x7f0000000280)={0x2, 0x70, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x2, 0x4, 0xfffffffffffffffd, 0x9, 0x4, 0x0, 0x5, 0x0, 0xfffffffffffffff8, 0xed, 0x0, 0x2, 0x0, 0x3f, 0x0, 0xffffffff, 0xfffffffffffffffc, 0x0, 0x0, 0xffffffffffffffc0, 0x0, @perf_config_ext={0x20, 0xe9}, 0x0, 0x7fff, 0x0, 0x7, 0x1, 0x0, 0x9d2}, 0x0, 0x6, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f00000000c0)="000000008c00000000000000000000", 0x0) pwritev(r1, &(0x7f0000f50f90), 0x0, 0x81003) 22:30:24 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0xa000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:24 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='memory.swap.current\x00', 0x0, 0x0) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'team_slave_1\x00'}) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="05630440040000000363e53f", @ANYRES64=0x0, @ANYBLOB="2c69041b"], 0xfffffd0e, 0xfffffdfd, &(0x7f0000000180)}) [ 575.648637] EXT4-fs (loop0): invalid inodes per group: 8192 [ 575.648637] 22:30:24 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x5000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:24 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000006c001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:24 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @dev}, 0x10) r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x4c00, 0xffffffffffffffff) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000780)) shmget(0x1, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) shmat(0x0, &(0x7f0000ffb000/0x2000)=nil, 0x0) perf_event_open(&(0x7f0000000280)={0x2, 0x70, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x2, 0x4, 0xfffffffffffffffd, 0x9, 0x4, 0x0, 0x5, 0x0, 0xfffffffffffffff8, 0xed, 0x0, 0x2, 0x0, 0x3f, 0x0, 0xffffffff, 0xfffffffffffffffc, 0x0, 0x0, 0xffffffffffffffc0, 0x0, @perf_config_ext={0x20, 0xe9}, 0x0, 0x7fff, 0x0, 0x7, 0x1, 0x0, 0x9d2}, 0x0, 0x6, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f00000000c0)="000000008c00000000000000000000", 0x0) pwritev(r1, &(0x7f0000f50f90), 0x0, 0x81003) 22:30:24 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000120001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 575.745994] EXT4-fs (loop0): invalid inodes per group: 8192 [ 575.745994] [ 575.762387] binder: 6872:6873 unknown command 1071997699 [ 575.801230] binder: 6872:6873 ioctl c0306201 20000140 returned -22 22:30:25 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec000344000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:25 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @dev}, 0x10) r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000780)) shmget(0xffffffffffffffff, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) shmat(0x0, &(0x7f0000ffb000/0x2000)=nil, 0x0) perf_event_open(&(0x7f0000000280)={0x2, 0x70, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x2, 0x4, 0xfffffffffffffffd, 0x9, 0x4, 0x0, 0x5, 0x0, 0xfffffffffffffff8, 0xed, 0x0, 0x2, 0x0, 0x3f, 0x0, 0xffffffff, 0xfffffffffffffffc, 0x0, 0x0, 0xffffffffffffffc0, 0x0, @perf_config_ext={0x20, 0xe9}, 0x0, 0x7fff, 0x0, 0x7, 0x1, 0x0, 0x9d2}, 0x0, 0x6, 0xffffffffffffffff, 0x0) r2 = memfd_create(&(0x7f00000000c0)="000000008c00000000000000000000", 0x0) pwritev(r2, &(0x7f0000f50f90), 0x0, 0x81003) 22:30:25 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) 22:30:25 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x7400000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:25 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000044000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 576.001073] EXT4-fs (loop0): invalid inodes per group: 8192 [ 576.001073] 22:30:25 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0xa00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:25 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:25 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000007001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:25 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec000444000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:25 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @dev}, 0x10) r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000780)) shmget(0xffffffffffffffff, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) shmat(0x0, &(0x7f0000ffb000/0x2000)=nil, 0x0) perf_event_open(&(0x7f0000000280)={0x0, 0x70, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x2, 0x4, 0xfffffffffffffffd, 0x9, 0x4, 0x0, 0x5, 0x0, 0xfffffffffffffff8, 0xed, 0x0, 0x2, 0x0, 0x3f, 0x0, 0xffffffff, 0xfffffffffffffffc, 0x0, 0x0, 0xffffffffffffffc0, 0x0, @perf_config_ext={0x20, 0xe9}, 0x0, 0x7fff, 0x0, 0x7, 0x1, 0x0, 0x9d2}, 0x0, 0x6, 0xffffffffffffffff, 0x0) r2 = memfd_create(&(0x7f00000000c0)="000000008c00000000000000000000", 0x0) pwritev(r2, &(0x7f0000f50f90), 0x0, 0x81003) 22:30:25 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000010000a0001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:25 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x600, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:25 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$xdp(0x2c, 0x3, 0x0) ioctl$sock_SIOCBRDELBR(r1, 0x89a1, &(0x7f0000000180)='team_slave_1\x00') r2 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x1ff, 0x10000) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f0000000040)={0x28, 0x2, 0x0, {0x0, 0x0, 0x9}}, 0x28) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0000000000000000000000c4e51519a2805e213170f238a100", @ANYRES64=0x0, @ANYBLOB='\vc\x00\x00'], 0x0, 0xfffffdfd, &(0x7f0000000180)}) socket$xdp(0x2c, 0x3, 0x0) [ 576.284129] EXT4-fs (loop0): invalid inodes per group: 8192 [ 576.284129] [ 576.398378] EXT4-fs (loop0): invalid inodes per group: 8192 [ 576.398378] [ 576.417574] binder: 6963:6965 unknown command 0 22:30:25 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @dev}, 0x10) r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000780)) shmget(0xffffffffffffffff, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) shmat(0x0, &(0x7f0000ffb000/0x2000)=nil, 0x0) perf_event_open(&(0x7f0000000280)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x2, 0x4, 0xfffffffffffffffd, 0x9, 0x4, 0x0, 0x5, 0x0, 0xfffffffffffffff8, 0xed, 0x0, 0x2, 0x0, 0x3f, 0x0, 0xffffffff, 0xfffffffffffffffc, 0x0, 0x0, 0xffffffffffffffc0, 0x0, @perf_config_ext={0x20, 0xe9}, 0x0, 0x7fff, 0x0, 0x7, 0x1, 0x0, 0x9d2}, 0x0, 0x6, 0xffffffffffffffff, 0x0) r2 = memfd_create(&(0x7f00000000c0)="000000008c00000000000000000000", 0x0) pwritev(r2, &(0x7f0000f50f90), 0x0, 0x81003) 22:30:25 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x74, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:25 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000030001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:25 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec004c44000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 576.469252] binder: 6963:6965 ioctl c0306201 20000140 returned -22 22:30:25 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000800000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:25 executing program 1: syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 22:30:25 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @dev}, 0x10) r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000780)) shmget(0xffffffffffffffff, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) shmat(0x0, &(0x7f0000ffb000/0x2000)=nil, 0x0) perf_event_open(&(0x7f0000000280)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x2, 0x4, 0xfffffffffffffffd, 0x9, 0x4, 0x0, 0x5, 0x0, 0xfffffffffffffff8, 0xed, 0x0, 0x2, 0x0, 0x3f, 0x0, 0xffffffff, 0xfffffffffffffffc, 0x0, 0x0, 0xffffffffffffffc0, 0x0, @perf_config_ext={0x20, 0xe9}, 0x0, 0x7fff, 0x0, 0x7, 0x1, 0x0, 0x9d2}, 0x0, 0x6, 0xffffffffffffffff, 0x0) r2 = memfd_create(&(0x7f00000000c0)="000000008c00000000000000000000", 0x0) pwritev(r2, &(0x7f0000f50f90), 0x0, 0x81003) 22:30:25 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x2000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:25 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec000244000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:25 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000680001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:25 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x1200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:25 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="056304400400000003630840", @ANYRES64=0x0, @ANYBLOB="0b63000010cef38acfdd2c38b93f9f297e6010c375247d857439972a26fb81edbf1f9fc4b9404df09c7e9c5fa58ba06efd81ed7952c4b1aee19b8e7b76c03226f71e785aa1"], 0x0, 0xfffffdfd, &(0x7f0000000180)}) r1 = syz_open_dev$adsp(&(0x7f00000000c0)='/dev/adsp#\x00', 0x85, 0x4800c0) ioctl$LOOP_CLR_FD(r1, 0x4c01) setsockopt$IP_VS_SO_SET_DELDEST(r1, 0x0, 0x488, &(0x7f0000000180)={{0x0, @loopback, 0x4e24, 0x1, 'fo\x00', 0x4, 0x1, 0x2a}, {@multicast2, 0x4e21, 0x3, 0x100000001, 0x800000000000, 0x1}}, 0x44) 22:30:26 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @dev}, 0x10) r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000780)) shmget(0xffffffffffffffff, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) shmat(0x0, &(0x7f0000ffb000/0x2000)=nil, 0x0) perf_event_open(&(0x7f0000000280)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, 0xfffffffffffffffd, 0x9, 0x4, 0x0, 0x5, 0x0, 0xfffffffffffffff8, 0xed, 0x0, 0x2, 0x0, 0x3f, 0x0, 0xffffffff, 0xfffffffffffffffc, 0x0, 0x0, 0xffffffffffffffc0, 0x0, @perf_config_ext={0x20, 0xe9}, 0x0, 0x7fff, 0x0, 0x7, 0x1, 0x0, 0x9d2}, 0x0, 0x6, 0xffffffffffffffff, 0x0) r2 = memfd_create(&(0x7f00000000c0)="000000008c00000000000000000000", 0x0) pwritev(r2, &(0x7f0000f50f90), 0x0, 0x81003) 22:30:26 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000d00000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 576.917621] EXT4-fs (loop0): invalid inodes per group: 8192 [ 576.917621] 22:30:26 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:26 executing program 1: r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x200000, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000000c0)={r0, 0x50, &(0x7f0000000040)}, 0x10) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="056304400400000003630840", @ANYRES64=0x0, @ANYBLOB="0e11012f070b9675ddeae90a430000000000000000f109434f66e082c257ec081018e7934d5c73038e2a8c1ebb417c6c66be3d7f6e638e2047f3aa449506b7d18c3ffadd17d1ab5512bcf694f356e1e8cf3c262b8a4baaef1e7c7d628520921ba95e083b7c93653e6b66995fac2ff94ff3928766e4fb7a00000000000000000000"], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:26 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @dev}, 0x10) r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000780)) shmget(0xffffffffffffffff, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) shmat(0x0, &(0x7f0000ffb000/0x2000)=nil, 0x0) perf_event_open(&(0x7f0000000280)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0xfffffffffffffffd, 0x9, 0x4, 0x0, 0x5, 0x0, 0xfffffffffffffff8, 0xed, 0x0, 0x2, 0x0, 0x3f, 0x0, 0xffffffff, 0xfffffffffffffffc, 0x0, 0x0, 0xffffffffffffffc0, 0x0, @perf_config_ext={0x20, 0xe9}, 0x0, 0x7fff, 0x0, 0x7, 0x1, 0x0, 0x9d2}, 0x0, 0x6, 0xffffffffffffffff, 0x0) r2 = memfd_create(&(0x7f00000000c0)="000000008c00000000000000000000", 0x0) pwritev(r2, &(0x7f0000f50f90), 0x0, 0x81003) 22:30:26 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec006c44000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:26 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000000000100000003f000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 577.138057] binder: 7048:7051 unknown command 788599054 [ 577.184547] binder: 7048:7051 ioctl c0306201 20000140 returned -22 [ 577.188137] EXT4-fs (loop0): invalid inodes per group: 8192 [ 577.188137] 22:30:26 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x20000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:26 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @dev}, 0x10) r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000780)) shmget(0xffffffffffffffff, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) shmat(0x0, &(0x7f0000ffb000/0x2000)=nil, 0x0) perf_event_open(&(0x7f0000000280)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x9, 0x4, 0x0, 0x5, 0x0, 0xfffffffffffffff8, 0xed, 0x0, 0x2, 0x0, 0x3f, 0x0, 0xffffffff, 0xfffffffffffffffc, 0x0, 0x0, 0xffffffffffffffc0, 0x0, @perf_config_ext={0x20, 0xe9}, 0x0, 0x7fff, 0x0, 0x7, 0x1, 0x0, 0x9d2}, 0x0, 0x6, 0xffffffffffffffff, 0x0) r2 = memfd_create(&(0x7f00000000c0)="000000008c00000000000000000000", 0x0) pwritev(r2, &(0x7f0000f50f90), 0x0, 0x81003) 22:30:26 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000040)={0x0, 0xffffffffffffff9c, 0x0, 0xd, &(0x7f0000000000)='/dev/binder#\x00'}, 0x30) close(r0) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000540)='/dev/vcs\x00', 0x402, 0x0) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r2, 0x84, 0x10, &(0x7f0000000080)=@sack_info={0x0, 0x4, 0x3}, &(0x7f00000004c0)=0xc) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r2, 0x84, 0x22, &(0x7f0000000500)={0x98e, 0x0, 0xffffffffffffff4d, 0x8, r3}, 0x10) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0x0, 0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000180)=',cpuset\x00', 0xffffffffffffffff}, 0x30) ioctl$KVM_ASSIGN_SET_INTX_MASK(r2, 0x4040aea4, &(0x7f00000002c0)={0x3, 0x6, 0xea, 0x2, 0x6}) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000200)={r1, r2, 0x0, 0x6, &(0x7f00000000c0)='em1}%\x00', r4}, 0x30) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f00000003c0)={0x0, 0x18, 0xfa00, {0x10001, &(0x7f0000000380)={0xffffffffffffffff}, 0x0, 0x7}}, 0x20) fcntl$F_GET_FILE_RW_HINT(r0, 0x40d, &(0x7f0000000440)) write$RDMA_USER_CM_CMD_SET_OPTION(r2, &(0x7f0000000400)={0xe, 0x18, 0xfa00, @id_tos={&(0x7f0000000340)=0x9, r5, 0x0, 0x0, 0x1}}, 0x20) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="056304400400000003630840", @ANYRES64=0x0, @ANYBLOB="fb5ce0"], 0x0, 0xfffffdfd, &(0x7f0000000180)}) r6 = semget(0x0, 0x3, 0x208) semctl$GETVAL(r6, 0xbdcc1a2df8925338, 0xc, &(0x7f0000000240)=""/119) getitimer(0x0, &(0x7f0000000480)) 22:30:26 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000900000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:26 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000053000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:26 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec00004f000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 577.426165] binder_transaction: 68 callbacks suppressed [ 577.426182] binder: 7090:7092 transaction failed 29201/-22, size 0-0 line 2834 [ 577.478246] binder: 7087:7088 transaction failed 29189/-22, size 0-0 line 2834 [ 577.509415] EXT4-fs (loop0): invalid inodes per group: 8192 [ 577.509415] [ 577.517731] binder_thread_write: 36 callbacks suppressed 22:30:26 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000180)='/dev/snapshot\x00', 0x10000, 0x0) connect(r1, &(0x7f00000001c0)=@sco={0x1f, {0x2, 0x4c50, 0x8, 0x9, 0xb73c, 0x80000001}}, 0x80) setsockopt$inet_sctp_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000240)={0x20, 0xffffe00000000000, 0x400, 0x6, 0x3ff, 0x4, 0x5, 0xcd, 0x0, 0xffffffff, 0x9}, 0xb) r2 = accept4$packet(0xffffffffffffff9c, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14, 0x0) ioctl$sock_inet_SIOCGIFBRDADDR(r2, 0x8919, &(0x7f0000000080)={'dummy0\x00', {0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x17}}}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="056304400400000003630840", @ANYRES64=0x0, @ANYBLOB="0b63d0e5a53490b971626d22a80000c740755518a37431efad07b8434ef1b6"], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:26 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @dev}, 0x10) r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000780)) shmget(0xffffffffffffffff, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) shmat(0x0, &(0x7f0000ffb000/0x2000)=nil, 0x0) perf_event_open(&(0x7f0000000280)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x9, 0x4, 0x0, 0x5, 0x0, 0xfffffffffffffff8, 0xed, 0x0, 0x2, 0x0, 0x3f, 0x0, 0xffffffff, 0xfffffffffffffffc, 0x0, 0x0, 0xffffffffffffffc0, 0x0, @perf_config_ext={0x20, 0xe9}, 0x0, 0x7fff, 0x0, 0x7, 0x1, 0x0, 0x9d2}, 0x0, 0x6, 0xffffffffffffffff, 0x0) r2 = memfd_create(&(0x7f00000000c0)="000000008c00000000000000000000", 0x0) pwritev(r2, &(0x7f0000f50f90), 0x0, 0x81003) [ 577.517746] binder: 7090:7092 Acquire 1 refcount change on invalid ref 0 ret -22 [ 577.530115] binder: 7101:7110 transaction failed 29189/-22, size 0-0 line 2834 [ 577.560967] binder_release_work: 69 callbacks suppressed [ 577.560974] binder: undelivered TRANSACTION_ERROR: 29201 [ 577.575149] binder_transaction: 19 callbacks suppressed [ 577.575158] binder: 7090:7092 got transaction to invalid handle [ 577.608832] binder: 7101:7119 transaction failed 29189/-22, size 0-0 line 2834 [ 577.619971] binder: 7118:7121 Acquire 1 refcount change on invalid ref 4 ret -22 [ 577.626574] binder: 7090:7092 transaction failed 29201/-22, size 0-0 line 2834 [ 577.672185] binder: undelivered TRANSACTION_ERROR: 29189 [ 577.678488] binder: undelivered TRANSACTION_ERROR: 29189 [ 577.678810] binder: 7087:7129 transaction failed 29189/-22, size 0-0 line 2834 [ 577.698203] binder_thread_write: 6 callbacks suppressed [ 577.698215] binder: 7118:7121 BC_FREE_BUFFER u0000000000000000 no match [ 577.713503] binder: undelivered TRANSACTION_ERROR: 29201 22:30:26 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001003000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:26 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:26 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec000025000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 577.728038] binder: undelivered TRANSACTION_ERROR: 29189 [ 577.744015] binder: undelivered TRANSACTION_ERROR: 29189 [ 577.751286] binder: 7118:7121 unknown command -439327989 22:30:26 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @dev}, 0x10) r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000780)) shmget(0xffffffffffffffff, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) shmat(0x0, &(0x7f0000ffb000/0x2000)=nil, 0x0) perf_event_open(&(0x7f0000000280)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0xfffffffffffffffd, 0x0, 0x4, 0x0, 0x5, 0x0, 0xfffffffffffffff8, 0xed, 0x0, 0x2, 0x0, 0x3f, 0x0, 0xffffffff, 0xfffffffffffffffc, 0x0, 0x0, 0xffffffffffffffc0, 0x0, @perf_config_ext={0x20, 0xe9}, 0x0, 0x7fff, 0x0, 0x7, 0x1, 0x0, 0x9d2}, 0x0, 0x6, 0xffffffffffffffff, 0x0) r2 = memfd_create(&(0x7f00000000c0)="000000008c00000000000000000000", 0x0) pwritev(r2, &(0x7f0000f50f90), 0x0, 0x81003) [ 577.777747] binder: 7118:7121 ioctl c0306201 20000140 returned -22 22:30:26 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000600001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 577.831798] binder: 7135:7136 Acquire 1 refcount change on invalid ref 0 ret -22 [ 577.840516] binder: 7118:7137 Acquire 1 refcount change on invalid ref 4 ret -22 [ 577.849387] binder: 7118:7137 BC_FREE_BUFFER u0000000000000000 no match [ 577.859688] binder: 7135:7136 got transaction to invalid handle [ 577.865807] binder: 7135:7136 transaction failed 29201/-22, size 0-0 line 2834 [ 577.878221] binder: 7118:7137 unknown command -439327989 [ 577.907734] EXT4-fs (loop0): invalid inodes per group: 8192 [ 577.907734] [ 577.915051] binder: 7118:7137 ioctl c0306201 20000140 returned -22 [ 577.924245] binder: 7134:7151 transaction failed 29189/-22, size 0-0 line 2834 22:30:27 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x2ef, 0x0, &(0x7f00000000c0)=[@release={0x40046306, 0x1}, @increfs_done={0x40106308, r1, 0x1}, @request_death={0x400c630e, 0x2, 0x2}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 577.953469] binder: undelivered TRANSACTION_ERROR: 29201 [ 577.981503] binder: 7134:7159 transaction failed 29189/-22, size 0-0 line 2834 22:30:27 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @dev}, 0x10) r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000780)) shmget(0xffffffffffffffff, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) shmat(0x0, &(0x7f0000ffb000/0x2000)=nil, 0x0) perf_event_open(&(0x7f0000000280)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x5, 0x0, 0xfffffffffffffff8, 0xed, 0x0, 0x2, 0x0, 0x3f, 0x0, 0xffffffff, 0xfffffffffffffffc, 0x0, 0x0, 0xffffffffffffffc0, 0x0, @perf_config_ext={0x20, 0xe9}, 0x0, 0x7fff, 0x0, 0x7, 0x1, 0x0, 0x9d2}, 0x0, 0x6, 0xffffffffffffffff, 0x0) r2 = memfd_create(&(0x7f00000000c0)="000000008c00000000000000000000", 0x0) pwritev(r2, &(0x7f0000f50f90), 0x0, 0x81003) [ 578.000827] binder: 7147:7161 transaction failed 29189/-22, size 0-0 line 2834 [ 578.043691] binder: undelivered TRANSACTION_ERROR: 29189 22:30:27 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec000a44000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:27 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0xffffff7f00000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:27 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000000000106c000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 578.049298] binder: undelivered TRANSACTION_ERROR: 29189 [ 578.068065] binder: 7166:7167 Release 1 refcount change on invalid ref 1 ret -22 [ 578.134338] binder: 7166:7167 BC_INCREFS_DONE u0000000000000000 no match [ 578.170076] binder: 7166:7167 BC_REQUEST_DEATH_NOTIFICATION invalid ref 2 22:30:27 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000a00001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 578.179833] binder: undelivered TRANSACTION_ERROR: 29189 [ 578.193901] binder: 7183:7184 Acquire 1 refcount change on invalid ref 0 ret -22 [ 578.200161] EXT4-fs (loop0): invalid inodes per group: 8192 [ 578.200161] [ 578.210079] binder: 7166:7167 unknown command 0 22:30:27 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec006044000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:27 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @dev}, 0x10) r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000780)) shmget(0xffffffffffffffff, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) shmat(0x0, &(0x7f0000ffb000/0x2000)=nil, 0x0) perf_event_open(&(0x7f0000000280)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0xfffffffffffffffd, 0x0, 0x4, 0x0, 0x0, 0x0, 0xfffffffffffffff8, 0xed, 0x0, 0x2, 0x0, 0x3f, 0x0, 0xffffffff, 0xfffffffffffffffc, 0x0, 0x0, 0xffffffffffffffc0, 0x0, @perf_config_ext={0x20, 0xe9}, 0x0, 0x7fff, 0x0, 0x7, 0x1, 0x0, 0x9d2}, 0x0, 0x6, 0xffffffffffffffff, 0x0) r2 = memfd_create(&(0x7f00000000c0)="000000008c00000000000000000000", 0x0) pwritev(r2, &(0x7f0000f50f90), 0x0, 0x81003) [ 578.241666] binder: 7166:7167 ioctl c0306201 20000080 returned -22 [ 578.248732] binder: 7183:7184 got transaction to invalid handle 22:30:27 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x3f000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 578.361081] EXT4-fs (loop0): invalid inodes per group: 8192 [ 578.361081] 22:30:27 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000010000003d1000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:27 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @dev}, 0x10) r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000780)) shmget(0xffffffffffffffff, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) shmat(0x0, &(0x7f0000ffb000/0x2000)=nil, 0x0) perf_event_open(&(0x7f0000000280)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0xfffffffffffffffd, 0x0, 0x4, 0x0, 0x5, 0x0, 0x0, 0xed, 0x0, 0x2, 0x0, 0x3f, 0x0, 0xffffffff, 0xfffffffffffffffc, 0x0, 0x0, 0xffffffffffffffc0, 0x0, @perf_config_ext={0x20, 0xe9}, 0x0, 0x7fff, 0x0, 0x7, 0x1, 0x0, 0x9d2}, 0x0, 0x6, 0xffffffffffffffff, 0x0) r2 = memfd_create(&(0x7f00000000c0)="000000008c00000000000000000000", 0x0) pwritev(r2, &(0x7f0000f50f90), 0x0, 0x81003) 22:30:27 executing program 1: r0 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x9, 0x101000) r1 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) getsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r0, 0x84, 0x12, &(0x7f0000000040), &(0x7f0000000080)=0x4) [ 578.471271] EXT4-fs (loop0): invalid inodes per group: 8192 [ 578.471271] 22:30:27 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @dev}, 0x10) r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000780)) shmget(0xffffffffffffffff, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) shmat(0x0, &(0x7f0000ffb000/0x2000)=nil, 0x0) perf_event_open(&(0x7f0000000280)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0xfffffffffffffffd, 0x0, 0x4, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x3f, 0x0, 0xffffffff, 0xfffffffffffffffc, 0x0, 0x0, 0xffffffffffffffc0, 0x0, @perf_config_ext={0x20, 0xe9}, 0x0, 0x7fff, 0x0, 0x7, 0x1, 0x0, 0x9d2}, 0x0, 0x6, 0xffffffffffffffff, 0x0) r2 = memfd_create(&(0x7f00000000c0)="000000008c00000000000000000000", 0x0) pwritev(r2, &(0x7f0000f50f90), 0x0, 0x81003) [ 578.530551] binder: 7223:7224 Acquire 1 refcount change on invalid ref 0 ret -22 [ 578.563174] binder: 7225:7227 Acquire 1 refcount change on invalid ref 4 ret -22 22:30:27 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec000944000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:27 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000006000001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 578.594487] binder: 7225:7227 BC_FREE_BUFFER u0000000000000000 no match [ 578.604732] binder_thread_write: 5 callbacks suppressed [ 578.604741] binder: 7225:7227 ERROR: BC_REGISTER_LOOPER called without request [ 578.614778] binder: 7223:7224 got transaction to invalid handle [ 578.627602] binder: 7225:7235 Acquire 1 refcount change on invalid ref 4 ret -22 22:30:27 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001074f5bc9f000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 578.651961] binder: 7225:7235 BC_FREE_BUFFER u0000000000000000 no match [ 578.689973] binder: 7225:7235 ERROR: BC_REGISTER_LOOPER called without request 22:30:27 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x4) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000000c0)={{0x9, 0x5}, 0x0, 0x7, 0x3, {0x5}, 0xffffffffffff0001, 0x8}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) r1 = fcntl$dupfd(r0, 0x406, r0) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000000)={0x0, @rand_addr, @remote}, &(0x7f0000000040)=0xc) 22:30:27 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x1200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 578.761557] EXT4-fs (loop0): invalid inodes per group: 8192 [ 578.761557] 22:30:28 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @dev}, 0x10) r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000780)) shmget(0xffffffffffffffff, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) shmat(0x0, &(0x7f0000ffb000/0x2000)=nil, 0x0) perf_event_open(&(0x7f0000000280)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0xfffffffffffffffd, 0x0, 0x4, 0x0, 0x5, 0x0, 0x0, 0xed, 0x0, 0x0, 0x0, 0x3f, 0x0, 0xffffffff, 0xfffffffffffffffc, 0x0, 0x0, 0xffffffffffffffc0, 0x0, @perf_config_ext={0x20, 0xe9}, 0x0, 0x7fff, 0x0, 0x7, 0x1, 0x0, 0x9d2}, 0x0, 0x6, 0xffffffffffffffff, 0x0) r2 = memfd_create(&(0x7f00000000c0)="000000008c00000000000000000000", 0x0) pwritev(r2, &(0x7f0000f50f90), 0x0, 0x81003) [ 578.840724] binder: 7265:7266 Acquire 1 refcount change on invalid ref 0 ret -22 [ 578.840812] binder: 7261:7267 ioctl c058534f 200000c0 returned -22 22:30:28 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec000644000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 578.909745] binder: 7261:7273 BC_FREE_BUFFER u0000000000000000 no match [ 578.933770] binder: 7265:7266 got transaction to invalid handle 22:30:28 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001007000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 578.955449] binder: 7261:7273 ERROR: BC_REGISTER_LOOPER called without request 22:30:28 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 578.997076] binder: 7261:7267 ioctl c058534f 200000c0 returned -22 [ 578.997084] binder: 7261:7273 BC_FREE_BUFFER u0000000000000000 no match [ 578.997098] binder: 7261:7273 ERROR: BC_REGISTER_LOOPER called without request 22:30:28 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000001200001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:28 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @dev}, 0x10) r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000780)) shmget(0xffffffffffffffff, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) shmat(0x0, &(0x7f0000ffb000/0x2000)=nil, 0x0) perf_event_open(&(0x7f0000000280)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0xfffffffffffffffd, 0x0, 0x4, 0x0, 0x5, 0x0, 0x0, 0xed, 0x0, 0x2, 0x0, 0x0, 0x0, 0xffffffff, 0xfffffffffffffffc, 0x0, 0x0, 0xffffffffffffffc0, 0x0, @perf_config_ext={0x20, 0xe9}, 0x0, 0x7fff, 0x0, 0x7, 0x1, 0x0, 0x9d2}, 0x0, 0x6, 0xffffffffffffffff, 0x0) r2 = memfd_create(&(0x7f00000000c0)="000000008c00000000000000000000", 0x0) pwritev(r2, &(0x7f0000f50f90), 0x0, 0x81003) 22:30:28 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000240)='/dev/binder#\x00', 0x0, 0x800) ioctl$DRM_IOCTL_GET_MAP(r0, 0xc0286404, &(0x7f0000000000)={&(0x7f0000ffc000/0x1000)=nil, 0x3, 0x5, 0xe1, &(0x7f0000ffa000/0x4000)=nil, 0x1ff}) io_setup(0x80000001, &(0x7f0000000040)=0x0) io_setup(0x9, &(0x7f0000001340)) r2 = memfd_create(&(0x7f0000001280)='/dev/binder#\x00', 0x0) r3 = openat$zero(0xffffffffffffff9c, &(0x7f00000012c0)='/dev/zero\x00', 0x400, 0x0) fanotify_mark(r2, 0x84, 0xa, r3, &(0x7f0000001300)='./file0\x00') socketpair(0xf, 0x1, 0x3, &(0x7f0000000180)={0xffffffffffffffff}) io_cancel(r1, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x5, 0x4, r0, &(0x7f0000000280)="bbcc7c1ea5775ea1a055ddbc2fba2c06c75e10001c8a21912d7881d0483c2ba68a636a4d99eea2898ba50c71ed6a6e2f23aaf4959c9f661b3f87c12246cae4fa5c53f405015657f21193ed7ab5358fd3211f05a9af0e4566f633bdcf0eb909c0ade3f80fbc1afef0849be831ebf42305ce55c684b195da5192eb41dc13f13c70df5e6f0ffb6e318b60013a5e1c7e78035a0fc97693f50242b06eaba04f8f3a8a8f5834eb977a8cd793e05eb8271a577cdac435cdc315f388825906daef438794a85a9776df24b713880d7df5c2aa738f8be1652643d58f4fca3cc4635e7ef525caff0569cbc3b5c25d33a37a8641d04fd3423e1e5c8195ce4e8862dbba45151e6feab81b3eb91bb460f5cf22831d503fee7f9930d7a6cbe09a0b9c70ca06b45949c3acb6333c40bc403271c4065ce8b14f7fd5034cbb8b841a09448ef38932b5fbf4b8aae8af68a71d78f57f8eef6ce05f7a39d285a1b2da92209df750692325049caa1785ab26eac47266221aec9fe7e2b8ae861ee6f050ce94a67b321ceeaf21fcc266426629916e27907b85aa47d5d3e64ea9276391c16319d8efbade6d1d0309cab6a3ca17d3dd0ead51c4f77a443e519ed9da1b586912dbb79a9eadf94417fe7df5a31f237a9ad0a88c8f2f12cb684b1494ae40f05f6b9081f04d3bc855a8f2f2190ac5d96cdb506ba75a0361652a14b749aae3e70547622a1810085384498c25085745e686ae84abd82666052f38f65f776cba173684797092d04f1d9ff62c134c8ac438d8d4f5e307aa7433db7c53ff71b17e006a89dee472c080be85ed6f7ecc0a2b52d934c8981f70da304fb518310e294c21a375e85e1674719f28addb99de4ae44353306fddcdb17d6fea84159cc6a1a63c53624542af5e4593294b4c054874c0707bf5db0693e6a14b125916925e06a98168182f4ad7456aa5a328c8eb4fff7f55a25550948d254ab18f3c09b27ac5e9300d079bdebc0acdb8282836605bf4d80cdc04fb0ca28fc1b2c79ade832e8b7d70b666dcadbb7dcba0f229d75b0f03e0cb5060a6ef9e6fc53f23647269850e0d078adb87f0ba37958ef0be5fff4fc437bb7be5a51a523367852d487e5ae91e4ace68dfb55f9a1badfaae8ad06c3e9b23cea044016f323c43dea9805b5357211a140315985842869f9afedb81bdca3566415e9d2d586bb490d092c72b8dda4d9ffaa16296a4536585f9a0396e3470c745018198450be234c5b18da8470c708516c5dd5fcde0a7d466d6b8ae31cbcf03e1627c86d40a490c46f7e3a9204f5204ff448a853a6af91d1856470711c07a0e6e519fe10eaed8c6b24a041e619b71f1b15ae7c2f247e4f64870b62be7203825ebd4f5806ebdf8a8a9b49ae1d6bc7e42e528db71ab763fbf7d70d4c45c45c695b40ededef6573266c4a074d87880837294a12f6a3896a97cdde3422d2e290c5026e0e59888d8b4b2b2dacc415c39d96b1ca1ce569d3fb9ff2cac9c2cc574fe0842c468398841eeca2e7962fa9e651b7f8c833a30c6f2bd6e0599879b72745e1cfa87ef538040b346e705c41292cb67ae1c6b88c0c84669740715191eed34e5203425a8260d6ecab96ab5329699e5a02bdf7c85fb09d7db315164a7babb939735beee99d243d48a1b0741520cada27c4e034cec5b6a47cbc9cacce45228ec597e56d978531e5adad44e670c5f381feac72f12c6873f24234a65daf7e0b840e65534058a579fc0f9616533f4cbc8adc1de613f373bc31d1c3e3cd300e6e71f313fb2611eb6773e5ce00a90caea57bb4b6f161d270e28cd9d9d0b68c93dc4c78002c836f680ffc6bbf42e6c204be0a9eef68133e7817744e3826adb0203a1b82eb278f8a6c96340ce7ab2f4467baff4ff7b79f82a45e643beb96b20a23a55ae69fb4bdde3e020656282ad28fdfa04f8836b24846276443b7848d4d7c32411e28f9f6a98512edb1a79d1f9345d9879d6532fee9c055d85a88a78b319400203d881c4f97fc1876a3b131f10fae4030d13b4b149c103312b855a2ab5051cd4c978d7e39062ea19b4d6fb5b995c9410e0023af978f73b0ef771bf60cdeea17a94a9e730c9b1aa0b922258e8fcf3823eec28c5fc1a1164573747945f381ee1259697b0a241dec50b460c2963351f7d2036392330843de65920715b75375297dcabd2cabac0b5fe35bc01944fe70f872ad835b8325cb0f9e9c7e3bc0464e497076b18cedacb77b3563f6fed8d3705bcd9bf20fa13db536a513fa2ff4ceb87b9a3c07589b38a57d6219c19aa835adff91abbd820fe9d7a481c77cae13f66ef562c231149a94c0a1deb4ff9ed2a22a018205deb4dac4038efef6d941aa67d9660230c77df95f457d68d9f7372b9f11613de681e570e4733b0887a27a918b8989657786b2faf3938158471decc412f7a17afa03127f44f1922b25f1d4a0271b37b8144c5236e1f211d497dc22b2915ff843b6034d4c7ac4fadb3e26e54aa4ca4ad3ed2845d83eab3e4a72cc2629ba08a2b8fc713e6b4ef2d3a305311d6f42f1a72a50d90b87a09fd9105b3fa45a9dd43b2d0fb9699facc873d3e5ae04bfa2adfef3f6abe8bec37e70799aac045223758b05fb42df6301a02b277735bae2a6037eba3f8f160ad75fa0ae18f9c820adcb672115f0be5a0d0b166feef3ab6b5ec241cbee23bdbe93594fa47e332be10ac863b36d51108cadd348b9430327b580624a3bad88c9ec6a4e601522f3c0fcd9bc41110180bf3588d1f9cbcd15e2dded99451688cd11aa3eb2b14d0eddcaa5641b5929a4ffbd654349baf5abfe926a018f39f29912fd0918ca047fdcdd8ef4437cf4bf55898f5120a257ea3f1083adf4256028813e2f8cd466ed618eff68d64a531a7bb518636a745eee50f2d86ed18a1bc5ef4079ff67616d947ee074e6c7051c32a52a8478a3071450c8876725a13977ebe4679e3c763ab7792d061b2c848edad1edc6730bba5fe9c3f3fe03e207d41197e46f765d0380fdf0ef8839dbee449de5822dd1c21e4eb5c532b52eb11ba5c74921ee329c6a556cfe72300848a9ec5734ef5f39b6d38992e7ec22b9f3722f4438ea74fa4ecd342918acb041dc0b25dc2fe63dad3a0791a0f3741f52f89fb545467d185a1bf7eb0644139d67ce288bdd3af0c41adcfb81d34488b9acf1c114697e1b5ac98a5235e5186ff53ac1449403113fd15dfdb10ca7b90b592e87e6dda98f2576d372de969e1b31d1664c12cf556346aa76bf04001f7f65140990f46fc3c88202681356fe05a7257edf9c81d93b96cff252f93468f388ba70c5251de23cd456f17cbb5a9518f8e894ba19c70131cba1f7a4eab73b2582b753eb55d15ec9bebf060c5b3a659e2436b0143dac0086ca8465ade19bf65491061095a92eefebb8365b295962be17c6107269894eefd0e448eb47d23922c930d41034b7eb47db5b2b9b47e88a51fa1c8288370c26f7ba5a343d446d406d6f408fd26b34721ea4966f6543a81157324f0c7dd783a66b1c666c7dd6a429030166330738c31ceacda9192481d96044c187b2bbe58dfc89882ceb7c7b4638357eae6b632cf051a6ee4ebec89b3a580f7cccec0f1a2b51a31eba80b63608fbb09069e857c43429bc147bfc13cc10edb6b16c7e32deaef50fb8fd7d71cfdd5690a8fb431411499e01032e2fd2ef6c11fe7d736597ffb9688ad6ec29d070ddec0cfd03280928580dfc716a5cd01731cf1e289711a6bcc19034794573d76966cf9943ff171f2ee5c7b7d6660b0e551552f98ac3717b076cae4b2280e2bad3dc60870ed05d77981ac2c6dbc54bd717be0cf09bf646ef4cc946b629c911aea6f2486415ee0a966a3ee0388f9ec9ba8a47ee3e6e5ed8c9be59791ff426c4412761f6c71c75043b2ee3296da43e449f0a310985f173963b4fe2bf642fbd0852db6552f33cadba7cbf67bd40c26291d5bb388a514e1b5ebd4f28263dd6c48c6bf292cbf8f2f0dc3ef7b9d0a6e99bd2eac23de3f204a3f74015ecc006e7053016e0c7a2c0fb3a162b249fc36e8dd448370c22034bb908f08de555eda12232ff8dd0a078b9b778cc941fe6870219fc62fd535f747a282ee49e553b27636fb804c38f1b41de9d8dab1b37b12163fcfb47ebfac064c530796df6aba0cef34ea6586df7897e568235344690154edb1f79826f763e61898ff77507916f2c04927dbcf0b1def93283534a32451e180074d8cf2e09d157e6885c9e2ec4064f6703140467ac264e42cf646f6e62dd3964d82a81fdaa9a100e8d3ce76dc47dd30a51ed199c714353d2c6d583caf33b2a9acf4b48504b65b74d0fcf35f188d65f679b06afe6430ba5e991ddfdc9e1c136cac43629c00403ea0e480f6ea3b29e14ed1d4609a99eeb30e56837bb301322c78db00039c1e0510c6448bdf60bb921294b9b6950c38d345781ea247c1d8e470ccbffd0fb8ab828bfe5869377e6bf6189a5bcaaa2a9065f1004e40076a8d28ee73bdf5bdbd0e46cd1f33b0bc089ca3cb0ea616a7d17c941610dc0839d7f4049b1c2217e7947ca1987ebc9f7cd340ff8a015c73959f33d524b6e8cb800ad6faf6b9d6eef4dd43270fd11c994fa0703e5529155e8b03894d96aabd5af6bcd148bce25dd1e22597cff2fc91640ef66db01185bf5bae555ca0b112eeedab48f788734aecfadc4315a7e33ffd90dc4d08439f15453d0f9ef4293c9cd3b1a559030691eef0654b12a3e213a04486a97ac136ad12af188875131fadb06734c3a9d96dc0bb92b51e513daa8613268fe630b12c296f73ab853052733544912033aa5636661ebae2d4f0bfc0795959d38d1cb45a474d3807c3cfe2d8421b2e652c27f90901873418f8574e6ea5114b8db408c859295de411f62cc98873ddd3d5136e5298dab3ecea9a18939dc8d2a16c11182d52dead40520fc49f832d33f54868bed2a970aba123a36ad42a1dc638d714655d88702cb5573a2dcef845f8aaf64a031b825495f8c9dc4ab08f9aeab1533a6076dd38f0ccc357c29e2eb45a20e5a878f8c29ec37d5781a6b943b84911663e245fea48bd72c8cae760043a0b743233009eeac3a663d130ef3c0aa7a5229d93919a67fc011f31acc5d507c640968a7d8fa894ccfa955737621eb420958336ab9ff0b79d66da644fe56573e7b2817fcc956364d5d56428308ae7ade80640847f4b37bb2de0ce25e138207a1f127738af2c38c8c7f4919ba4c40f2079269b25506750db57d25c94b39246027dfb94c640b53bf5d1045de7ae1431da4eb769b235ce01642c936a81f6d2ebd815e774e92ee9fc9e1f9eaa4f0bbb472a82859d2cc7d4b5eb43cb754c4e33d0c52b6b064041a18e4cfc2e21721448749c1779a966ffe6a7e791faaba09b58dfc7a076f3ea2b2e6511f95b08b458d46337ac70fa9db8e97882c3fb3712f6b47cddf9a1149170141f55a31fab66a60d0f6fd657a5c4d2a43ef413d805eed5b93dd3b56400185964da564a5ad202564494c70358a5a581eb40ba1a8c5644ad9402d0c60f832e7ea32864018a60b6a7648d48b3e4435dccd5d802791a1373c625b3244abcb7e5dd8252c8a91e461a37841b341a639920b37162e6da760d1a11b7e4bdd1e15b5fce2ad41197ea887be5f03ccd16a48b7af6f1e2656445b0e3180088661edfd89c5c8b056882e7763f71b69364326ebb0205e24444ec58a56e1eed938945b0eac953c0ddb67377e46ea49ca275d676f9bb480afbb7aae040189eddd0e779eb4fbcd5517f829b7de545b82ef5a79941e30402588143bf39ad1779f757906ba2b9635b8b92e82d651eda7d", 0x1000, 0x5, 0x0, 0x0, r4}, &(0x7f0000000200)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="05ff00809f5c050000000000000000000000000000000000000000b743401823508404f711b4f9b9e3ca39e965f0df3622764aabc01a1a8774be507b5d1bcf187ac2adcb004eb63d93b259ed920df35bd86a3aaa2c2622093cc4fb4bc32acc9eb201fb79629d", @ANYRES64=0x0, @ANYBLOB="c7460500000000"], 0x0, 0xfffffdfd, &(0x7f0000000180)}) write$RDMA_USER_CM_CMD_GET_EVENT(r2, &(0x7f0000001500)={0xc, 0x8, 0xfa00, {&(0x7f0000001380)}}, 0x10) syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x800) [ 579.093844] EXT4-fs (loop0): invalid inodes per group: 8192 [ 579.093844] [ 579.121373] binder: 7290:7291 got transaction to invalid handle [ 579.163943] EXT4-fs (loop0): invalid inodes per group: 8192 [ 579.163943] [ 579.165253] binder: 7290:7291 got transaction to invalid handle [ 579.215283] binder: 7310:7312 ioctl c0286404 20000000 returned -22 22:30:28 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec000544000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:28 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @dev}, 0x10) r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000780)) shmget(0xffffffffffffffff, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) shmat(0x0, &(0x7f0000ffb000/0x2000)=nil, 0x0) perf_event_open(&(0x7f0000000280)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0xfffffffffffffffd, 0x0, 0x4, 0x0, 0x5, 0x0, 0x0, 0xed, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0xffffffffffffffc0, 0x0, @perf_config_ext={0x20, 0xe9}, 0x0, 0x7fff, 0x0, 0x7, 0x1, 0x0, 0x9d2}, 0x0, 0x6, 0xffffffffffffffff, 0x0) r2 = memfd_create(&(0x7f00000000c0)="000000008c00000000000000000000", 0x0) pwritev(r2, &(0x7f0000f50f90), 0x0, 0x81003) 22:30:28 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001074000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:28 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x600000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 579.266550] binder: 7310:7312 unknown command -2147418363 [ 579.289428] binder: 7310:7312 ioctl c0306201 20000140 returned -22 [ 579.299188] binder: 7310:7312 ioctl c0286404 20000000 returned -22 [ 579.330948] EXT4-fs (loop0): invalid inodes per group: 8192 [ 579.330948] 22:30:28 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec006844000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:28 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000048001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 579.404864] binder: 7335:7336 got transaction to invalid handle 22:30:28 executing program 1: syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0xffffffffc) r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x600400, 0x0) ioctl$DRM_IOCTL_LOCK(r0, 0x4008642a, &(0x7f00000000c0)={0x0, 0x5}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x800) 22:30:28 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @dev}, 0x10) r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000780)) shmget(0xffffffffffffffff, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) shmat(0x0, &(0x7f0000ffb000/0x2000)=nil, 0x0) perf_event_open(&(0x7f0000000280)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0xfffffffffffffffd, 0x0, 0x4, 0x0, 0x5, 0x0, 0x0, 0xed, 0x0, 0x2, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0xffffffffffffffc0, 0x0, @perf_config_ext={0x20, 0xe9}, 0x0, 0x7fff, 0x0, 0x7, 0x1, 0x0, 0x9d2}, 0x0, 0x6, 0xffffffffffffffff, 0x0) r2 = memfd_create(&(0x7f00000000c0)="000000008c00000000000000000000", 0x0) pwritev(r2, &(0x7f0000f50f90), 0x0, 0x81003) [ 579.499854] EXT4-fs (loop0): invalid inodes per group: 8192 [ 579.499854] 22:30:28 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000060001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:28 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x100000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:28 executing program 1: socketpair$nbd(0x2, 0x1, 0x0, &(0x7f0000000080)) r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="05630440040000000083fa20", @ANYRES64=0x0, @ANYBLOB='\vc\x00\x00'], 0x0, 0xfffffdfd, &(0x7f0000000180)}) socketpair$inet(0x2, 0x800, 0x3, &(0x7f0000000040)) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x2001, 0x0) setsockopt$inet6_MRT6_DEL_MFC(r1, 0x29, 0xcd, &(0x7f0000000180)={{0xa, 0x4e23, 0x6, @empty, 0x4}, {0xa, 0x4e21, 0x6, @empty, 0x8000}, 0xa2, [0x4, 0x188, 0x6, 0x24, 0x5, 0x3, 0xf9, 0xfffffffffffffffa]}, 0x5c) [ 579.623613] EXT4-fs (loop0): invalid inodes per group: 8192 [ 579.623613] 22:30:28 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @dev}, 0x10) r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000780)) shmget(0xffffffffffffffff, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) shmat(0x0, &(0x7f0000ffb000/0x2000)=nil, 0x0) perf_event_open(&(0x7f0000000280)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0xfffffffffffffffd, 0x0, 0x4, 0x0, 0x5, 0x0, 0x0, 0xed, 0x0, 0x2, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x20, 0xe9}, 0x0, 0x7fff, 0x0, 0x7, 0x1, 0x0, 0x9d2}, 0x0, 0x6, 0xffffffffffffffff, 0x0) r2 = memfd_create(&(0x7f00000000c0)="000000008c00000000000000000000", 0x0) pwritev(r2, &(0x7f0000f50f90), 0x0, 0x81003) 22:30:28 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec00002d000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 579.728290] binder: 7375:7378 unknown command 553288448 [ 579.733384] binder: 7377:7382 got transaction to invalid handle [ 579.752851] binder: 7375:7378 ioctl c0306201 20000140 returned -22 22:30:28 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:29 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000b00000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:29 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @dev}, 0x10) r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000780)) shmget(0xffffffffffffffff, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) shmat(0x0, &(0x7f0000ffb000/0x2000)=nil, 0x0) perf_event_open(&(0x7f0000000280)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0xfffffffffffffffd, 0x0, 0x4, 0x0, 0x5, 0x0, 0x0, 0xed, 0x0, 0x2, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0xe9}, 0x0, 0x7fff, 0x0, 0x7, 0x1, 0x0, 0x9d2}, 0x0, 0x6, 0xffffffffffffffff, 0x0) r2 = memfd_create(&(0x7f00000000c0)="000000008c00000000000000000000", 0x0) pwritev(r2, &(0x7f0000f50f90), 0x0, 0x81003) 22:30:29 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000010007a0001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:29 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) r1 = open(&(0x7f0000000000)='./file0\x00', 0x40, 0x20) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000000180)={{{@in=@broadcast, @in6=@mcast2}}, {{@in6=@local}, 0x0, @in=@broadcast}}, &(0x7f0000000040)=0xe8) [ 579.858123] binder: 7375:7397 unknown command 553288448 [ 579.867789] binder: 7375:7397 ioctl c0306201 20000140 returned -22 [ 579.960760] EXT4-fs (loop0): invalid inodes per group: 8192 [ 579.960760] [ 579.968329] binder: 7406:7411 got transaction to invalid handle [ 580.023774] binder: 7415:7423 BC_FREE_BUFFER u0000000000000000 no match 22:30:29 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @dev}, 0x10) r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000780)) shmget(0xffffffffffffffff, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) shmat(0x0, &(0x7f0000ffb000/0x2000)=nil, 0x0) perf_event_open(&(0x7f0000000280)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0xfffffffffffffffd, 0x0, 0x4, 0x0, 0x5, 0x0, 0x0, 0xed, 0x0, 0x2, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x7fff, 0x0, 0x7, 0x1, 0x0, 0x9d2}, 0x0, 0x6, 0xffffffffffffffff, 0x0) r2 = memfd_create(&(0x7f00000000c0)="000000008c00000000000000000000", 0x0) pwritev(r2, &(0x7f0000f50f90), 0x0, 0x81003) 22:30:29 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 580.087715] binder: 7415:7423 ERROR: BC_REGISTER_LOOPER called without request 22:30:29 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec000058000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:29 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000025000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:29 executing program 1: recvmsg(0xffffffffffffff9c, &(0x7f0000000180)={&(0x7f0000000200)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback}}}, 0x80, &(0x7f0000000100)=[{&(0x7f0000000340)=""/136, 0x88}, {&(0x7f0000000280)=""/117, 0x75}], 0x2, &(0x7f0000000400)=""/148, 0x94, 0x5}, 0x40000000) ioctl$FS_IOC_GETFSLABEL(r0, 0x81009431, &(0x7f00000004c0)) r1 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0x0, 0x0) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x101400, 0x0) ioctl$LOOP_SET_STATUS(r2, 0x4c02, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x7ffb, 0x1, 0x3, 0x10, "98d573379846574f02c6fea4b6e740203a525aec8404abbf929f37377ced66886fbcbac48928baa0814b5168763cfc05297ab6e1bf05f6518b14366d1c3e3305", "46782ea46ee7ab3ced61384ce753f58d820c242d7f4d5ae09d27a43663cf668f", [0x0, 0x6]}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:29 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @dev}, 0x10) r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000780)) shmget(0xffffffffffffffff, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) shmat(0x0, &(0x7f0000ffb000/0x2000)=nil, 0x0) perf_event_open(&(0x7f0000000280)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0xfffffffffffffffd, 0x0, 0x4, 0x0, 0x5, 0x0, 0x0, 0xed, 0x0, 0x2, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7, 0x1, 0x0, 0x9d2}, 0x0, 0x6, 0xffffffffffffffff, 0x0) r2 = memfd_create(&(0x7f00000000c0)="000000008c00000000000000000000", 0x0) pwritev(r2, &(0x7f0000f50f90), 0x0, 0x81003) 22:30:29 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:29 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000400000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:29 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec004844000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 580.357653] binder: 7459:7462 BC_FREE_BUFFER u0000000000000000 no match [ 580.394875] binder: 7459:7462 ERROR: BC_REGISTER_LOOPER called without request 22:30:29 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000010000003b2000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:29 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x6000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 580.421035] binder: 7459:7476 BC_FREE_BUFFER u0000000000000000 no match [ 580.438870] binder: 7459:7476 ERROR: BC_REGISTER_LOOPER called without request 22:30:29 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @dev}, 0x10) r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000780)) shmget(0xffffffffffffffff, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) shmat(0x0, &(0x7f0000ffb000/0x2000)=nil, 0x0) perf_event_open(&(0x7f0000000280)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0xfffffffffffffffd, 0x0, 0x4, 0x0, 0x5, 0x0, 0x0, 0xed, 0x0, 0x2, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x9d2}, 0x0, 0x6, 0xffffffffffffffff, 0x0) r2 = memfd_create(&(0x7f00000000c0)="000000008c00000000000000000000", 0x0) pwritev(r2, &(0x7f0000f50f90), 0x0, 0x81003) 22:30:29 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec007a44000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:29 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) r1 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x8400, 0x0) ioctl$IOC_PR_PREEMPT_ABORT(r1, 0x401870cc, &(0x7f0000000040)={0x6eea, 0xfffffffffffff001, 0x1, 0x100000001}) [ 580.644327] EXT4-fs (loop0): invalid inodes per group: 8192 [ 580.644327] 22:30:29 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @dev}, 0x10) r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000780)) shmget(0xffffffffffffffff, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) shmat(0x0, &(0x7f0000ffb000/0x2000)=nil, 0x0) perf_event_open(&(0x7f0000000280)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0xfffffffffffffffd, 0x0, 0x4, 0x0, 0x5, 0x0, 0x0, 0xed, 0x0, 0x2, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x9d2}, 0x0, 0x6, 0xffffffffffffffff, 0x0) r2 = memfd_create(&(0x7f00000000c0)="000000008c00000000000000000000", 0x0) pwritev(r2, &(0x7f0000f50f90), 0x0, 0x81003) 22:30:29 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001005000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 580.687097] binder: 7508:7511 BC_FREE_BUFFER u0000000000000000 no match [ 580.719867] binder: 7508:7511 ERROR: BC_REGISTER_LOOPER called without request 22:30:29 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x7a000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:29 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000004800001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 580.753467] binder: 7508:7511 ERROR: BC_REGISTER_LOOPER called without request [ 580.787117] EXT4-fs (loop0): invalid inodes per group: 8192 [ 580.787117] 22:30:30 executing program 1: syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 22:30:30 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x60, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:30 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @dev}, 0x10) r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000780)) shmget(0xffffffffffffffff, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) shmat(0x0, &(0x7f0000ffb000/0x2000)=nil, 0x0) perf_event_open(&(0x7f0000000280)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0xfffffffffffffffd, 0x0, 0x4, 0x0, 0x5, 0x0, 0x0, 0xed, 0x0, 0x2, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x6, 0xffffffffffffffff, 0x0) r2 = memfd_create(&(0x7f00000000c0)="000000008c00000000000000000000", 0x0) pwritev(r2, &(0x7f0000f50f90), 0x0, 0x81003) 22:30:30 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec000744000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:30 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x9b9a, 0x24000) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000080)={r1, r1, 0x7, 0x1}, 0x10) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000040)={0x65b4b590, 0x7, 0x7, 0x81, 0x2, 0x80000001, 0xe4, 0x1, 0x100000001, 0x800}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x34, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="056304400400000003630840", @ANYRESDEC=r0, @ANYRESDEC=r1], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:30 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000000000107a000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 581.074767] EXT4-fs (loop0): invalid inodes per group: 8192 [ 581.074767] [ 581.102866] binder: 7557:7565 unknown command 808464432 22:30:30 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x500000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:30 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @dev}, 0x10) r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000780)) shmget(0xffffffffffffffff, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) shmat(0x0, &(0x7f0000ffb000/0x2000)=nil, 0x0) perf_event_open(&(0x7f0000000280)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0xfffffffffffffffd, 0x0, 0x4, 0x0, 0x5, 0x0, 0x0, 0xed, 0x0, 0x2, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x9d2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = memfd_create(&(0x7f00000000c0)="000000008c00000000000000000000", 0x0) pwritev(r2, &(0x7f0000f50f90), 0x0, 0x81003) [ 581.122105] binder: 7557:7565 ioctl c0306201 20000180 returned -22 [ 581.139107] binder: 7557:7569 unknown command 808464432 22:30:30 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000200001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:30 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec00002d000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 581.203173] binder: 7557:7569 ioctl c0306201 20000180 returned -22 22:30:30 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000050001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:30 executing program 1: r0 = socket$kcm(0x29, 0x0, 0x0) setsockopt(r0, 0x1f, 0x100000000, &(0x7f0000000340)="fb2f53ea259586c015bdfae3690a65f0bd645a151921303199f4c1fddc795df7fcf299580106a2efcc5ca91c6f628dea9290ef6a880ef7a2da871f05080e826ba2d627e2495cf02fc8a1b7787856a443cae3e2981ea2a010437ac8d7b7a369b5bbebbf1073a045fa8d16e2637e1dab28c1c85ddb3a61b81a4b4bae14ce52aabcae8c0ff2fece80c5089362c850b7448b3693316c61edfd9e0409ea8bf9f0fcdd3738606d2a1504b69740362ac7070d7abc2732728e971b134d0e28403e02c76818c768e681acb5d848b188a7b330a97e83ae80e7384c5725b313027ac5162e82d653320bad5918357b7aa9a89d968fd74e42f5d7181478725eee7f2e154b3f1a08777c1217439d47fdf32018226b73b640d36e187d1f62c8aefef81b02f9780d9316f7b016229965822cff35392b6eb43aa245cde30610a2c30662384c3d031ede49bde80abbdc800879fc567c10a2f7fac5bef8ef0ab544c0ab1936d34a464bfe89099193dcc02d650f965c087de9071129c9243d47065c3653cdac2ef5301f9662d242fce4ab1894e552d495659c1f2e1dd4b65a27e2b20e4207d9ac259972958c83eb2b5aa0731f9449f9a836a8e8195647ea665dda8afd51005d23785f61efe792ff7409d4c6e0b2a260e06f177d04d42df110f7b2823d6b4a59ab1e2cea56028b693817bfc1d9078f06111bdfaa287ff42055c36f0e193dcb73b812293d53df1187fcdbd67265311042c27751c71fa880fa2281a3a393b7441975b99b2ca9a500964224851ceb8b9c6a12210065b047ffc93eabb8560b666b14e2f0c5723b727adde46892f34a3da7b22e060b77d31316b0cbf787bc6078c934f674179d264dafe48e75cacb02bb8f8241383b04b0599f22b2c40e5921270c73d66675e6f9ab81cb2ae036d3b9e06f3d0ebbe0c2b085cd5b51f48785a0b3eb5be218d03ff655001d124b57ab53c5ba802f516963557825a28dcb6ae3eee86b019c12eb64d4d866ba8aab5767a0dfb47e7acea021294dc3cd602c241f128ec771b28b2bc60a13c62cbf91bdba159f349a11f0a9637e876eed5635b6c3cbc49388f70ef816e288ec1f355979074e5068937bc68ce66485529f1e17ef24808e714e4589e0698f888f02a7d75aec541c5ef74a1e381eda298c39e39a4a382fed06628041a4d7b9e353ad2257e033d1b40f09ab72c814b4314993f15ddbf0e2c96cbcfe6e2113ee4f252df4693e84af8090eca0692a577194662d04f03d79c9fad6927bba45cf1aa709b6454b299086215c469f441aaf883f7865d13b82f9da1c18bb7a12d9bf0c6d6dd7172d7590fe9d0a676b850fcb05b54eef28c78f18576dfc8eca759d68ed5e09b87f4ef9d0f38445747f8519fd8d9efda30191088eba6e8ce274aaee3684fc8fc0b20c45b80565625cd64fab59e3dec92153a244cbfd1d78e0c0aa623fef01729a48f7a9d65815bd3cbe9ff6116d2973537c0fe376584ead8b0bda277bcdf784c6a9f3decfd723ee52be5c07e43dbc79a0fa595997579f75091576098f216692c550a25c233fbff4177d5febcc57ae03a8719165fa719d28c81bd5af1bf4c6b8456ec8cf4021f20c2e344f3541bc6f4a47af970cd13bf49905a63c95d4fc712ba952890d29056665e9b47c1ff6161a704861fea235f7f2353f3764b75622031c5dce642fcc3781cf47c2868aadd2221e39cf9ee9d508c8d201db82223518b599dc64f39292d3e6ef3ec706794dc18c81bc7c8da81bf800f81bdbf46c12a80f6928843764c26e2aac9a9d556d9fbc5157e1b53991e56bf0c04575a78ea1afe4fcdc6caa4e9891b89da8312a0db8b715a30066b3da97bec416594eaa04caead3e4fdfed47784560ccd275aabfc50c891c4e5f3cd12f15d9e94a0ddea2311f804e83932b7146f378c3a86fabfda87169054e9fb076627e8d347eb267676ce5543cd3801eb98b44bd930a38ea8bb13a04665d75d5ded50ce934151b815b9c4c94c72f11f0a8361ed99ebe424df5b70fd89aa0f439cc13c170bc9e52a5853d8d96ac893a0423173e906fbe1b1ff786b876b960ebba9541196a33ecdb5e39979fcf85012a20d23985698b5736a06d994ca7fe39ecda26c5c8da9786bf80cd694f4cb42c708a61e2e3c55479760f5a4f45121743a6406313ede87e527ac7714790c29296e0e2ac9908376582cca85739456fdd324a3fcc2a5058e46671dce92fa16c1cd224e6083ce1c043996df68a79168e777e68f066232f3e2ef41d248e2804c585177f138861756c0fb6bf0884307efc2263cdc7782128cb06dfb305dfec989892b9ce0a4ddbe3ca50f068b1c88e4f8c8974a48e562f102f8643b7eb524890b250d0fca3c2cc473bce5ffaebffaf78143ed6c4b79a2db0063a3015b2d6f7dd6904efbb1a0bf01fb0b2347451625aa86dc123925053da31111ce17b6601a6c3140b105d68be97604a3d2731deb2556e84740ffa9afdf5f8df09d5cb000dad606f5283527dacb71c2f2922ce71702ecae6514a4c5aadb152072947efb174cc6f86e7f439e93d368c0aecea8ad3724e79c2a63f80df800d159557734afedba8b49f0da3817368f958bf5cc0d6e971b5486987d4ab0f77b7cce1420148a4b7b50a1d10ffc1ef3c8d05c9f7d8c973fe89ed1a43907b1831ef208170570137e2af3ebeb9e92e72a0f14ca29589e253e15b6df2d8a924fbb3c9c8253ff5eb08fe772b8ddc6951ec06ab9fdd020bee77a06ed1acf0b00dcdd2d8a62085dc2ead1d1f2fc6a7d202360e8da673be99ec035b5860e2a79490318c7a8d443f749bdbce47bee54151324beb9887c41b55cbf7174bbb397170e62c3dcb70945f48a88d6b0efa35a39600a2d11cdf978d4c13c0b70d85fb1056cd1e816e37d8bd8bd853bf0dc5676f8b4e6f71ec41c1c54457d7483d4328f7d3becf3a56a0cff7c848c47b021dfec3c06063091566a0fc8e23b8881850b2c8ea7da84921c3f0461c51a442b101fc96086f0cf25b8d115ab800a2f40cd71150c73035031a75742c72a04acb8f4c7fb1348317a14a1686143d0f5861380f1be10428faad015a21191766db8382c77ac50d9f2d38959a0bbe9dec75821505a30c4559c80f25d9bed12f307c9fa52466c47fc3863f4834b5d744d4b2ed8c0b522a65a97a573758ad4361afcbfff3e0f39c659eee0d7034de44a826646a0dd43859e5df987afbc81e17d3312e4fb7fe1c0a6e24a8f884f73ef45a34a82ce313290c684d9ac0912309d7a2fefab894668adadb70c91ea12eea0d21ed3aae677b869b01eba249a2fd6ea330aa698e1b514e39454c6d66aa90dde72996fb19e996820ece6b5e5901e46076c78e2165f877b3361b681a6f6550fd23049dd1c31d975346d2530cce5462b6594a79856f5383bf159ab07d7b8f25626eb74612893541f2bf42040324c6ef7df96f2bdb0125c71cbf728791e405c0b6f1eff0d890cbfc5f4f700d06e4f586dc0d0742a42a8c2226a2ce24965514ffd197aa932ef67ccf77f73f8805655fd9a50ce88cc7521c3ab54b48e85a7ba3d9ee3735b581275de6b9acb16152b7c59574d43fb124db858ba0a1bbc1e6340ad8da2a065ae18d1154fecc183bf781aea58d1b12f741b75ca9cb0b1eae5c286714d1a3b3b64a4319771e1f7b0cfd339be56e6ea90dab826d4cbce7dd5dc74ac16718b47f27c1a54954d2bf1f617a28d73ef0269fb7020a041f3a280f614c7b289961bc9a88452efbe39809f339e988973e1e88fb684cdf988506ee8541c4f9101627fab111c1c2a28c7b92c469ead41c5f1d2ab77bc114a73415b31fa51d189b77dbfc1d27b3e351d880073d2ac0c3a7f606c343844389a2c88257ae8cff626206d1941daa36a0f1ad82ede2f337b0ca992c4437e55ebe42fc80ac8a57395f8bd5fde20c40fdff61382bc96433855bd5d4e2f5ae113913fec8bbb73bde99e841d15402c0a53349d13887e60b73d10c0db9a9f95a72ea96b178296e9fae6b4fb6548cd1efc5d4ddb2bec420a489058371145833438fa64e241d1383be690a6d787a3a06950d67b95695a692b765c8b312ef8efbf5ad7779a3556f40e3c86a0f2016234a5b47e3e51d3d2ba275aa21dd9e326114bb8540d99576ce637acc489ab7814b40663606a45b1f1018ca378b67f67ec958a51aafed13e0b5b0df21c08564fa4646b1b295aaab3942e42e7e0e1efd0bfe938a4e8dac6b051eab6f578a3614a5191b5125575120f60f64aabb4b43c528601c1da3099a24b0c31dae506eb6d62cf7d39a4a7e940035abc2a09d7c003ef9df5d0de74213b67df79e4106178b1c8cc6d2f676b205004e182bc432c39f7f2dee5b5564cfcf6c07db561a91c8e60bef51448c79796756297f58f6a503bb196b51655ea717f11877fa1d18ff04a96d5f5b9df8d4a70424edb9c4e50110d002ed4e69b7b9e8fd3507475264ad99c39bed098546d72a88dea221777cdb4a08a4bd214641acff408ed8383a40c1c298e26fd624cb05d86a50a396496067ffe47015eff44e01b873f107f6ed6691725cdf0f33388066cff931e6afd522595aa7c45510d5fdb3bc99b9e55142456ae936b86eb8892bdf6d799ff30f01d558d02164232e0473adf4efe637e494a67fb45b69ed23213ddf65bc16a043877789248b15e357bf5f5b6f15d815f8cb67cda607781af5fc74c1daa3fc468524c901c9cf7113501a573a0054cd92a5c6a8c39535a640c1fbf58c15b17ceee5be494242938f28338939db27bc63e6c609b02ff49f91174d6da64ca6792944316e509e4ada7e4054f9bf31e895dcd094f5a38ef962a166f00f0eeaf3ca25cced42c645a9a78d35d65408316ddc00f810b115e82b005d218f111c267ab1ff5308dcc3565543ad4a9329a46143fc77642754b26ad5785eba1c74f1b5cb1f0997aabe433f44953c6e0b28e5f7e0734e912793ad8c587abdf7af6c1de1a8d9d6d597c6ec773877691973641e7cb902f06e5679ce2de387b2bf73844a8a52500ef650aedc21e7aada2345c84bedbc79accc5112b9481e99755c3a0961e4f60a4f1afa273965dca31366ae803b027e45b90ae1f47c5337de649a2eb13fbe9b315adcf75081f4176a5e066cdf9f0f263a72300c841eb80918c076fbcdd3a86f27f21fa976972c20238960645b44f8605cf710e272647819676745234b706136e8e3f4fc6938771e68808fc24573ceba6fc2012307d49f3ba586de8a52cd71a8c4058041076629a3446bbe96ddb834178339f97021dbc7ffb2a2f8e89bfe5b7568da31391c55d33ad865ad13c43eeab3001650fa1f5bed02e07235e342000080bf157008a46ee794fd27ef4de1191d2237b20f1fe888af002ad74f4e3e69e6d709b686a7b6e1ce02639da2a3b195f2fe435805e3c7405e8ec6aa0d6bc63f0bd6fe604ca1836c03efe2fe863227cd1e8ebfff905d4f82129c8511cbffda5fa87c0e38c81cc74d5c74ac0192aea25f34ae71793f719dc0365f71477137aabf04bb3cdab5c7841d43331f0c18264b2932ce374deadb11344d33a83e8f5ce91d2f9c5ca38c45ab842e479a8ab75f8a8570b6048b89bba52cddacb4b9528bc7d18980275eb7bf6c4a1722baddba67b43df53e0caadb8a01275ab9445bb92c4d2a5ead40d77b67c0b026a26e02f7e297ddd6e142397f26ec9b5f35ec4f65ac22bf22a4e8ccf393c055058480164889eb836dec91a726312e9c99f7e22eb6f05a0783cf218abaebd33eedf2bd657a68e2afbde35e7deddb5a21b746511dba17a577510207eb02c436f684e3bb24a53641ce1f8f258f9", 0x1000) socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="056304400400000003630840", @ANYRES64=0x0, @ANYBLOB="9f8b6f9ca9a05ae962001eae530e4375b7516e92cb184ad77c9ee4dcfa7d129a49d4973887b7e58093bd870cc3bdcb86b361198302f3d0d424802148710e0570eed0f87eb9b6555679570c1fecc0cbc34b9789f392"], 0x0, 0xfffffdfd, &(0x7f0000000180)}) r1 = dup(0xffffffffffffffff) ioctl$FS_IOC_FSSETXATTR(r1, 0x401c5820, &(0x7f0000000000)={0x4, 0x9, 0x4, 0x12, 0x200}) 22:30:30 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @dev}, 0x10) r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000780)) shmget(0xffffffffffffffff, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) shmat(0x0, &(0x7f0000ffb000/0x2000)=nil, 0x0) perf_event_open(&(0x7f0000000280)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0xfffffffffffffffd, 0x0, 0x4, 0x0, 0x5, 0x0, 0x0, 0xed, 0x0, 0x2, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x9d2}, 0x0, 0x6, 0xffffffffffffffff, 0x0) memfd_create(&(0x7f00000000c0)="000000008c00000000000000000000", 0x0) pwritev(0xffffffffffffffff, &(0x7f0000f50f90), 0x0, 0x81003) [ 581.310084] EXT4-fs (loop0): invalid inodes per group: 8192 [ 581.310084] 22:30:30 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 581.417735] EXT4-fs (loop0): invalid inodes per group: 8192 [ 581.417735] 22:30:30 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="056304400400000003630840", @ANYRES64=0x0, @ANYBLOB="0b630000c38d98e09b3264352f914cfc53735d86f53a9c7c66c01ab2ff1699276e9effb785f80bb1b6ea0ab575d2c31e211f83d97484fde53a0b594b88e2f17091afadcb7ab2e9095a64e1516cd8fa6fa313d6c9fabfe317e46803a511858e5121013f97555e107f736525ece9495984c4f36a4b1b68d188f0b6d3bad9a64a56fefe8c6e57144ecd3aa051e1251f3245623b"], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:30 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x6c00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:30 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @dev}, 0x10) r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000780)) shmget(0xffffffffffffffff, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) shmat(0x0, &(0x7f0000ffb000/0x2000)=nil, 0x0) perf_event_open(&(0x7f0000000280)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0xfffffffffffffffd, 0x0, 0x4, 0x0, 0x5, 0x0, 0x0, 0xed, 0x0, 0x2, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x9d2}, 0x0, 0x6, 0xffffffffffffffff, 0x0) memfd_create(&(0x7f00000000c0)="000000008c00000000000000000000", 0x0) pwritev(0xffffffffffffffff, &(0x7f0000f50f90), 0x0, 0x0) 22:30:30 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000010006c0001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:30 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000700001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:30 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec000058000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 581.595095] binder: 7624:7625 ERROR: BC_REGISTER_LOOPER called without request 22:30:30 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = creat(&(0x7f0000000080)='./file0\x00', 0x11) setsockopt$inet_sctp6_SCTP_RECVNXTINFO(r1, 0x84, 0x21, &(0x7f00000000c0), 0x4) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000040)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000000)='\x00', 0xffffffffffffffff}, 0x30) fcntl$setown(r0, 0x8, r2) writev(r1, &(0x7f00000002c0)=[{&(0x7f0000000180)="90167624bfb5814a16e2ae46b0b0755865e70ffccc201a92190d1e75f20a75571fa806408b102a0c8d3bf195b5ef2eb053cf06e7118f7c98cb97190e12ea95c459f823b88d5c664d94c8b28dcbd9bf964f201842a1cccf2bf173b6fee7472cb9cde4d9ca38d98d5e43e2f67504cb69385906348df11aa542d7935132e1bfca57725a8899bae7ae37aa43ee065cac6b6d8d92e96d07d8d72869f3c5d285550889ecddb745afbbddf7357e86c803fde8e87eaff58c23bf1a4be0dee12efef77a287b3700993306d5221880e84f98684f9cef91349f96930ed77549f0464b404d95e5ec1294497531d0e67dbd4163d5f6f420f02aac38", 0xf5}, {&(0x7f0000000280)}, {&(0x7f0000000340)="529f52e90e05255125a1cb566594cadea4dda909fab94ee1fdd721ce044c0ab2826b31d1beca74ec80eb9c19994bcf6275ee4a179444e073c98b239a1e9e985c00ace3930844964fb29973b1280747d83e84c6a678098cf656d525df1c18669bb55210fad26bc704438ea114e3849d2efc198724f04666c474fd9c0fbdef90df49e962515e73f5839b", 0x89}, {&(0x7f0000000400)="a45970bac0d1e176504f7d0c3e83c59c24096d620f26df86dff18a78237860245f0b5b6357823320823cd6e612a9912151d987eb5fc372a1fbbe47aab56f3aa3824e86ef67bc50187c67128d5fa9b37a3a47056a31a81c2d42063aac9d711e84c5ab2f239691a13e4c22544426e316afd121c7a2dd73a93732839a38484c2ca0298938e354885765d3d2ec0e0496a603de5b8b68c8ef899d51457a3a95e6aeffb96f3afd7c5d64aa143004d40eb0d7120ca0c569434d3416f97c7b6157b7c1e0165c19bb1005deed3b47d0ee46", 0xcd}], 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0563044004000000030b0840", @ANYRES64=0x0, @ANYBLOB='\vc\x00\x00'], 0x0, 0xfffffdfd, &(0x7f0000000180)}) socket$pptp(0x18, 0x1, 0x2) 22:30:30 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x68000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:30 executing program 5: r0 = socket(0x11, 0x2, 0x0) r1 = syz_open_dev$ndb(&(0x7f0000000000)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) ioctl$NBD_SET_SOCK(r1, 0xab00, r0) ioctl$NBD_SET_FLAGS(r1, 0xab0a, 0x3d) ioctl$NBD_CLEAR_SOCK(r1, 0xab03) 22:30:30 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec000025000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 581.787706] binder: 7648:7649 unknown command 1074268931 22:30:31 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000010000003a7000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 581.836578] binder: 7648:7649 ioctl c0306201 20000140 returned -22 [ 581.857380] block nbd0: Receive control failed (result -22) [ 581.879658] block nbd0: Device being setup by another task [ 581.884722] binder: 7648:7660 unknown command 1074268931 [ 581.932682] binder: 7648:7660 ioctl c0306201 20000140 returned -22 22:30:31 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x7000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:31 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000005001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:31 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec000007000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 581.985231] EXT4-fs (loop0): invalid inodes per group: 8192 [ 581.985231] [ 582.012459] block nbd0: shutting down sockets 22:30:31 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0563044004000020036323401331edbcfb2ee8e5", @ANYRES64=0x0, @ANYBLOB="a02a6300813de5beef2b2cabfa01f2d59bcb157d7b15a0b8d1268bd6f065783a0c5af8ae09"], 0x0, 0xfffffdfd, &(0x7f0000000180)}) userfaultfd(0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x80000, 0x0) ioctl$PERF_EVENT_IOC_DISABLE(r1, 0x2401, 0x8) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000080)='/dev/zero\x00', 0x8c000, 0x0) ioctl$BLKGETSIZE64(r2, 0x80081272, &(0x7f00000000c0)) 22:30:31 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x6c000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:31 executing program 5: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x71}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f00000000c0)={'ip_vti0\x00', &(0x7f0000000080)=@ethtool_rxfh_indir={0x0, 0x1, [0x0]}}) 22:30:31 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000000000100000003d000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 582.174762] binder: 7696:7698 unknown command 1076060931 [ 582.215178] EXT4-fs (loop0): invalid inodes per group: 8192 [ 582.215178] [ 582.245103] binder: 7696:7698 ioctl c0306201 20000140 returned -22 22:30:31 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x68, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 582.261821] binder: 7696:7698 unknown command 1076060931 [ 582.282234] binder: 7696:7698 ioctl c0306201 20000140 returned -22 22:30:31 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x240, 0x0) ioctl$KVM_SET_CLOCK(r1, 0x4030ae7b, &(0x7f0000000040)={0x6, 0x8001}) [ 582.316546] EXT4-fs (loop0): invalid inodes per group: 8192 [ 582.316546] 22:30:31 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x48000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:31 executing program 5: r0 = socket$inet(0x2, 0x3, 0x19) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x23, &(0x7f0000000000)={{{@in=@multicast2, @in=@multicast1}}, {{@in6}, 0x0, @in6=@loopback}}, 0xe8) 22:30:31 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000007a001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:31 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec000000030000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:31 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001006000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:31 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000000)={@remote}, 0x14) [ 582.505535] binder_transaction: 68 callbacks suppressed [ 582.505551] binder: 7742:7743 transaction failed 29201/-22, size 0-0 line 2834 [ 582.520743] binder_thread_write: 38 callbacks suppressed [ 582.520758] binder: 7737:7741 Acquire 1 refcount change on invalid ref 4 ret -22 22:30:31 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x6000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 582.600074] binder: 7733:7755 transaction failed 29189/-22, size 0-0 line 2834 [ 582.618123] EXT4-fs (loop0): invalid inodes per group: 8192 [ 582.618123] [ 582.654530] binder: 7737:7741 Acquire 1 refcount change on invalid ref 4 ret -22 [ 582.675141] binder: 7757:7765 transaction failed 29189/-22, size 0-0 line 2834 [ 582.703975] binder: 7767:7770 Acquire 1 refcount change on invalid ref 0 ret -22 [ 582.714837] EXT4-fs (loop0): invalid inodes per group: 8192 [ 582.714837] [ 582.736963] binder: 7757:7775 transaction failed 29189/-22, size 0-0 line 2834 [ 582.738976] binder: 7733:7745 transaction failed 29189/-22, size 0-0 line 2834 22:30:31 executing program 5: syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f0000000100)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400100401000200027000f8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) write$apparmor_current(0xffffffffffffffff, &(0x7f0000000040)=@profile={'permprofile ', 'c\x00'}, 0xe) r1 = openat$cgroup_ro(r0, &(0x7f0000000000)="b58c8c256367726f75702e636f6e79722e6c6c", 0x26e1, 0x0) fchmod(r1, 0x10) sendmsg$unix(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000180)=@file={0x0, './file0/file0\x00'}, 0x6e, &(0x7f0000000200), 0x0, &(0x7f0000000240)=[@cred={0x20}], 0x20}, 0x0) 22:30:31 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000040)=0x0) ptrace$setsig(0x4203, r1, 0x8, &(0x7f0000000080)={0xe, 0x1, 0x3, 0x4}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x1c, 0x0, &(0x7f0000000000)=[@acquire={0x40046305, 0x4}, @free_buffer, @release={0x40046306, 0x1}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) r2 = openat$mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/mixer\x00', 0x4000, 0x0) ioctl$KDSIGACCEPT(r2, 0x4b4e, 0x2d) [ 582.746647] binder_release_work: 69 callbacks suppressed [ 582.746654] binder: undelivered TRANSACTION_ERROR: 29189 [ 582.761226] binder_transaction: 16 callbacks suppressed [ 582.761235] binder: 7767:7770 got transaction to invalid handle 22:30:32 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000200001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 582.808877] binder: undelivered TRANSACTION_ERROR: 29189 [ 582.835501] binder: 7782:7783 Acquire 1 refcount change on invalid ref 4 ret -22 [ 582.838430] binder: undelivered TRANSACTION_ERROR: 29189 [ 582.843566] binder: 7767:7770 transaction failed 29201/-22, size 0-0 line 2834 22:30:32 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000006001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 582.860508] binder: undelivered TRANSACTION_ERROR: 29189 [ 582.895343] binder_thread_write: 7 callbacks suppressed [ 582.895355] binder: 7782:7783 BC_FREE_BUFFER u0000000000000000 no match 22:30:32 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec00004f000000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 582.929432] binder: undelivered TRANSACTION_ERROR: 29201 22:30:32 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x6c00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 582.978534] binder: 7786:7800 transaction failed 29189/-22, size 0-0 line 2834 [ 582.987066] binder: 7782:7783 Release 1 refcount change on invalid ref 1 ret -22 22:30:32 executing program 5: sched_setaffinity(0x0, 0xffffffffffffff3e, &(0x7f0000000180)=0x9) pread64(0xffffffffffffffff, &(0x7f0000000340)=""/39, 0x27, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='net/packet\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x1000000) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') syz_open_dev$loop(&(0x7f0000000040)='/dev/loop#\x00', 0x0, 0x0) [ 583.038874] binder: 7782:7789 Acquire 1 refcount change on invalid ref 4 ret -22 [ 583.052874] binder: 7786:7807 transaction failed 29189/-22, size 0-0 line 2834 [ 583.059405] binder: 7797:7798 transaction failed 29189/-22, size 0-0 line 2834 [ 583.081987] binder: undelivered TRANSACTION_ERROR: 29189 [ 583.087597] binder: undelivered TRANSACTION_ERROR: 29189 [ 583.088274] binder: 7782:7789 BC_FREE_BUFFER u0000000000000000 no match [ 583.105537] binder: 7815:7817 Acquire 1 refcount change on invalid ref 0 ret -22 22:30:32 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000480001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 583.131265] binder: 7815:7817 got transaction to invalid handle [ 583.145365] binder: 7782:7789 Release 1 refcount change on invalid ref 1 ret -22 [ 583.156370] EXT4-fs (loop0): invalid inodes per group: 8192 [ 583.156370] [ 583.169769] binder: 7815:7817 transaction failed 29201/-22, size 0-0 line 2834 [ 583.218996] binder: undelivered TRANSACTION_ERROR: 29189 [ 583.220067] EXT4-fs (loop0): invalid inodes per group: 8192 [ 583.220067] [ 583.225322] binder: undelivered TRANSACTION_ERROR: 29189 22:30:32 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000004c001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:32 executing program 1: r0 = syz_open_dev$amidi(&(0x7f0000000200)='/dev/amidi#\x00', 0x7, 0x7fffe) setsockopt$inet6_icmp_ICMP_FILTER(r0, 0x1, 0x1, &(0x7f0000000100)={0xa7600}, 0x4) ioctl$TUNGETFILTER(r0, 0x801054db, &(0x7f0000000040)=""/190) r1 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) r2 = getpgrp(0xffffffffffffffff) fcntl$setownex(r1, 0xf, &(0x7f0000000000)={0x2, r2}) [ 583.266612] binder: undelivered TRANSACTION_ERROR: 29201 22:30:32 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec000044000000080000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:32 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x700, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 583.349697] binder: 7841:7844 Acquire 1 refcount change on invalid ref 4 ret -22 [ 583.367123] binder: 7841:7844 BC_FREE_BUFFER u0000000000000000 no match 22:30:32 executing program 5: sched_setaffinity(0x0, 0xffffffffffffff3e, &(0x7f0000000180)=0x9) pread64(0xffffffffffffffff, &(0x7f0000000340)=""/39, 0x27, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x13d}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='net/packet\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x1000000) syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') syz_open_dev$loop(&(0x7f0000000040)='/dev/loop#\x00', 0x0, 0x0) [ 583.395854] binder: 7841:7852 Acquire 1 refcount change on invalid ref 4 ret -22 [ 583.412645] binder: 7853:7854 got transaction to invalid handle [ 583.439730] binder: 7841:7852 BC_FREE_BUFFER u0000000000000000 no match 22:30:32 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000601000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 583.460588] EXT4-fs (loop0): invalid inodes per group: 8192 [ 583.460588] [ 583.485711] binder: 7853:7854 got transaction to invalid handle 22:30:32 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x200020000002) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)="00000000632f7379732f6e65742f697076342f76732f7379fffffeffffffffff6f6e00", 0x2, 0x0) ioctl$KVM_CHECK_EXTENSION_VM(r1, 0xae03, 0x8001) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0003000000", @ANYRES64=0x0, @ANYBLOB='\vc\x00\x00'], 0x0, 0xfffffdfd, &(0x7f0000000180)}) ioctl$KVM_IRQ_LINE(r1, 0x4008ae61, &(0x7f0000000080)={0x3, 0x8}) 22:30:32 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x4c00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 583.556296] EXT4-fs (loop0): invalid inodes per group: 8192 [ 583.556296] 22:30:32 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec000044001f00000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 583.637832] binder: 7876:7877 unknown command 768 22:30:32 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000007001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:32 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = dup(r0) ioctl$TIOCPKT(r1, 0x5420, &(0x7f00000004c0)=0x400000000063) read(r0, &(0x7f00000000c0)=""/11, 0xb) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) r2 = syz_open_pts(r0, 0x0) clone(0x3102001ff6, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$TUNSETLINK(r1, 0x400454cd, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x151) clone(0x1ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000380), 0xffffffffffffffff) connect$inet6(r3, &(0x7f0000000080), 0x1c) r4 = dup2(r3, r3) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r4, 0x6, 0x16, &(0x7f0000000440), 0x1320fd) sendmsg$FOU_CMD_DEL(r4, &(0x7f0000000440)={&(0x7f0000000180), 0xc, &(0x7f0000000300)={&(0x7f0000000540)=ANY=[]}}, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000200)) [ 583.666145] binder: 7876:7877 ioctl c0306201 20000140 returned -22 [ 583.698264] binder: 7885:7887 got transaction to invalid handle 22:30:32 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000680001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:32 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="056304060000000003630840", @ANYRES64=0x0, @ANYBLOB='\vc\x00\x00'], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:33 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 583.838025] EXT4-fs (loop0): invalid inodes per group: 8192 [ 583.838025] [ 583.886964] binder: 7905:7911 unknown command 100950789 [ 583.909695] EXT4-fs (loop0): invalid inodes per group: 8192 [ 583.909695] [ 583.919437] binder: 7905:7911 ioctl c0306201 20000140 returned -22 [ 583.931894] binder: 7914:7918 got transaction to invalid handle 22:30:33 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x4c00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:33 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x2000003, 0x10, r0, 0x0) socket$xdp(0x2c, 0x3, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x9, 0x0, &(0x7f0000000180)=[@transaction_sg={0x40486311, {{0x4, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000000080)=[0x78, 0x38, 0x18]}, 0x6}}, @exit_looper, @register_looper], 0xffd5, 0xfffffdfd, &(0x7f0000000180)}) getsockname(0xffffffffffffff9c, &(0x7f0000000000)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @dev}}}, &(0x7f00000000c0)=0x80) setsockopt$l2tp_PPPOL2TP_SO_LNSMODE(r1, 0x111, 0x4, 0x1, 0x4) 22:30:33 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec000044000300000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:33 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000006c1000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:33 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x7400000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 584.111956] binder: 7935:7936 got transaction to invalid handle [ 584.114149] binder: 7940:7941 got transaction to invalid handle [ 584.124979] EXT4-fs (loop0): invalid inodes per group: 8192 [ 584.124979] 22:30:33 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000050001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 584.190546] binder: 7940:7941 ioctl c0306201 20000140 returned -14 [ 584.225074] binder: 7940:7950 got transaction to invalid handle [ 584.247707] binder: 7955:7959 got transaction to invalid handle [ 584.257220] EXT4-fs (loop0): invalid inodes per group: 8192 [ 584.257220] [ 584.283999] binder: 7940:7950 ioctl c0306201 20000140 returned -14 22:30:33 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x300, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:33 executing program 1: syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff}) setsockopt$inet6_udp_int(r0, 0x11, 0x6f, &(0x7f0000000040)=0x9, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x341, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0563cacfa8e1000003630840", @ANYRES64=0x0, @ANYBLOB='\vc\x00\x00'], 0x0, 0xfffffdfd, &(0x7f0000000180)}) socket$bt_rfcomm(0x1f, 0x3, 0x3) ioctl$sock_inet_SIOCSIFDSTADDR(r0, 0x8918, &(0x7f0000000080)={'gre0\x00', {0x2, 0x4e20, @remote}}) 22:30:33 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = dup(r0) ioctl$TIOCPKT(r1, 0x5420, &(0x7f00000004c0)=0x400000000063) read(r0, &(0x7f00000000c0)=""/11, 0xb) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) r2 = syz_open_pts(r0, 0x0) clone(0x3102001ff6, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$TUNSETLINK(r1, 0x400454cd, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x151) clone(0x1ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000380), 0xffffffffffffffff) connect$inet6(r3, &(0x7f0000000080), 0x1c) r4 = dup2(r3, r3) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r4, 0x6, 0x16, &(0x7f0000000440), 0x1320fd) sendmsg$FOU_CMD_DEL(r4, &(0x7f0000000440)={&(0x7f0000000180), 0xc, &(0x7f0000000300)={&(0x7f0000000540)=ANY=[]}}, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000200)) 22:30:33 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec00004400000000fffffff607000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:33 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000501000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:33 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000031000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:33 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x60, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:33 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) r1 = dup(r0) bind$vsock_stream(r1, &(0x7f0000000040)={0x28, 0x0, 0xffffffff, @host}, 0x10) [ 584.838698] binder: 8000:8003 BC_FREE_BUFFER u0000000000000000 no match [ 584.856597] EXT4-fs (loop0): Unsupported filesystem blocksize 0 (-150994945 log_block_size) [ 584.883388] binder_thread_write: 5 callbacks suppressed 22:30:34 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x1200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 584.883397] binder: 8000:8003 ERROR: BC_REGISTER_LOOPER called without request 22:30:34 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000060001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 584.949201] EXT4-fs (loop0): Unsupported filesystem blocksize 0 (-150994945 log_block_size) [ 584.960757] binder: 8000:8003 BC_FREE_BUFFER u0000000000000000 no match [ 584.987021] binder: 8000:8003 ERROR: BC_REGISTER_LOOPER called without request 22:30:34 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x6000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:34 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec000044000000001000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:34 executing program 1: getrusage(0x1, &(0x7f0000000180)) r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$bt_bnep(0x1f, 0x3, 0x4) getsockopt$IP_VS_SO_GET_INFO(r1, 0x0, 0x481, &(0x7f0000000000), &(0x7f0000000040)=0xc) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:34 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = dup(r0) ioctl$TIOCPKT(r1, 0x5420, &(0x7f00000004c0)=0x400000000063) read(r0, &(0x7f00000000c0)=""/11, 0xb) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) r2 = syz_open_pts(r0, 0x0) clone(0x3102001ff6, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$TUNSETLINK(r1, 0x400454cd, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x151) clone(0x1ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000380), 0xffffffffffffffff) connect$inet6(r3, &(0x7f0000000080), 0x1c) r4 = dup2(r3, r3) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r4, 0x6, 0x16, &(0x7f0000000440), 0x1320fd) sendmsg$FOU_CMD_DEL(r4, &(0x7f0000000440)={&(0x7f0000000180), 0xc, &(0x7f0000000300)={&(0x7f0000000540)=ANY=[]}}, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000200)) 22:30:34 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000074001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 585.181830] EXT4-fs (loop0): Unsupported filesystem blocksize 67108864 (16 log_block_size) [ 585.196966] binder: 8056:8058 BC_FREE_BUFFER u0000000000000000 no match 22:30:34 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000010007a0001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:34 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x7a00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 585.259172] binder: 8056:8058 ERROR: BC_REGISTER_LOOPER called without request [ 585.300520] EXT4-fs (loop0): Unsupported filesystem blocksize 67108864 (16 log_block_size) [ 585.339043] binder: 8056:8079 BC_FREE_BUFFER u0000000000000000 no match 22:30:34 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec000044ac0d00000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 585.350040] binder: 8056:8079 ERROR: BC_REGISTER_LOOPER called without request 22:30:34 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0xffffff7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:34 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000001000)='/dev/zero\x00', 0xa82, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000001100)={'bond0\x00', 0x0}) ioctl$EXT4_IOC_PRECACHE_EXTENTS(r1, 0x6612) ioctl$EVIOCSCLOCKID(r1, 0x400445a0, &(0x7f0000000000)=0xc28) connect$can_bcm(r1, &(0x7f0000001140)={0x1d, r2}, 0x10) 22:30:34 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000004801000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:34 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000741000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:34 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x6c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:34 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = dup(r0) ioctl$TIOCPKT(r1, 0x5420, &(0x7f00000004c0)=0x400000000063) read(r0, &(0x7f00000000c0)=""/11, 0xb) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) r2 = syz_open_pts(r0, 0x0) clone(0x3102001ff6, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$TUNSETLINK(r1, 0x400454cd, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x151) clone(0x1ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000380), 0xffffffffffffffff) connect$inet6(r3, &(0x7f0000000080), 0x1c) r4 = dup2(r3, r3) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r4, 0x6, 0x16, &(0x7f0000000440), 0x1320fd) sendmsg$FOU_CMD_DEL(r4, &(0x7f0000000440)={&(0x7f0000000180), 0xc, &(0x7f0000000300)={&(0x7f0000000540)=ANY=[]}}, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000200)) [ 585.548470] EXT4-fs (loop0): invalid inodes per group: 8192 [ 585.548470] [ 585.570476] binder: 8108:8110 BC_FREE_BUFFER u0000000000000000 no match [ 585.618966] binder: 8108:8110 ERROR: BC_REGISTER_LOOPER called without request [ 585.628118] EXT4-fs (loop0): invalid inodes per group: 8192 [ 585.628118] [ 585.691034] binder: 8108:8110 BC_FREE_BUFFER u0000000000000000 no match 22:30:34 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x4800000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:34 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec0000447a0000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 585.739792] binder: 8108:8110 ERROR: BC_REGISTER_LOOPER called without request 22:30:34 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000002001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:35 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x24, 0x0, &(0x7f0000000040)=[@request_death={0x400c630e, 0x1, 0x2}, @request_death={0x400c630e, 0x2, 0x4}, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) dup(r0) [ 585.856662] EXT4-fs (loop0): invalid inodes per group: 8192 [ 585.856662] 22:30:35 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x48000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 585.938542] binder: 8155:8161 BC_REQUEST_DEATH_NOTIFICATION invalid ref 1 [ 585.970780] binder: 8155:8161 BC_REQUEST_DEATH_NOTIFICATION invalid ref 2 22:30:35 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000481000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 585.988068] EXT4-fs (loop0): invalid inodes per group: 8192 [ 585.988068] [ 586.015785] binder: 8155:8161 ERROR: BC_REGISTER_LOOPER called without request 22:30:35 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x400000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:35 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000006c01000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:35 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = fcntl$getown(r0, 0x9) ptrace$cont(0x20, r1, 0x0, 0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:35 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec000044000000000000002d07000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 586.223623] binder: 8187:8198 ERROR: BC_REGISTER_LOOPER called without request 22:30:35 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x12000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 586.271903] EXT4-fs (loop0): Invalid log block size: 754974720 [ 586.374058] EXT4-fs (loop0): Invalid log block size: 754974720 22:30:35 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = dup(r0) ioctl$TIOCPKT(r1, 0x5420, &(0x7f00000004c0)=0x400000000063) read(r0, &(0x7f00000000c0)=""/11, 0xb) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) syz_open_pts(r0, 0x0) clone(0x3102001ff6, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$TUNSETLINK(r1, 0x400454cd, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x151) clone(0x1ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000380), 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000000080), 0x1c) r3 = dup2(r2, r2) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f0000000440), 0x1320fd) sendmsg$FOU_CMD_DEL(r3, &(0x7f0000000440)={&(0x7f0000000180), 0xc, &(0x7f0000000300)={&(0x7f0000000540)=ANY=[]}}, 0x0) 22:30:35 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000004c1000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:35 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000000040000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:35 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x6000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:35 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x20, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0e48d47ed9ccf2630c4000000000010000000000000003630840", @ANYRES64=0x0, @ANYBLOB='\vc\x00\x00'], 0x34, 0xfffffdfd, &(0x7f0000000040)="e2d4c37a3cf788e31ad05d577f6cd23ad301a13a35b5d0e810706f86c910b832b694e2ef6aae24b008869a7753f47eaa740b33fb"}) 22:30:35 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec0000440000001f0000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 586.671497] binder: 8226:8235 unknown command 2127841294 [ 586.677017] binder: 8226:8235 ioctl c0306201 20000140 returned -22 [ 586.689657] EXT4-fs (loop0): invalid inodes per group: 8192 [ 586.689657] 22:30:35 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:35 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="056304400400000003630840", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00'], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 586.778332] EXT4-fs (loop0): invalid inodes per group: 8192 [ 586.778332] 22:30:36 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000010006c0001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:36 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec000044000004100000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:36 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x600, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 586.885168] binder: 8260:8261 unknown command 0 [ 586.890281] binder: 8260:8261 ioctl c0306201 20000140 returned -22 22:30:36 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000071000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 587.004203] EXT4-fs (loop0): invalid inodes per group: 8192 [ 587.004203] [ 587.117788] EXT4-fs (loop0): invalid inodes per group: 8192 [ 587.117788] 22:30:36 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x48, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:36 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) write$binfmt_script(r0, &(0x7f0000000180)={'#! ', './file0', [{0x20, 'securityvboxnet1$*%&cpuset\\'}], 0xa, "49b8313d64ee9f8a489ff01c17b9c01bd460faec55c1c261126a8bf0deb35ab2cf325230a44be5890496c63dca6c00cdb6db5fc8fd0f39d59749a0fe4939dd09735f3de290860042d1c9e74e5f08736a2ba8c848f41de26b20ba665525d9794e19098dd16c5bb64c10b2bc816c2131f32a7c40c16051177c194a130237a3b7682543699e32fa3d761a1cc311e7682fef9d2f0bdacaff6e7ef015075d1b63aaa45dc94851cd757ee42e3b91a93c726d9e33fc34713cfa050d528eb08514eeb43ee85f2e936e636acbdbeca011dc9133bf81dd564fd106f90c3598205b13c1e1de974e22e1d3"}, 0x10c) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:36 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000040001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:36 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec0000440000fc000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:36 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = dup(r0) ioctl$TIOCPKT(r1, 0x5420, &(0x7f00000004c0)=0x400000000063) read(r0, &(0x7f00000000c0)=""/11, 0xb) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) syz_open_pts(r0, 0x0) clone(0x3102001ff6, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$TUNSETLINK(r1, 0x400454cd, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x151) clone(0x1ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000380), 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000000080), 0x1c) r3 = dup2(r2, r2) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f0000000440), 0x1320fd) 22:30:36 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000061000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 587.651025] binder_thread_write: 31 callbacks suppressed [ 587.651038] binder: 8307:8308 Acquire 1 refcount change on invalid ref 4 ret -22 [ 587.670657] binder: 8311:8314 Acquire 1 refcount change on invalid ref 0 ret -22 [ 587.684548] EXT4-fs (loop0): invalid inodes per group: 8192 [ 587.684548] [ 587.689687] binder_transaction: 64 callbacks suppressed [ 587.689718] binder: 8311:8314 transaction failed 29201/-22, size 0-0 line 2834 [ 587.692374] binder: 8307:8308 ERROR: BC_REGISTER_LOOPER called without request [ 587.731302] binder: 8312:8326 transaction failed 29189/-22, size 0-0 line 2834 22:30:36 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:36 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec000044fbffffff0000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 587.755312] EXT4-fs (loop0): invalid inodes per group: 8192 [ 587.755312] [ 587.764711] binder: 8307:8329 Acquire 1 refcount change on invalid ref 4 ret -22 [ 587.774637] binder: 8310:8317 transaction failed 29189/-22, size 0-0 line 2834 [ 587.782696] binder: 8307:8329 ERROR: BC_REGISTER_LOOPER called without request [ 587.792525] binder: 8312:8331 transaction failed 29189/-22, size 0-0 line 2834 22:30:37 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$adsp(&(0x7f0000000100)='/dev/adsp#\x00', 0x3, 0x0) ioctl$KVM_PPC_ALLOCATE_HTAB(r1, 0xc004aea7, &(0x7f0000000180)=0x3ff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="056304400400000003630840", @ANYRES64=0x0, @ANYBLOB="1463005c19fbc238f400"], 0x0, 0xfffffdfd, &(0x7f0000000180)}) r2 = syz_open_dev$audion(&(0x7f0000000440)='/dev/audio#\x00', 0x0, 0x80) ioctl$DRM_IOCTL_INFO_BUFS(r2, 0xc0106418, &(0x7f0000000040)={0x547, 0x6, 0x0, 0x1, 0xc, 0x8}) getsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000000480)={0x0, 0x81, 0x3f, 0x80}, &(0x7f00000004c0)=0x10) setsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r2, 0x84, 0xc, &(0x7f00000000c0)=0xffffffffffffff7f, 0x4) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r2, 0x84, 0x1f, &(0x7f0000000500)={r3, @in={{0x2, 0x4e20, @broadcast}}, 0x7f, 0x200}, &(0x7f00000005c0)=0x90) [ 587.852779] binder_release_work: 62 callbacks suppressed [ 587.852785] binder: undelivered TRANSACTION_ERROR: 29189 [ 587.869110] binder: 8336:8341 Acquire 1 refcount change on invalid ref 0 ret -22 [ 587.920353] EXT4-fs (loop0): invalid inodes per group: 8192 [ 587.920353] [ 587.930405] binder: undelivered TRANSACTION_ERROR: 29189 [ 587.939034] binder: 8310:8354 transaction failed 29189/-22, size 0-0 line 2834 [ 587.948389] binder: 8352:8353 Acquire 1 refcount change on invalid ref 4 ret -22 [ 587.948841] binder_transaction: 18 callbacks suppressed [ 587.948853] binder: 8336:8341 got transaction to invalid handle 22:30:37 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000070001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 587.967760] binder_thread_write: 4 callbacks suppressed [ 587.967771] binder: 8352:8353 BC_FREE_BUFFER u0000000000000000 no match [ 587.988995] binder: undelivered TRANSACTION_ERROR: 29189 [ 587.992288] binder: 8336:8341 transaction failed 29201/-22, size 0-0 line 2834 [ 588.011070] binder: 8352:8353 unknown command 1543529236 22:30:37 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000002001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 588.012004] binder: undelivered TRANSACTION_ERROR: 29189 [ 588.036111] binder: 8352:8353 ioctl c0306201 20000140 returned -22 [ 588.062437] binder: undelivered TRANSACTION_ERROR: 29201 [ 588.078585] EXT4-fs (loop0): invalid inodes per group: 8192 [ 588.078585] [ 588.101907] binder: 8352:8358 Acquire 1 refcount change on invalid ref 4 ret -22 22:30:37 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x2000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 588.125509] binder: 8359:8369 transaction failed 29189/-22, size 0-0 line 2834 [ 588.172276] binder: 8352:8358 BC_FREE_BUFFER u0000000000000000 no match [ 588.196096] binder: 8359:8379 transaction failed 29189/-22, size 0-0 line 2834 [ 588.201753] binder: 8365:8366 transaction failed 29189/-22, size 0-0 line 2834 [ 588.224539] binder: undelivered TRANSACTION_ERROR: 29189 [ 588.230684] binder: undelivered TRANSACTION_ERROR: 29189 [ 588.239898] binder: 8352:8358 unknown command 1543529236 [ 588.252093] binder: 8380:8381 Acquire 1 refcount change on invalid ref 0 ret -22 22:30:37 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec000044f4ffffff0000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:37 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000010000a0001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 588.270935] binder: 8352:8358 ioctl c0306201 20000140 returned -22 [ 588.284875] binder: 8380:8381 got transaction to invalid handle [ 588.295844] binder: 8380:8381 transaction failed 29201/-22, size 0-0 line 2834 22:30:37 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000240)={0x6, 0x70, 0x0, 0x4, 0x8001, 0x4, 0x0, 0x80000000, 0x800, 0x8, 0x1f, 0x5, 0x3, 0x8, 0x1, 0x7fffffff, 0x0, 0x5, 0xfffffffffffff248, 0xfffffffffffffeff, 0x3ff, 0x4, 0x3, 0x5, 0x1, 0x1, 0xed, 0xfffffffffffffffa, 0xaed, 0x78, 0x20, 0x6, 0x280f7e88, 0x6, 0x0, 0x0, 0x2, 0x1, 0x0, 0xfa, 0x4, @perf_config_ext={0xffffffffffff8000, 0x6}, 0x20000, 0x4, 0x8, 0xb, 0x9, 0x18c5, 0x3f}, 0xffffffffffffffff, 0x7, 0xffffffffffffffff, 0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0000000000000000b36308402c54ab12345537d1de3f520277186ee98fc9405afbfdf1fec1a14691fc74", @ANYRES64=0x0, @ANYBLOB='\fc\x00\x00'], 0x0, 0xfffffdfd, &(0x7f0000000180)}) r1 = syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x3eb73c84, 0x20000) write$UHID_CREATE2(r1, &(0x7f0000000480)={0xb, 'syz1\x00', 'syz0\x00', 'syz1\x00', 0x67, 0xffffffffffffffa1, 0x8, 0x2, 0xe6, 0x6, "b5c8c29865080b7c2adb1a27c5e670e9005bbdc5f31fa52921f745fa6626031b7bb8102139271ffdf8e78ea34e74fb0115a58b85a59a1beabc240094ffc687e1ea22e1eb0e3c5d2be514b4131fba494e404a4b6fad06aa2740311f311782802be918590c84f37c"}, 0x17f) r2 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x802, 0x0) getsockopt$bt_BT_SNDMTU(r2, 0x112, 0xc, &(0x7f0000000040)=0x8, &(0x7f0000000080)=0x2) getsockopt$bt_rfcomm_RFCOMM_LM(r0, 0x12, 0x3, &(0x7f0000000200), &(0x7f0000000180)=0xffffffffffffff52) [ 588.350955] binder: undelivered TRANSACTION_ERROR: 29201 [ 588.357166] EXT4-fs (loop0): invalid inodes per group: 8192 [ 588.357166] [ 588.375733] binder: undelivered TRANSACTION_ERROR: 29189 [ 588.402273] binder: undelivered TRANSACTION_ERROR: 29189 22:30:37 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000006c001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 588.450053] EXT4-fs (loop0): invalid inodes per group: 8192 [ 588.450053] [ 588.494433] binder: 8408:8410 unknown command 0 [ 588.530148] binder: 8408:8410 ioctl c0306201 20000140 returned -22 [ 588.571783] binder: 8408:8416 unknown command 0 [ 588.584173] binder: 8408:8416 ioctl c0306201 20000140 returned -22 22:30:37 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = dup(r0) ioctl$TIOCPKT(r1, 0x5420, &(0x7f00000004c0)=0x400000000063) read(r0, &(0x7f00000000c0)=""/11, 0xb) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) syz_open_pts(r0, 0x0) clone(0x3102001ff6, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$TUNSETLINK(r1, 0x400454cd, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x151) clone(0x1ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000380), 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000000080), 0x1c) r3 = dup2(r2, r2) sendmsg$FOU_CMD_DEL(r3, &(0x7f0000000440)={&(0x7f0000000180), 0xc, &(0x7f0000000300)={&(0x7f0000000540)=ANY=[]}}, 0x0) 22:30:37 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x3f000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:37 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000a01000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:37 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec000044004c00000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:37 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) getsockname(0xffffffffffffff9c, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @loopback}}}, &(0x7f0000000080)=0x80) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000180)='IPVS\x00') sendmsg$IPVS_CMD_DEL_DAEMON(r1, &(0x7f00000002c0)={&(0x7f00000000c0), 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0x88, r2, 0xf00, 0x70bd28, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_DAEMON={0x6c, 0x3, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x3}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x5}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x20}}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @dev={0xfe, 0x80, [], 0x17}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x3}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @loopback}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x3}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e24}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xffff}]}, 0x88}, 0x1, 0x0, 0x0, 0x24004800}, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x18, 0x0, &(0x7f0000000300)=[@release={0x40046306, 0x1}, @free_buffer, @register_looper], 0x2, 0xfffffdfd, &(0x7f00000003c0)='E\b'}) 22:30:37 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000000a001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 588.781270] binder: 8430:8436 Release 1 refcount change on invalid ref 1 ret -22 [ 588.788882] binder: 8430:8436 BC_FREE_BUFFER u0000000000000000 no match [ 588.814326] binder: 8429:8443 Acquire 1 refcount change on invalid ref 0 ret -22 [ 588.823877] EXT4-fs (loop0): invalid inodes per group: 8192 [ 588.823877] 22:30:38 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x7400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 588.832214] binder: 8429:8443 got transaction to invalid handle [ 588.864526] binder: 8430:8453 Release 1 refcount change on invalid ref 1 ret -22 22:30:38 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000030001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 588.903095] binder: 8430:8453 BC_FREE_BUFFER u0000000000000000 no match [ 588.928379] EXT4-fs (loop0): invalid inodes per group: 8192 [ 588.928379] 22:30:38 executing program 1: ioctl$sock_SIOCGPGRP(0xffffffffffffff9c, 0x8904, &(0x7f0000000080)=0x0) waitid(0x0, r0, 0x0, 0x8, &(0x7f0000000180)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) r1 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x40002, 0x0) write$cgroup_int(r1, &(0x7f0000000040)=0x200, 0x12) [ 588.972326] binder: 8468:8470 got transaction to invalid handle 22:30:38 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec000044480000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:38 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000121000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:38 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x4800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 589.144950] EXT4-fs (loop0): invalid inodes per group: 8192 [ 589.144950] [ 589.220349] EXT4-fs (loop0): invalid inodes per group: 8192 [ 589.220349] [ 589.239365] binder: 8504:8505 got transaction to invalid handle 22:30:38 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = dup(r0) ioctl$TIOCPKT(r1, 0x5420, &(0x7f00000004c0)=0x400000000063) read(r0, &(0x7f00000000c0)=""/11, 0xb) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) syz_open_pts(r0, 0x0) clone(0x3102001ff6, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$TUNSETLINK(r1, 0x400454cd, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x151) clone(0x1ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000380), 0xffffffffffffffff) connect$inet6(r2, &(0x7f0000000080), 0x1c) sendmsg$FOU_CMD_DEL(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000180), 0xc, &(0x7f0000000300)={&(0x7f0000000540)=ANY=[]}}, 0x0) 22:30:38 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000600001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:38 executing program 1: r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x200000, 0x0) ioctl$UI_BEGIN_FF_UPLOAD(r0, 0xc06855c8, &(0x7f0000000080)={0x10, 0x101, {0x57, 0x2, 0x53, {0x80, 0x81}, {0xfff, 0x9}, @const={0x3, {0x0, 0x80, 0x6, 0x27}}}, {0x57, 0x7, 0x1, {0x6, 0x7}, {0x9f, 0x7ff}, @cond=[{0x400, 0x7, 0x400, 0x32, 0x3df, 0x80000001}, {0x1, 0x7, 0x6, 0xfff, 0x8000, 0x9}]}}) socket$xdp(0x2c, 0x3, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000000)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:38 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:38 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec000044000000000000041007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:38 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000005001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 589.657486] binder: 8519:8520 got transaction to invalid handle [ 589.665068] binder: 8517:8518 BC_FREE_BUFFER u0000000000000000 no match [ 589.686593] EXT4-fs (loop0): Invalid log block size: 268697600 [ 589.691761] binder: 8517:8531 BC_FREE_BUFFER u0000000000000000 no match 22:30:38 executing program 1: openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x804) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:38 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x12, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:38 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000740001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 589.777909] EXT4-fs (loop0): Invalid log block size: 268697600 22:30:39 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec000044006000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:39 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x3000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 589.835816] binder: 8547:8551 BC_FREE_BUFFER u0000000000000000 no match [ 589.838639] binder: 8552:8553 got transaction to invalid handle [ 589.873415] binder: 8547:8558 BC_FREE_BUFFER u0000000000000000 no match 22:30:39 executing program 1: syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 589.963852] binder: 8559:8563 got transaction to invalid handle [ 589.975388] binder: 8559:8563 got transaction to invalid handle [ 590.014097] EXT4-fs (loop0): invalid inodes per group: 8192 [ 590.014097] [ 590.069049] EXT4-fs (loop0): invalid inodes per group: 8192 [ 590.069049] 22:30:39 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = dup(r0) ioctl$TIOCPKT(r1, 0x5420, &(0x7f00000004c0)=0x400000000063) read(r0, &(0x7f00000000c0)=""/11, 0xb) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) syz_open_pts(r0, 0x0) clone(0x3102001ff6, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$TUNSETLINK(r1, 0x400454cd, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x151) clone(0x1ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000380), 0xffffffffffffffff) sendmsg$FOU_CMD_DEL(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000180), 0xc, &(0x7f0000000300)={&(0x7f0000000540)=ANY=[]}}, 0x0) 22:30:39 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000003001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:39 executing program 1: r0 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0xfffffffffffffffb, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0x43, 0x0, &(0x7f0000000080)="6a37600393c24a2c7c95f6af438762c171f6253804b939804e03eb58f1491a6e8b3d72e514b2d742b5edef488c706a588e12a728314a63dd99503d72175338d86c965b"}) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) ioctl$sock_SIOCOUTQ(r0, 0x5411, &(0x7f00000001c0)) 22:30:39 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x4c00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:39 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000006801000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:39 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec000044fcfdffff0000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 590.519456] binder: 8586:8589 BC_FREE_BUFFER u0000000000000000 no match [ 590.529688] binder: 8587:8588 got transaction to invalid handle [ 590.537573] binder_thread_write: 6 callbacks suppressed [ 590.537583] binder: 8586:8589 ERROR: BC_REGISTER_LOOPER called without request [ 590.553823] EXT4-fs (loop0): invalid inodes per group: 8192 [ 590.553823] 22:30:39 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0xffffff7f00000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 590.606442] binder: 8586:8589 BC_FREE_BUFFER u0000000000000000 no match [ 590.621787] EXT4-fs (loop0): invalid inodes per group: 8192 [ 590.621787] [ 590.642865] binder: 8586:8589 ERROR: BC_REGISTER_LOOPER called without request 22:30:39 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x20000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:39 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000010004c0001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:39 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:39 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec000044f5ffffff0000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:39 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000051000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 590.794639] binder: 8629:8632 ioctl 40046205 0 returned -22 [ 590.842741] EXT4-fs (loop0): invalid inodes per group: 8192 [ 590.842741] [ 590.854107] binder: 8629:8643 ERROR: BC_REGISTER_LOOPER called without request [ 590.894125] binder: 8629:8632 ioctl 40046205 0 returned -22 [ 590.921763] binder: 8629:8643 ERROR: BC_REGISTER_LOOPER called without request [ 590.947205] EXT4-fs (loop0): invalid inodes per group: 8192 [ 590.947205] 22:30:40 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = dup(r0) ioctl$TIOCPKT(r1, 0x5420, &(0x7f00000004c0)=0x400000000063) read(r0, &(0x7f00000000c0)=""/11, 0xb) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) syz_open_pts(r0, 0x0) clone(0x3102001ff6, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$TUNSETLINK(r1, 0x400454cd, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x151) sendmsg$FOU_CMD_DEL(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000180), 0xc, &(0x7f0000000300)={&(0x7f0000000540)=ANY=[]}}, 0x0) 22:30:40 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x4000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:40 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="c000800000000000e8ffffef", @ANYRES64=0x0, @ANYBLOB='\vc\x00\x00'], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:40 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000020001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:40 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec000044002d00000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:40 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000004001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:40 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0xa000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 591.420507] EXT4-fs (loop0): invalid inodes per group: 8192 [ 591.420507] [ 591.462399] binder: 8679:8682 unknown command 8388800 [ 591.467672] binder: 8679:8682 ioctl c0306201 20000140 returned -22 [ 591.497965] EXT4-fs (loop0): invalid inodes per group: 8192 [ 591.497965] 22:30:40 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000120001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:40 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:40 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec000044002000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:40 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="056d044004000000036308d0c24039cfb0109d62a4e3e3d61ae240c614d10670863260e28d0f33ebdc0197a2c2853f4cdfbed4e93738811f0e2655f8918400ec63cfecdb4e137de25e273212f5a1a0ba20afb0ea56252569ca72779112eac000bb71ef63233d566dc2faca1b9523247d521ec0a1857c4b29896f124ca01c3ce0faf5cb0a71f560560b371848186036ba48bfa9dda13ff8a566948ebde7d342354b970f96269a1bdd26f9b3c65c47a3be654f3c082b619a5e5319db73e38765b42bacf3bb524b864b8a04373660493fedb777b74fcc46b37380bcd588464db8b8ace134df5eeac03d92588efda70f0f11e3d638113376a36de8e555cee0e0f2e07313ade5942cc0e33cc8c3e9042033dab2fdb1343d5aa20c0af4081c86eb646f6d0ed0d5ce79fa597c59df3985dad3c47d0a0699c1234fdfc7b98aeaddfa211973ee0cbd74c03757b0ac28beda3d4ba7bd0dc4415a9284b180529b8324a95d0e129bba36d9821bd8e8c87e5436ed6f040cbcdc4ebd4cb93f", @ANYRES64=0x0, @ANYBLOB='\vc\x00\x00'], 0x0, 0xfffffdfd, &(0x7f0000000180)}) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x400, 0x0) getsockopt$inet_sctp6_SCTP_CONTEXT(0xffffffffffffff9c, 0x84, 0x11, &(0x7f0000000040)={0x0, 0x7}, &(0x7f0000000080)=0x8) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f00000002c0)={0x0, 0x18, 0xfa00, {0x2, &(0x7f00000001c0)={0xffffffffffffffff}, 0x13f, 0x8}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r1, &(0x7f0000000300)={0x5, 0x10, 0xfa00, {&(0x7f0000000540), r3}}, 0x18) getsockopt$inet_sctp_SCTP_DELAYED_SACK(r1, 0x84, 0x10, &(0x7f00000000c0)=@sack_info={r2, 0x7cf, 0x3}, &(0x7f0000000180)=0xc) lsetxattr$trusted_overlay_opaque(&(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='trusted.overlay.opaque\x00', &(0x7f0000000280)='y\x00', 0x2, 0x1) 22:30:40 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000007a1000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 591.710191] EXT4-fs (loop0): invalid inodes per group: 8192 [ 591.710191] [ 591.765604] binder: 8725:8727 unknown command 1074031877 [ 591.779255] EXT4-fs (loop0): invalid inodes per group: 8192 [ 591.779255] [ 591.810595] binder: 8725:8727 ioctl c0306201 20000140 returned -22 [ 591.840288] binder: 8725:8727 unknown command 1074031877 [ 591.847012] binder: 8725:8727 ioctl c0306201 20000140 returned -22 22:30:41 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = dup(r0) ioctl$TIOCPKT(r1, 0x5420, &(0x7f00000004c0)=0x400000000063) read(r0, &(0x7f00000000c0)=""/11, 0xb) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) syz_open_pts(r0, 0x0) clone(0x3102001ff6, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$TUNSETLINK(r1, 0x400454cd, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$FOU_CMD_DEL(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000180), 0xc, &(0x7f0000000300)={&(0x7f0000000540)=ANY=[]}}, 0x0) 22:30:41 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:41 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000006001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:41 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0xfdfd, 0x0, &(0x7f0000000200)=ANY=[@ANYRESHEX=r0, @ANYBLOB="a1e4df239a58998386c222b6858cea1d468797377124de5e28155e130bd7a73c8edceb7513444bc3c92277ba0f5da7a0fa4b7ac08dd7663936d66d3e5d7d303d8f307c5131a97ebb34d6ff3ffcee057513e7043ed98cf2b3842ad7349648d62f2aa36df874ce3921a7b1a41c5c8d1de3d3beba945842f3cdae9afec55d59ba23c59c992114f2efd52e971d", @ANYRES16=r0, @ANYRESOCT=0x0, @ANYRES64=r0, @ANYBLOB="15b759e997fb792974b7758d4df92ed806"], 0x6d, 0xfffffdfd, &(0x7f0000000180)}) 22:30:41 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec000044080000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:41 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000681000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:41 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 592.316362] binder: 8756:8757 unknown command 808482864 [ 592.328517] EXT4-fs (loop0): invalid inodes per group: 8192 [ 592.328517] [ 592.352213] binder: 8756:8757 ioctl c0306201 20000140 returned -22 22:30:41 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000007401000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:41 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$usb(&(0x7f00000003c0)='/dev/bus/usb/00#/00#\x00', 0x8, 0x41) write$P9_RSTAT(r1, &(0x7f0000000040)={0x62, 0x7d, 0x1, {0x0, 0x5b, 0x8000, 0x1ff, {0x21, 0x3, 0x3}, 0x40050000, 0x6, 0x755b, 0x5db2, 0xd, '/dev/binder#\x00', 0x1, '%', 0xd, '/dev/binder#\x00', 0xd, '/dev/binder#\x00'}}, 0x62) ioctl$LOOP_GET_STATUS64(r1, 0x4c05, &(0x7f0000000180)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="056304400400000003630840", @ANYRES64=0x0, @ANYBLOB="0b63000027127de03e7c95be16c5f10b04a23e0ae502af72daa3084041371ddfdf39c4f20c054db40071db28d195ac01000000e4881262f4b1aa8a04040001d08a0ed6e32e36927419d7cd2e5e1437ee8d559030841da2d95416fbf16ec7534bd157b7fa"], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 592.416570] EXT4-fs (loop0): invalid inodes per group: 8192 [ 592.416570] 22:30:41 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec000044fffffdfc0000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:41 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x1200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 592.556690] binder: 8792:8797 ERROR: BC_REGISTER_LOOPER called without request 22:30:41 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000048001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 592.625681] binder: 8792:8810 ERROR: BC_REGISTER_LOOPER called without request [ 592.646745] EXT4-fs (loop0): invalid inodes per group: 8192 [ 592.646745] [ 592.690541] binder_thread_write: 25 callbacks suppressed [ 592.690556] binder: 8811:8812 Acquire 1 refcount change on invalid ref 0 ret -22 [ 592.704856] binder_transaction: 54 callbacks suppressed [ 592.704874] binder: 8811:8812 transaction failed 29201/-22, size 0-0 line 2834 [ 592.741441] EXT4-fs (loop0): invalid inodes per group: 8192 [ 592.741441] [ 592.751996] binder: 8811:8812 Acquire 1 refcount change on invalid ref 0 ret -22 [ 592.778620] binder: 8814:8819 transaction failed 29189/-22, size 0-0 line 2834 [ 592.781294] binder: 8811:8812 transaction failed 29201/-22, size 0-0 line 2834 22:30:42 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = dup(r0) ioctl$TIOCPKT(r1, 0x5420, &(0x7f00000004c0)=0x400000000063) read(r0, &(0x7f00000000c0)=""/11, 0xb) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) syz_open_pts(r0, 0x0) clone(0x3102001ff6, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$TUNSETLINK(r1, 0x400454cd, 0x0) sendmsg$FOU_CMD_DEL(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000180), 0xc, &(0x7f0000000300)={&(0x7f0000000540)=ANY=[]}}, 0x0) 22:30:42 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000007a01000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:42 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) shmget$private(0x0, 0x1000, 0x820, &(0x7f0000fff000/0x1000)=nil) r1 = syz_open_dev$amidi(&(0x7f0000000000)='/dev/amidi#\x00', 0x8, 0x242000) write$smack_current(r1, &(0x7f0000000040)='#\x00', 0x2) ioctl$KVM_GET_REGS(r1, 0x8090ae81, &(0x7f0000000180)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0563659c073cab4e8d420840", @ANYRES64=0x0, @ANYBLOB='\nc\x00\x00'], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:42 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec00004400000000fffffffb07000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:42 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x74000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:42 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000068001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 593.210121] EXT4-fs (loop0): Unsupported filesystem blocksize 0 (-67108865 log_block_size) [ 593.211544] binder: 8835:8842 transaction failed 29189/-22, size 0-0 line 2834 [ 593.220615] binder: 8836:8849 Acquire 1 refcount change on invalid ref 0 ret -22 [ 593.250229] binder: 8834:8848 unknown command -1671077115 [ 593.256166] binder: 8834:8848 ioctl c0306201 20000140 returned -22 [ 593.270492] binder_transaction: 10 callbacks suppressed [ 593.270501] binder: 8836:8849 got transaction to invalid handle [ 593.273595] binder: 8835:8857 transaction failed 29189/-22, size 0-0 line 2834 [ 593.285043] binder: 8838:8859 transaction failed 29189/-22, size 0-0 line 2834 [ 593.307589] binder: 8836:8849 transaction failed 29201/-22, size 0-0 line 2834 [ 593.310482] binder_release_work: 56 callbacks suppressed [ 593.310492] binder: undelivered TRANSACTION_ERROR: 29189 [ 593.336003] binder: undelivered TRANSACTION_ERROR: 29189 22:30:42 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x700, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:42 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000301000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 593.355729] binder: undelivered TRANSACTION_ERROR: 29201 22:30:42 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x505000, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000040), 0x0, 0x8}}, 0x20) setsockopt$l2tp_PPPOL2TP_SO_LNSMODE(r1, 0x111, 0x4, 0x1, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 593.390381] EXT4-fs (loop0): Unsupported filesystem blocksize 0 (-67108865 log_block_size) [ 593.409288] binder: 8838:8874 transaction failed 29189/-22, size 0-0 line 2834 [ 593.416113] binder: 8871:8873 Acquire 1 refcount change on invalid ref 0 ret -22 [ 593.429642] binder: undelivered TRANSACTION_ERROR: 29189 [ 593.435157] binder: undelivered TRANSACTION_ERROR: 29189 22:30:42 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000003f1000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 593.489707] binder: 8871:8873 got transaction to invalid handle [ 593.499211] binder: 8875:8882 Acquire 1 refcount change on invalid ref 4 ret -22 [ 593.520972] binder: 8878:8884 transaction failed 29189/-22, size 0-0 line 2834 [ 593.521865] binder: 8871:8873 transaction failed 29201/-22, size 0-0 line 2834 22:30:42 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec000044070000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 593.547697] binder_thread_write: 4 callbacks suppressed [ 593.547708] binder: 8875:8882 BC_FREE_BUFFER u0000000000000000 no match [ 593.574134] binder: undelivered TRANSACTION_ERROR: 29189 [ 593.582222] binder: undelivered TRANSACTION_ERROR: 29189 [ 593.595265] binder: 8875:8882 ERROR: BC_REGISTER_LOOPER called without request [ 593.605519] binder: undelivered TRANSACTION_ERROR: 29201 [ 593.618011] binder: 8875:8894 Acquire 1 refcount change on invalid ref 4 ret -22 22:30:42 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000001201000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 593.644059] binder: 8875:8894 BC_FREE_BUFFER u0000000000000000 no match [ 593.655246] binder: 8875:8894 ERROR: BC_REGISTER_LOOPER called without request [ 593.695701] EXT4-fs (loop0): invalid inodes per group: 8192 [ 593.695701] [ 593.789932] binder: undelivered TRANSACTION_ERROR: 29189 [ 593.823510] EXT4-fs (loop0): invalid inodes per group: 8192 [ 593.823510] [ 593.830049] binder: undelivered TRANSACTION_ERROR: 29189 22:30:43 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = getpgrp(0x0) ptrace$PTRACE_SECCOMP_GET_METADATA(0x420d, r1, 0x10, &(0x7f0000000180)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/lblcr_expiration\x00', 0x2, 0x0) ioctl$RNDADDENTROPY(r2, 0x40085203, &(0x7f0000000040)={0x8, 0x9c, "ed2b1c12344cbf0bf27f722f37907564ea1132d3f182e598f75b528762ad0909c9162a383971d0ebeb178ecce83a9fcc5dae27ff4bcbed3b1ec2de108c86e74b8781bae8b72614304194818ad98f29bf4ba1575d15225cf0213d2186ca34b933c78192bec3de679043875505840b2101a129a957b9ad89164a84fb215c9c0c882e92f2daa74ec93a047e4553ff4af65e69d7e1ffb6ed7f19b6609d0b"}) 22:30:43 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x6c00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:43 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000601000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:43 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = dup(r0) ioctl$TIOCPKT(r1, 0x5420, &(0x7f00000004c0)=0x400000000063) read(r0, &(0x7f00000000c0)=""/11, 0xb) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) syz_open_pts(r0, 0x0) ioctl$TUNSETLINK(r1, 0x400454cd, 0x0) sendmsg$FOU_CMD_DEL(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000180), 0xc, &(0x7f0000000300)={&(0x7f0000000540)=ANY=[]}}, 0x0) 22:30:43 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000701000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:43 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec000044000000000000fc0007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 594.083124] binder: 8925:8930 Acquire 1 refcount change on invalid ref 0 ret -22 [ 594.116337] binder: 8926:8940 Acquire 1 refcount change on invalid ref 4 ret -22 [ 594.124383] binder: 8925:8930 got transaction to invalid handle [ 594.138430] binder: 8926:8940 BC_FREE_BUFFER u0000000000000000 no match [ 594.158260] EXT4-fs (loop0): Invalid log block size: 16515072 [ 594.161101] binder: 8926:8940 ERROR: BC_REGISTER_LOOPER called without request 22:30:43 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x74, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:43 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000004c01000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 594.216908] binder: 8926:8940 Acquire 1 refcount change on invalid ref 4 ret -22 [ 594.231637] binder: 8926:8940 BC_FREE_BUFFER u0000000000000000 no match [ 594.271375] EXT4-fs (loop0): Invalid log block size: 16515072 [ 594.273339] binder: 8961:8962 Acquire 1 refcount change on invalid ref 0 ret -22 [ 594.299442] binder: 8926:8940 ERROR: BC_REGISTER_LOOPER called without request 22:30:43 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000060001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:43 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec0000440000000000000dac07000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:43 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x201, 0x0) ioctl$RTC_UIE_ON(r1, 0x7003) [ 594.400124] binder: 8961:8962 got transaction to invalid handle 22:30:43 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x6c00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 594.468999] EXT4-fs (loop0): Invalid log block size: 2886533120 [ 594.487366] binder: 8988:8989 BC_FREE_BUFFER u0000000000000000 no match 22:30:43 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000063000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 594.533555] binder: 8988:8989 BC_FREE_BUFFER u0000000000000000 no match [ 594.544904] binder: 8993:8996 got transaction to invalid handle [ 594.567377] EXT4-fs (loop0): Invalid log block size: 2886533120 22:30:43 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec000044000004000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:43 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x300000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:43 executing program 1: uname(&(0x7f0000000040)=""/5) r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0xfffffffffffffffd) fcntl$F_GET_RW_HINT(r0, 0x40b, &(0x7f0000000000)) fcntl$getflags(r0, 0xbd15dc7627a4521e) fcntl$setsig(r0, 0xa, 0x2) socket$xdp(0x2c, 0x3, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0563400400000003630840", @ANYRES64=0x0, @ANYBLOB='\vc\x00\x00'], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 594.674349] EXT4-fs (loop0): invalid inodes per group: 8192 [ 594.674349] [ 594.732968] binder: 9013:9015 got transaction to invalid handle [ 594.747273] EXT4-fs (loop0): invalid inodes per group: 8192 [ 594.747273] 22:30:44 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = dup(r0) ioctl$TIOCPKT(r1, 0x5420, &(0x7f00000004c0)=0x400000000063) read(r0, &(0x7f00000000c0)=""/11, 0xb) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) clone(0x3102001ff6, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$TUNSETLINK(r1, 0x400454cd, 0x0) sendmsg$FOU_CMD_DEL(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000180), 0xc, &(0x7f0000000300)={&(0x7f0000000540)=ANY=[]}}, 0x0) 22:30:44 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000012001000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:44 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000001201000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:44 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec000044002300000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:44 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0xa00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:44 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="f957e994d91a865660d8094523f2b369327a43", @ANYRES64=0x0, @ANYBLOB='\vc\x00\x00'], 0x0, 0xfffffdfd, &(0x7f0000000180)}) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vsock\x00', 0x28000, 0x0) ioctl$UI_GET_VERSION(r1, 0x8004552d, &(0x7f0000000080)) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x0, 0x0) ioctl$VHOST_SET_OWNER(r2, 0xaf01, 0x0) [ 594.972288] binder: 9037:9041 unknown command -1796646919 [ 594.979306] EXT4-fs (loop0): invalid inodes per group: 8192 [ 594.979306] [ 594.996898] binder: 9037:9041 ioctl c0306201 20000140 returned -22 [ 594.998221] binder: 9040:9047 got transaction to invalid handle [ 595.032109] Unknown ioctl -2147199699 [ 595.040602] Unknown ioctl -2147199699 [ 595.053045] binder: 9037:9041 unknown command -1796646919 [ 595.062528] binder: 9037:9041 ioctl c0306201 20000140 returned -22 22:30:44 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x600000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:44 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000025000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 595.088271] EXT4-fs (loop0): invalid inodes per group: 8192 [ 595.088271] 22:30:44 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) r1 = openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x60) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(0xffffffffffffff9c, 0x84, 0x22, &(0x7f0000000040)={0x6, 0x8004, 0x5e, 0x5, 0x0}, &(0x7f0000000080)=0x10) setsockopt$inet_sctp6_SCTP_SET_PEER_PRIMARY_ADDR(r1, 0x84, 0x5, &(0x7f0000000180)={r2, @in={{0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x10}}}}, 0x84) 22:30:44 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000201000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 595.156086] binder: 9069:9074 got transaction to invalid handle 22:30:44 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec000044006800000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:44 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x7a00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 595.270242] binder: 9078:9084 BC_FREE_BUFFER u0000000000000000 no match [ 595.315436] binder: 9078:9084 BC_FREE_BUFFER u0000000000000000 no match [ 595.326314] binder: 9088:9093 got transaction to invalid handle [ 595.343222] binder: 9088:9093 got transaction to invalid handle [ 595.349598] EXT4-fs (loop0): invalid inodes per group: 8192 [ 595.349598] [ 595.451601] EXT4-fs (loop0): invalid inodes per group: 8192 [ 595.451601] 22:30:44 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = dup(r0) ioctl$TIOCPKT(r1, 0x5420, &(0x7f00000004c0)=0x400000000063) read(r0, &(0x7f00000000c0)=""/11, 0xb) clone(0x3102001ff6, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$TUNSETLINK(r1, 0x400454cd, 0x0) sendmsg$FOU_CMD_DEL(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000180), 0xc, &(0x7f0000000300)={&(0x7f0000000540)=ANY=[]}}, 0x0) 22:30:44 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000000000100000003d000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:44 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:44 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="056304400400000003630a50", @ANYRES64=0x0, @ANYBLOB='\vc\x00\x00'], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:44 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec000044006c00000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:44 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000a1000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:45 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x7000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 595.866792] binder: 9123:9124 unknown command 1342857987 [ 595.879644] EXT4-fs (loop0): invalid inodes per group: 8192 [ 595.879644] [ 595.899633] binder: 9123:9124 ioctl c0306201 20000140 returned -22 22:30:45 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x40, 0x0) ioctl$KDGKBTYPE(r1, 0x4b33, &(0x7f0000000180)) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x101400, 0x0) ioctl$sock_SIOCADDDLCI(r2, 0x8980, &(0x7f0000000040)={'vcan0\x00', 0x1}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) setsockopt$inet_mreqsrc(r2, 0x0, 0x25, &(0x7f0000000080)={@rand_addr=0x8}, 0xc) 22:30:45 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x100000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:45 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec000044000000000000003f07000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:45 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000007401000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:45 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000021000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 596.117254] binder: 9158:9161 BC_FREE_BUFFER u0000000000000000 no match [ 596.143493] binder_thread_write: 4 callbacks suppressed [ 596.143503] binder: 9158:9161 ERROR: BC_REGISTER_LOOPER called without request [ 596.168830] EXT4-fs (loop0): Invalid log block size: 1056964608 [ 596.234298] binder: 9158:9161 BC_FREE_BUFFER u0000000000000000 no match [ 596.257381] binder: 9158:9161 ERROR: BC_REGISTER_LOOPER called without request [ 596.275452] EXT4-fs (loop0): Invalid log block size: 1056964608 22:30:45 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = dup(r0) ioctl$TIOCPKT(r1, 0x5420, &(0x7f00000004c0)=0x400000000063) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) clone(0x3102001ff6, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$TUNSETLINK(r1, 0x400454cd, 0x0) sendmsg$FOU_CMD_DEL(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000180), 0xc, &(0x7f0000000300)={&(0x7f0000000540)=ANY=[]}}, 0x0) 22:30:45 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x700000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:45 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000007a01000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:45 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:45 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000006c1000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:45 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec0000440000002d0000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 596.759926] EXT4-fs (loop0): invalid inodes per group: 8192 [ 596.759926] [ 596.763509] binder: 9203:9211 ERROR: BC_REGISTER_LOOPER called without request 22:30:45 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x68000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:45 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = dup(r0) read(r0, &(0x7f00000000c0)=""/11, 0xb) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) clone(0x3102001ff6, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$TUNSETLINK(r1, 0x400454cd, 0x0) sendmsg$FOU_CMD_DEL(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000180), 0xc, &(0x7f0000000300)={&(0x7f0000000540)=ANY=[]}}, 0x0) 22:30:46 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x101000, 0x0) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000080}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0x34, r2, 0x10, 0x70bd25, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x80000001}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xe25}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x3ff}]}, 0x34}, 0x1, 0x0, 0x0, 0x4}, 0x4000080) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:46 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000006c01000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 596.872715] EXT4-fs (loop0): invalid inodes per group: 8192 [ 596.872715] 22:30:46 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec0000440000000a0000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 597.001906] binder: 9232:9241 ERROR: BC_REGISTER_LOOPER called without request 22:30:46 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x6000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:46 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000601000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 597.055026] binder: 9232:9251 ERROR: BC_REGISTER_LOOPER called without request 22:30:46 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000401000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:46 executing program 1: r0 = dup(0xffffffffffffffff) ioctl$DRM_IOCTL_SET_MASTER(r0, 0x641e) r1 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="056304400400000003630840", @ANYRES64=0x0, @ANYBLOB="0b6300029133ae79d6a6fd986b224b9649b56075aea8b8cbc268"], 0x0, 0xfffffdfd, &(0x7f0000000180)}) r2 = syz_open_dev$vcsn(&(0x7f0000000040)='/dev/vcs#\x00', 0xffff, 0x0) getsockopt$packet_buf(r2, 0x107, 0x1f, &(0x7f0000000080)=""/108, &(0x7f0000000180)=0x6c) [ 597.121402] EXT4-fs (loop0): invalid inodes per group: 8192 [ 597.121402] 22:30:46 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x3f00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 597.208447] EXT4-fs (loop0): invalid inodes per group: 8192 [ 597.208447] [ 597.243118] binder: 9276:9279 unknown command 33579787 [ 597.250636] binder: 9276:9279 ioctl c0306201 20000140 returned -22 22:30:46 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec000044007400000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 597.266536] binder: 9276:9279 unknown command 33579787 [ 597.286391] binder: 9276:9279 ioctl c0306201 20000140 returned -22 22:30:46 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:46 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = getuid() syz_mount_image$ext4(&(0x7f0000000000)='ext3\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x9, &(0x7f0000002640), 0x8020, &(0x7f0000002840)=ANY=[@ANYBLOB="7374726970d1f02eb51e653d3078303030303030303034326131353331652c626172726965723d3078303030303030303030303031303030312c7569643d", @ANYRESDEC=r1, @ANYRES32]) remap_file_pages(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x8, 0xd635, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 597.409847] EXT4-fs (loop0): invalid inodes per group: 8192 [ 597.409847] [ 597.541497] binder: 9307:9309 ERROR: BC_REGISTER_LOOPER called without request [ 597.553515] EXT4-fs (loop0): invalid inodes per group: 8192 [ 597.553515] [ 597.597872] binder: 9307:9318 ERROR: BC_REGISTER_LOOPER called without request 22:30:46 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) read(r0, &(0x7f00000000c0)=""/11, 0xb) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) clone(0x3102001ff6, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x0) sendmsg$FOU_CMD_DEL(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000180), 0xc, &(0x7f0000000300)={&(0x7f0000000540)=ANY=[]}}, 0x0) 22:30:46 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000121000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:46 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000301000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:46 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:46 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) write$P9_RREMOVE(0xffffffffffffffff, &(0x7f0000000040)={0x7, 0x7b, 0x2}, 0x7) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="056304400400000003630840", @ANYRES64=0x0, @ANYBLOB="0b631f00"], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:46 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec00004400000000fffffdf907000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 597.814576] binder_thread_write: 31 callbacks suppressed [ 597.814591] binder: 9324:9335 Acquire 1 refcount change on invalid ref 0 ret -22 [ 597.822683] binder: 9328:9337 Acquire 1 refcount change on invalid ref 4 ret -22 [ 597.837056] EXT4-fs (loop0): Unsupported filesystem blocksize 0 (-100794369 log_block_size) [ 597.847957] binder_transaction: 58 callbacks suppressed [ 597.847974] binder: 9324:9335 transaction failed 29201/-22, size 0-0 line 2834 [ 597.876112] binder: 9330:9341 transaction failed 29189/-22, size 0-0 line 2834 [ 597.880868] binder: 9328:9337 unknown command 2056971 [ 597.900653] binder: 9328:9337 ioctl c0306201 20000140 returned -22 [ 597.911941] binder: 9325:9347 transaction failed 29189/-22, size 0-0 line 2834 22:30:47 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x4c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 597.923428] binder: 9330:9346 transaction failed 29189/-22, size 0-0 line 2834 [ 597.935367] binder: 9328:9352 Acquire 1 refcount change on invalid ref 4 ret -22 [ 597.968159] EXT4-fs (loop0): Unsupported filesystem blocksize 0 (-100794369 log_block_size) 22:30:47 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000004801000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 598.012118] binder: 9328:9352 unknown command 2056971 [ 598.024770] binder: 9328:9352 ioctl c0306201 20000140 returned -22 [ 598.032327] binder: 9360:9362 Acquire 1 refcount change on invalid ref 0 ret -22 [ 598.049768] binder: 9360:9362 transaction failed 29201/-22, size 0-0 line 2834 [ 598.080612] binder: 9325:9342 transaction failed 29189/-22, size 0-0 line 2834 22:30:47 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x6800000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:47 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:47 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec000044000000000000010007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:47 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000031000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 598.120979] binder: 9365:9370 transaction failed 29189/-22, size 0-0 line 2834 [ 598.181215] binder: 9365:9376 transaction failed 29189/-22, size 0-0 line 2834 [ 598.198900] binder: 9373:9379 Acquire 1 refcount change on invalid ref 0 ret -22 [ 598.211594] binder: 9374:9375 Acquire 1 refcount change on invalid ref 4 ret -22 [ 598.240140] binder: 9373:9379 transaction failed 29201/-22, size 0-0 line 2834 [ 598.250565] EXT4-fs (loop0): Invalid log block size: 65536 [ 598.254986] binder: 9374:9375 ERROR: BC_REGISTER_LOOPER called without request [ 598.325192] EXT4-fs (loop0): Invalid log block size: 65536 [ 598.333073] binder: 9382:9386 transaction failed 29189/-22, size 0-0 line 2834 [ 598.397207] binder_release_work: 64 callbacks suppressed [ 598.397215] binder: undelivered TRANSACTION_ERROR: 29189 [ 598.421982] binder: undelivered TRANSACTION_ERROR: 29189 22:30:47 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x7a000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:47 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) r1 = dup(r0) read(r0, &(0x7f00000000c0)=""/11, 0xb) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) clone(0x3102001ff6, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$TUNSETLINK(r1, 0x400454cd, 0x0) sendmsg$FOU_CMD_DEL(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000180), 0xc, &(0x7f0000000300)={&(0x7f0000000540)=ANY=[]}}, 0x0) 22:30:47 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000000000100000039b000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:47 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0xc001, 0x0) ioctl$BLKTRACESTART(r1, 0x1274, 0x0) 22:30:47 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000041000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:47 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec000044000000000000002307000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 598.675026] binder: 9410:9411 Acquire 1 refcount change on invalid ref 4 ret -22 [ 598.689977] binder: 9406:9413 Acquire 1 refcount change on invalid ref 0 ret -22 [ 598.712510] binder_thread_write: 10 callbacks suppressed [ 598.712522] binder: 9410:9411 BC_FREE_BUFFER u0000000000000000 no match [ 598.733058] EXT4-fs (loop0): Invalid log block size: 587202560 [ 598.735913] binder_transaction: 14 callbacks suppressed [ 598.735921] binder: 9406:9413 got transaction to invalid handle [ 598.771050] binder: 9410:9411 ERROR: BC_REGISTER_LOOPER called without request [ 598.776831] binder: undelivered TRANSACTION_ERROR: 29201 [ 598.802521] binder: undelivered TRANSACTION_ERROR: 29189 22:30:48 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x1000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:48 executing program 1: socketpair$inet_udp(0x2, 0x2, 0x0, &(0x7f0000000000)) r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="5965000000001a664aacb5c7", @ANYRES64=0x0, @ANYBLOB='\vc\x00\x00'], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:48 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000044000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 598.841960] binder: undelivered TRANSACTION_ERROR: 29189 22:30:48 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec000044000000020000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 598.900337] binder: undelivered TRANSACTION_ERROR: 29189 [ 598.906038] binder: undelivered TRANSACTION_ERROR: 29189 [ 598.929885] binder: 9445:9449 Acquire 1 refcount change on invalid ref 0 ret -22 22:30:48 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000a00000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 598.965001] binder: 9447:9453 unknown command 25945 [ 598.977063] EXT4-fs (loop0): invalid inodes per group: 8192 [ 598.977063] [ 598.997379] binder: 9447:9453 ioctl c0306201 20000140 returned -22 [ 599.016227] binder: 9445:9449 got transaction to invalid handle [ 599.027925] binder: 9447:9462 unknown command 25945 [ 599.035137] binder: undelivered TRANSACTION_ERROR: 29201 [ 599.044739] binder: 9447:9462 ioctl c0306201 20000140 returned -22 [ 599.059022] EXT4-fs (loop0): invalid inodes per group: 8192 [ 599.059022] 22:30:48 executing program 1: syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2) r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$dspn(&(0x7f0000000040)='/dev/dsp#\x00', 0x1, 0x4000) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000002c0)={0x1d004, 0x1000}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000080)={0xffffffffffffffff}, 0x113, 0x1009}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(r1, &(0x7f0000000180)={0x8, 0x120, 0xfa00, {0x3, {0x8, 0x2, "b442dee7ceb166532234fec20bf30800e4bd1f1b29d05af16790b73d4ff758834d8a92ce6cc993c0e04d7834f6576db19fa064a004ed0029888ff3e6b26a3b3219aa4cfd698138c8d267e1c7afc300bdf9cfee5ae1f7d535733d8b0ae5c788143e8d6567b287007a93ab0d7bd56114d68e9802427461e8ea8985e279a3e7b924a3a89481f84555a8a1cf40f53fa39477364bbd4b2cf5431c61eaf565b1469777cff921d3d817423da614bb00e070351c230bc7388cab7ec6f1879eb0d899158e9af9c4bf34fd0b8f014562166ca66760d6bb579dfb65dcb8ff1d38dc4628243bbe7e55a9d1cdb918bfeea8772160b7969c0a7d4aafebb23dd99b64ffbaea463c", 0xca, 0x3, 0xffffffff, 0x5, 0x6, 0xfffffffffffffffd, 0x934f}, r3}}, 0x128) ioctl$TCGETA(r2, 0x5405, &(0x7f0000000340)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:48 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x6800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 599.081884] binder: undelivered TRANSACTION_ERROR: 29189 [ 599.103003] binder: undelivered TRANSACTION_ERROR: 29189 [ 599.205067] binder: 9479:9483 Acquire 1 refcount change on invalid ref 0 ret -22 [ 599.229604] binder: 9479:9483 got transaction to invalid handle [ 599.247147] binder: 9481:9482 BC_FREE_BUFFER u0000000000000000 no match [ 599.254818] binder: 9481:9482 ERROR: BC_REGISTER_LOOPER called without request [ 599.280316] binder: 9481:9489 BC_FREE_BUFFER u0000000000000000 no match 22:30:48 executing program 5: r0 = dup(0xffffffffffffffff) read(0xffffffffffffffff, &(0x7f00000000c0)=""/11, 0xb) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000100)) clone(0x3102001ff6, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$TUNSETLINK(r0, 0x400454cd, 0x0) sendmsg$FOU_CMD_DEL(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000180), 0xc, &(0x7f0000000300)={&(0x7f0000000540)=ANY=[]}}, 0x0) 22:30:48 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000a01000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:48 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:48 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000c00000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:48 executing program 1: r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x40, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000340)='/dev/binder#\x00', 0x0, 0x10000001002) ioctl$TIOCMSET(r0, 0x5418, &(0x7f00000000c0)=0x20000000000c) r2 = syz_open_dev$audion(&(0x7f0000000080)='/dev/audio#\x00', 0x7, 0x10000) epoll_pwait(r0, &(0x7f0000000180)=[{}, {}, {}, {}, {}, {}], 0x6, 0x3f, &(0x7f0000000100)={0xfffffffffffff385}, 0x8) set_robust_list(&(0x7f0000000400)={&(0x7f00000002c0)={&(0x7f0000000280)}, 0xa1c, &(0x7f00000003c0)={&(0x7f0000000380)}}, 0x18) ioctl$DRM_IOCTL_AGP_ALLOC(r2, 0xc0206434, &(0x7f0000000200)={0x1000, 0x0, 0x10003, 0x2}) ioctl$DRM_IOCTL_SG_ALLOC(r0, 0xc0106438, &(0x7f0000000240)={0x4, r3}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="8840", @ANYRES64=0x0, @ANYBLOB='\vc\x00\x00'], 0x0, 0xfffffdfd, &(0x7f0000000180)}) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000040)={0x3c3}) 22:30:48 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec000044004000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:48 executing program 5: r0 = dup(0xffffffffffffffff) read(0xffffffffffffffff, &(0x7f00000000c0)=""/11, 0xb) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000100)) clone(0x3102001ff6, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$TUNSETLINK(r0, 0x400454cd, 0x0) sendmsg$FOU_CMD_DEL(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000180), 0xc, &(0x7f0000000300)={&(0x7f0000000540)=ANY=[]}}, 0x0) [ 599.556703] binder: 9497:9499 unknown command 16520 [ 599.562049] binder: 9501:9502 got transaction to invalid handle [ 599.576589] EXT4-fs (loop0): invalid inodes per group: 8192 [ 599.576589] [ 599.595204] binder: 9497:9499 ioctl c0306201 20000140 returned -22 22:30:48 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0xa00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 599.634127] binder: 9497:9516 unknown command 16520 [ 599.651402] binder: 9497:9516 ioctl c0306201 20000140 returned -22 22:30:48 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="056304400400000003630840", @ANYRES64=0x0, @ANYBLOB="390232687a9153ba388e8fb01caec1ef0a9c1a7ef6373c6318393d23f1844ae2b9984d103e599672208ab37a0d0807c096e6cf65334e636aa5b2d3d297510792148fe5c146f4b846f11a2e1b3eade9c882d1a777eaced72a6c9258309cfdc09e59cad4050815154917b080bbcc35054e87643283459f1e5da58060d8e05ac7dcffa25b7d0f29ff91fbdc2deb8146044c5e099e656b9f04b14dc968bc00bde1d744282a00000000000000000000"], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 599.690047] EXT4-fs (loop0): invalid inodes per group: 8192 [ 599.690047] 22:30:48 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000601000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:48 executing program 5: r0 = dup(0xffffffffffffffff) read(0xffffffffffffffff, &(0x7f00000000c0)=""/11, 0xb) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000100)) clone(0x3102001ff6, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$TUNSETLINK(r0, 0x400454cd, 0x0) sendmsg$FOU_CMD_DEL(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000180), 0xc, &(0x7f0000000300)={&(0x7f0000000540)=ANY=[]}}, 0x0) 22:30:48 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec000044ffffffffffffffff07000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 599.743036] binder: 9531:9532 got transaction to invalid handle 22:30:48 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x6c000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:49 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000a1000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 599.830664] binder: 9540:9541 BC_FREE_BUFFER u0000000000000000 no match [ 599.837477] binder: 9540:9541 unknown command 1748107833 22:30:49 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) r1 = dup(0xffffffffffffffff) read(r0, &(0x7f00000000c0)=""/11, 0xb) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) clone(0x3102001ff6, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$TUNSETLINK(r1, 0x400454cd, 0x0) sendmsg$FOU_CMD_DEL(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000180), 0xc, &(0x7f0000000300)={&(0x7f0000000540)=ANY=[]}}, 0x0) [ 599.870958] EXT4-fs (loop0): Unsupported filesystem blocksize 0 (-1 log_block_size) [ 599.903007] binder: 9549:9554 got transaction to invalid handle 22:30:49 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000501000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:49 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 599.970615] binder: 9540:9541 ioctl c0306201 20000140 returned -22 [ 599.991053] EXT4-fs (loop0): Unsupported filesystem blocksize 0 (-1 log_block_size) 22:30:49 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) r1 = semget$private(0x0, 0x1, 0x1) semctl$SETALL(r1, 0x0, 0x11, &(0x7f0000000000)=[0x5]) 22:30:49 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec000044100400000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 600.069245] binder: 9575:9576 got transaction to invalid handle 22:30:49 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 600.144479] binder: 9587:9588 BC_FREE_BUFFER u0000000000000000 no match 22:30:49 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000007a1000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:49 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000701000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 600.210784] binder: 9587:9588 BC_FREE_BUFFER u0000000000000000 no match [ 600.221508] EXT4-fs (loop0): invalid inodes per group: 8192 [ 600.221508] [ 600.240314] binder: 9598:9601 got transaction to invalid handle 22:30:49 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) rt_sigreturn() ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05e56c35dd0ade6a23ef25ca689a287b7a47607e163711630c40", @ANYRES64=0x0, @ANYBLOB='\vc\x00\x00'], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:49 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x500000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 600.315941] EXT4-fs (loop0): invalid inodes per group: 8192 [ 600.315941] 22:30:49 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec00004400000000fffffdfc07000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:49 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x4c000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 600.411070] binder: 9619:9622 got transaction to invalid handle [ 600.538541] binder: 9634:9635 got transaction to invalid handle [ 600.568491] EXT4-fs (loop0): Unsupported filesystem blocksize 0 (-50462721 log_block_size) [ 600.627359] EXT4-fs (loop0): Unsupported filesystem blocksize 0 (-50462721 log_block_size) 22:30:49 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) r1 = dup(r0) read(0xffffffffffffffff, &(0x7f00000000c0)=""/11, 0xb) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) clone(0x3102001ff6, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$TUNSETLINK(r1, 0x400454cd, 0x0) sendmsg$FOU_CMD_DEL(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000180), 0xc, &(0x7f0000000300)={&(0x7f0000000540)=ANY=[]}}, 0x0) 22:30:49 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x2000000, 0x13, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x60, 0x0, &(0x7f0000000180)=[@acquire={0x40046305, 0x4}, @free_buffer, @reply_sg={0x40486312, {{0x4, 0x0, 0x1, 0x0, 0x10, 0x0, 0x0, 0x40, 0x10, &(0x7f0000000080)=[@flat={0x776a2a85, 0x101, r1, 0x4}, @ptr={0x70742a85, 0x0, &(0x7f0000000040), 0x1, 0x0, 0x2d}], &(0x7f00000000c0)=[0x20, 0x78]}, 0x8}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:49 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000006001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:49 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000005400000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:49 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:49 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec000044000000000000008007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:50 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) r1 = dup(r0) read(r0, &(0x7f00000000c0)=""/11, 0xb) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000100)) clone(0x3102001ff6, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$TUNSETLINK(r1, 0x400454cd, 0x0) sendmsg$FOU_CMD_DEL(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000180), 0xc, &(0x7f0000000300)={&(0x7f0000000540)=ANY=[]}}, 0x0) [ 600.822013] binder: 9658:9663 BC_FREE_BUFFER u0000000000000000 no match [ 600.837017] EXT4-fs (loop0): Invalid log block size: 2147483648 [ 600.858220] binder: 9658:9663 got reply transaction with no transaction stack 22:30:50 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x68, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 600.887443] binder: 9658:9673 BC_FREE_BUFFER u0000000000000000 no match [ 600.923116] EXT4-fs (loop0): Invalid log block size: 2147483648 [ 600.939962] binder: 9658:9673 got reply transaction with no transaction stack 22:30:50 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000000000100000003f000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:50 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec000044fffffffb0000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:50 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) r1 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhci\x00', 0x900, 0x0) ioctl$EVIOCGABS20(r1, 0x80184560, &(0x7f0000000040)=""/99) mprotect(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000008) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x74, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x4, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x40, 0x8, &(0x7f0000000180)=[@fd={0x66642a85, 0x0, r1, 0x0, 0x2}, @ptr={0x70742a85, 0x0, &(0x7f00000000c0), 0x1, 0x3, 0x1d}], &(0x7f00000001c0)=[0x38]}, 0x3}}, @increfs={0x40046304, 0x2}, @acquire={0x40046305, 0x2}, @decrefs, @register_looper, @exit_looper, @increfs={0x40046304, 0x4}], 0xd, 0x0, &(0x7f0000000280)="4132dcc18b4c3bc2429c4fccae"}) 22:30:50 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000600000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:50 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x5000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 601.114121] EXT4-fs (loop0): invalid inodes per group: 8192 [ 601.114121] [ 601.151839] binder: 9701:9711 BC_FREE_BUFFER u0000000000000000 no match 22:30:50 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:50 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000009000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 601.194232] EXT4-fs (loop0): invalid inodes per group: 8192 [ 601.194232] [ 601.217978] binder_thread_write: 3 callbacks suppressed [ 601.217987] binder: 9701:9711 ERROR: BC_REGISTER_LOOPER called without request 22:30:50 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x3000000, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 601.254707] binder: 9701:9711 BC_FREE_BUFFER u0000000000000000 no match [ 601.264723] binder: 9701:9711 ERROR: BC_REGISTER_LOOPER called without request 22:30:50 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05635d53852804400400000003630840", @ANYRES64=0x0, @ANYBLOB='\vc\x00\x00'], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:50 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec000044000000050000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 601.445560] binder: 9742:9744 unknown command 1398629125 [ 601.471866] EXT4-fs (loop0): invalid inodes per group: 8192 [ 601.471866] [ 601.475920] binder: 9742:9744 ioctl c0306201 20000140 returned -22 [ 601.531559] EXT4-fs (loop0): invalid inodes per group: 8192 [ 601.531559] 22:30:50 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) r1 = dup(r0) read(r0, &(0x7f00000000c0)=""/11, 0xb) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$TUNSETLINK(r1, 0x400454cd, 0x0) sendmsg$FOU_CMD_DEL(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000180), 0xc, &(0x7f0000000300)={&(0x7f0000000540)=ANY=[]}}, 0x0) 22:30:50 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000022300000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:50 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x3f00, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:50 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000010000003a7000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:50 executing program 1: r0 = syz_open_dev$mouse(&(0x7f0000000180)='/dev/input/mouse#\x00', 0x81, 0x100) ioctl$sock_inet_SIOCSIFBRDADDR(r0, 0x891a, &(0x7f00000001c0)={'irlan0\x00', {0x2, 0x4e23}}) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$midi(&(0x7f0000000080)='/dev/midi#\x00', 0x547, 0x800) ioctl$DRM_IOCTL_GET_CAP(r2, 0xc010640c, &(0x7f00000000c0)={0x7fff, 0x81}) ioctl$KVM_GET_REG_LIST(r0, 0xc008aeb0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) write$FUSE_DIRENT(r2, &(0x7f0000000240)={0x58, 0xfffffffffffffff5, 0x8, [{0x0, 0x20, 0x2e, 0x8, '!nodev!security/*md5summime_typebdevusermd5sum'}]}, 0x58) r3 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x1c006, 0x0) syz_open_dev$adsp(&(0x7f0000000200)='/dev/adsp#\x00', 0x440, 0x800) ioctl$KVM_S390_UCAS_MAP(r3, 0x4018ae50, &(0x7f0000000040)={0x1, 0x1, 0x630}) 22:30:50 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec000044003f00000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 601.862327] binder: 9765:9767 ERROR: BC_REGISTER_LOOPER called without request [ 601.886429] EXT4-fs (loop0): invalid inodes per group: 8192 [ 601.886429] 22:30:51 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 601.917684] binder: 9765:9780 ERROR: BC_REGISTER_LOOPER called without request 22:30:51 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) 22:30:51 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec0000440fff00000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:51 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000004c01000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:51 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:51 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000300000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 602.099675] EXT4-fs (loop0): invalid inodes per group: 8192 [ 602.099675] [ 602.153838] EXT4-fs (loop0): invalid inodes per group: 8192 [ 602.153838] [ 602.156761] binder: 9807:9813 ERROR: BC_REGISTER_LOOPER called without request [ 602.196279] binder: 9807:9813 ERROR: BC_REGISTER_LOOPER called without request 22:30:51 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x4c, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:51 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000201000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:51 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec00004400fc00000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:51 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) dup(r0) read(r0, &(0x7f00000000c0)=""/11, 0xb) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) clone(0x3102001ff6, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x0) sendmsg$FOU_CMD_DEL(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000180), 0xc, &(0x7f0000000300)={&(0x7f0000000540)=ANY=[]}}, 0x0) 22:30:51 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000051000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:51 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x2, 0x0) ioctl$EVIOCGABS3F(r1, 0x8018457f, &(0x7f0000000040)=""/176) 22:30:52 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 602.770483] binder: 9846:9851 ERROR: BC_REGISTER_LOOPER called without request [ 602.790013] EXT4-fs (loop0): invalid inodes per group: 8192 [ 602.790013] [ 602.798946] binder: 9846:9851 ERROR: BC_REGISTER_LOOPER called without request 22:30:52 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x14, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0d630000cf630840", @ANYRES64=0x0, @ANYBLOB='\vc\x00\x00'], 0x0, 0xfffffdfd, &(0x7f0000000180)}) rmdir(&(0x7f0000000040)='./file0\x00') [ 602.872376] EXT4-fs (loop0): invalid inodes per group: 8192 [ 602.872376] [ 602.910818] binder_thread_write: 33 callbacks suppressed 22:30:52 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000010000003b2000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 602.910833] binder: 9873:9876 Acquire 1 refcount change on invalid ref 0 ret -22 [ 602.925820] binder_transaction: 63 callbacks suppressed [ 602.926675] binder: 9873:9876 transaction failed 29201/-22, size 0-0 line 2834 [ 602.945958] binder: 9844:9880 transaction failed 29189/-22, size 0-0 line 2834 22:30:52 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec0000446c0000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 602.979701] binder: 9882:9886 unknown command 1074291663 22:30:52 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x7a000000, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:52 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000061000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 603.034589] binder: 9882:9886 ioctl c0306201 20000140 returned -22 [ 603.053303] binder: 9884:9891 transaction failed 29189/-22, size 0-0 line 2834 [ 603.074464] binder: 9893:9894 Acquire 1 refcount change on invalid ref 0 ret -22 22:30:52 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={0x0}) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x100, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'ip6gretap0\x00', 0x4000}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="05730440040000000b630013fb65e408af2f503e9d5bf69ae9e2760003630840", @ANYRES64=r1], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 603.090384] binder: 9893:9894 transaction failed 29201/-22, size 0-0 line 2834 [ 603.137453] EXT4-fs (loop0): invalid inodes per group: 8192 [ 603.137453] [ 603.154789] binder: 9884:9908 transaction failed 29189/-22, size 0-0 line 2834 [ 603.180179] binder: 9896:9910 transaction failed 29189/-22, size 0-0 line 2834 22:30:52 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x6c000000, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 603.220682] binder: 9913:9915 unknown command 1074033413 [ 603.245769] binder: 9913:9915 ioctl c0306201 20000140 returned -22 [ 603.263531] binder: 9917:9919 Acquire 1 refcount change on invalid ref 0 ret -22 22:30:52 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000400000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 603.289695] binder: 9917:9919 transaction failed 29201/-22, size 0-0 line 2834 [ 603.299825] binder: 9913:9924 unknown command 1074033413 [ 603.307427] EXT4-fs (loop0): invalid inodes per group: 8192 [ 603.307427] [ 603.334620] binder: 9913:9924 ioctl c0306201 20000140 returned -22 [ 603.352597] binder: 9896:9904 transaction failed 29189/-22, size 0-0 line 2834 [ 603.376405] binder: 9927:9932 transaction failed 29189/-22, size 0-0 line 2834 [ 603.413370] binder: 9927:9934 transaction failed 29189/-22, size 0-0 line 2834 [ 603.447995] binder_release_work: 62 callbacks suppressed [ 603.448002] binder: undelivered TRANSACTION_ERROR: 29189 [ 603.459252] binder: undelivered TRANSACTION_ERROR: 29189 22:30:52 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000053000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:52 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:52 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec00004400000000fffffdfd07000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:52 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x10) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl(r1, 0x20000000008912, &(0x7f0000000100)="0a5c2d0240316285717070") bind$netlink(r0, &(0x7f0000000040)={0x4400000010, 0x0, 0x0, 0x20060000}, 0xc) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f0000000040)="025cc80700145f8f764070") r3 = socket$inet6(0xa, 0x2000000802, 0x0) socketpair$packet(0x11, 0x1, 0x300, &(0x7f0000000580)={0xffffffffffffffff}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000340)={0x0, @dev, @multicast2}, &(0x7f0000000380)=0xc) sendmsg$can_raw(r3, &(0x7f0000000480)={&(0x7f00000003c0)={0x1d, r5}, 0x10, &(0x7f0000000440)={&(0x7f0000000400)=@can={{0x4, 0xf9, 0x1, 0x4}, 0x6, 0x1, 0x0, 0x0, "65f7807aef6c0f4c"}, 0x10}, 0x1, 0x0, 0x0, 0x40}, 0x10) r6 = accept(r3, 0x0, &(0x7f0000000080)) setsockopt$inet6_int(r3, 0x29, 0x21, &(0x7f000089b000)=0x1, 0x4) unshare(0x40000000) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r6, 0x84, 0x1d, &(0x7f0000000300)=ANY=[@ANYBLOB="05000000ffff85f3d3d1b18ece1acbd2ca", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0], &(0x7f0000000500)=0x6) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r3, 0x84, 0x72, &(0x7f0000000540)={r7, 0x4, 0x20}, 0xc) r8 = socket$inet6(0xa, 0x3, 0x3a) setsockopt$inet_tcp_int(r4, 0x6, 0x24, &(0x7f0000000240)=0xffffffffffff63e9, 0x4) setsockopt$inet6_MRT6_ADD_MIF(r8, 0x29, 0xcb, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x3}, 0xc) 22:30:52 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000d00000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:52 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x100, 0x800) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000180)={{{@in=@broadcast, @in=@rand_addr, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in=@dev}}, &(0x7f0000000040)=0xe8) ioctl$TUNSETOWNER(r1, 0x400454cc, r2) [ 603.662282] binder: 9951:9953 Acquire 1 refcount change on invalid ref 4 ret -22 [ 603.670558] binder: 9942:9945 Acquire 1 refcount change on invalid ref 0 ret -22 [ 603.681183] EXT4-fs (loop0): Unsupported filesystem blocksize 0 (-33685505 log_block_size) [ 603.699688] binder: 9951:9953 ERROR: BC_REGISTER_LOOPER called without request [ 603.714847] binder: undelivered TRANSACTION_ERROR: 29201 [ 603.729337] binder: undelivered TRANSACTION_ERROR: 29189 [ 603.740040] binder: undelivered TRANSACTION_ERROR: 29189 [ 603.746364] binder: 9951:9953 Acquire 1 refcount change on invalid ref 4 ret -22 22:30:52 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000010000003d1000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:52 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x68000000, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 603.774164] IPVS: ftp: loaded support on port[0] = 21 [ 603.810209] EXT4-fs (loop0): Unsupported filesystem blocksize 0 (-33685505 log_block_size) [ 603.812065] binder_thread_write: 7 callbacks suppressed [ 603.812075] binder: 9951:9953 BC_FREE_BUFFER u0000000000000000 no match 22:30:53 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec000044000000000000040007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 603.868009] binder: 9951:9953 ERROR: BC_REGISTER_LOOPER called without request [ 603.877074] binder: 9974:9983 Acquire 1 refcount change on invalid ref 0 ret -22 [ 603.899674] binder: undelivered TRANSACTION_ERROR: 29189 22:30:53 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000e00000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 603.950271] binder: undelivered TRANSACTION_ERROR: 29189 [ 603.955828] binder: undelivered TRANSACTION_ERROR: 29189 [ 603.964278] binder_transaction: 15 callbacks suppressed [ 603.964287] binder: 9974:9983 got transaction to invalid handle 22:30:53 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000300), 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:53 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000006801000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 604.027121] binder: undelivered TRANSACTION_ERROR: 29201 [ 604.062000] EXT4-fs (loop0): Invalid log block size: 262144 22:30:53 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x74, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 604.136537] EXT4-fs (loop0): Invalid log block size: 262144 22:30:53 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="056304400400000003630840", @ANYRES64=0x0, @ANYBLOB="01220000"], 0x0, 0xfffffdfd, &(0x7f0000000180)}) r1 = syz_open_dev$mouse(&(0x7f00000001c0)='/dev/input/mouse#\x00', 0x1ff, 0x1200000) getsockopt$inet6_udp_int(r1, 0x11, 0xb, &(0x7f0000000000), &(0x7f0000000200)=0x4) mq_timedsend(r1, &(0x7f0000000040)="c5897b76d228ae9e504663a166217521ad065b7f723e8d7e43fe12e10e076a9c67cd58a06426f37e2ebb3e1f155b0ea0d0f774dc35e4ffae97d20802c8c84ad0c9967038efa1e54301a2db1cab69ddf15ad32567875f0d1defa3c06fb29ad01eeb86d2c10cb745f56aff56a2291c0ff36139ec9e90f104b7955626d898e4c70cb16e11f43b27f87a784d4838a6a6dec425cef2d233676a2d744fd0d3bdcc263cef77713de29369bfc29665905cfbc2b58bd176e741", 0xb5, 0xda, &(0x7f0000000180)={0x77359400}) ioctl$VIDIOC_S_PRIORITY(r1, 0x40045644, 0x0) 22:30:53 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec0000447fffffffffffffff07000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 604.186444] binder: 10011:10015 Acquire 1 refcount change on invalid ref 0 ret -22 [ 604.201696] binder: 10011:10015 got transaction to invalid handle [ 604.218820] IPVS: ftp: loaded support on port[0] = 21 [ 604.224040] binder: undelivered TRANSACTION_ERROR: 29201 [ 604.327098] binder: 10029:10031 Acquire 1 refcount change on invalid ref 4 ret -22 [ 604.344057] EXT4-fs (loop0): Unsupported filesystem blocksize 0 (-1 log_block_size) [ 604.374703] binder: 10029:10031 BC_FREE_BUFFER u0000000000000000 no match [ 604.392687] binder: 10029:10031 unknown command 8705 [ 604.398900] binder: 10029:10031 ioctl c0306201 20000140 returned -22 [ 604.417136] binder: 10029:10031 Acquire 1 refcount change on invalid ref 4 ret -22 [ 604.434442] binder: 10029:10031 BC_FREE_BUFFER u0000000000000000 no match [ 604.443741] EXT4-fs (loop0): Unsupported filesystem blocksize 0 (-1 log_block_size) [ 604.448555] binder: 10029:10031 unknown command 8705 [ 604.459090] binder: 10029:10031 ioctl c0306201 20000140 returned -22 22:30:55 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000007a01000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:55 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:55 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000002000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:55 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05f9ff4004000000166308402aa22ca9c01ad49e726ded539787e2e39ab0b97230dd323f0022f217c7de049c167ec50d0b8ff675bd09eee5f7968882b616e29400a363432c317f886b8bea5b4308fe21bf92a3d1b9f566be244dca88acf2f30a6bd2553cc2f54fcaca7a3adeb4d6b03baa81a68260ab1bb025cf1e0a968b09c062550c5e91fd55faff0cd3b36027120eb03c51be0761ac7823dff359010a30bb86e2f9fe5a28773aad1c10975ea969930a2fc1f7572a69d61c519847cc6bbe36e70ca8a522543330cf81af3f7d6dc0b0cf1285b1b22d90a18cc953a176912e6b75c8c2a599f2a6", @ANYRES64=0x0, @ANYBLOB='\vc\x00\x00'], 0x0, 0xfffffdfd, &(0x7f0000000180)}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180)='/dev/hwrng\x00', 0x80, 0x0) getsockname(r1, &(0x7f00000001c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast1}}}, &(0x7f0000000480)=0x18d815911b09fc8f) 22:30:55 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000900000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:55 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec000044000000680000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 606.761990] binder: 10046:10053 got transaction to invalid handle [ 606.776817] binder: 10054:10055 unknown command 1090517253 [ 606.777355] EXT4-fs (loop0): invalid inodes per group: 8192 [ 606.777355] [ 606.810880] binder: 10054:10055 ioctl c0306201 20000140 returned -22 22:30:56 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x700000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 606.868039] binder: 10054:10055 unknown command 1090517253 [ 606.905367] binder: 10054:10055 ioctl c0306201 20000140 returned -22 22:30:56 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000099bcf574000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:56 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @dev}, 0x10) r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000780)) shmget(0x1, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) shmat(0x0, &(0x7f0000ffb000/0x2000)=nil, 0x0) perf_event_open(&(0x7f0000000280)={0x2, 0x70, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x2, 0x4, 0xfffffffffffffffd, 0x9, 0x4, 0x0, 0x5, 0x0, 0xfffffffffffffff8, 0xed, 0x0, 0x2, 0x0, 0x3f, 0x0, 0xffffffff, 0xfffffffffffffffc, 0x0, 0x0, 0xffffffffffffffc0, 0x0, @perf_config_ext={0x20, 0xe9}, 0x0, 0x7fff, 0x0, 0x7, 0x1, 0x0, 0x9d2}, 0x0, 0x6, 0xffffffffffffffff, 0x0) r2 = memfd_create(&(0x7f00000000c0)="000000008c00000000000000000000", 0x0) pwritev(r2, &(0x7f0000f50f90), 0x0, 0x81003) [ 606.932100] EXT4-fs (loop0): invalid inodes per group: 8192 [ 606.932100] [ 606.964329] binder: 10080:10081 got transaction to invalid handle 22:30:56 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:56 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec000044102000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:56 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x400000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:56 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000071000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 607.122419] binder: 10095:10096 BC_FREE_BUFFER u0000000000000000 no match 22:30:56 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(0xffffffffffffffff, 0x4004af61, &(0x7f0000000200)) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @dev}, 0x10) ioctl$SIOCSIFMTU(0xffffffffffffffff, 0x8922, &(0x7f0000000440)={'veth0_to_bond\x00'}) syz_open_dev$sndtimer(&(0x7f00000007c0)='/dev/snd/timer\x00', 0x0, 0x0) r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000780)) shmget(0x1, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) shmat(0x0, &(0x7f0000ffb000/0x2000)=nil, 0x0) perf_event_open(&(0x7f0000000280)={0x2, 0x70, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x2, 0x4, 0xfffffffffffffffd, 0x9, 0x4, 0x0, 0x5, 0x0, 0xfffffffffffffff8, 0xed, 0x0, 0x2, 0x0, 0x3f, 0x0, 0xffffffff, 0xfffffffffffffffc, 0x0, 0x0, 0xffffffffffffffc0, 0x0, @perf_config_ext={0x20, 0xe9}, 0x0, 0x7fff, 0x0, 0x7, 0x1, 0x0, 0x9d2}, 0x0, 0x6, 0xffffffffffffffff, 0x0) r2 = memfd_create(&(0x7f00000000c0)="000000008c00000000000000000000", 0x0) pwritev(r2, &(0x7f0000f50f90), 0x0, 0x81003) [ 607.201725] EXT4-fs (loop0): invalid inodes per group: 8192 [ 607.201725] [ 607.234712] binder: 10107:10109 got transaction to invalid handle [ 607.242204] binder: 10095:10096 ERROR: BC_REGISTER_LOOPER called without request 22:30:56 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000009000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 607.293442] EXT4-fs (loop0): invalid inodes per group: 8192 [ 607.293442] [ 607.294116] binder: 10095:10096 BC_FREE_BUFFER u0000000000000000 no match 22:30:56 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x1000000, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 607.348506] binder: 10095:10096 ERROR: BC_REGISTER_LOOPER called without request 22:30:56 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="056304480400ecff03630840", @ANYRES64=0x0, @ANYBLOB='\vc\x00\x00'], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:56 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(0xffffffffffffffff, 0x4004af61, &(0x7f0000000200)) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @dev}, 0x10) ioctl$SIOCSIFMTU(0xffffffffffffffff, 0x8922, &(0x7f0000000440)={'veth0_to_bond\x00'}) syz_open_dev$sndtimer(&(0x7f00000007c0)='/dev/snd/timer\x00', 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xd, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) ioctl$LOOP_SET_FD(r1, 0x4c00, 0xffffffffffffffff) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000780)) shmget(0x1, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) shmat(0x0, &(0x7f0000ffb000/0x2000)=nil, 0x0) perf_event_open(&(0x7f0000000280)={0x2, 0x70, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x2, 0x4, 0xfffffffffffffffd, 0x9, 0x4, 0x0, 0x5, 0x0, 0xfffffffffffffff8, 0xed, 0x0, 0x2, 0x0, 0x3f, 0x0, 0xffffffff, 0xfffffffffffffffc, 0x0, 0x0, 0xffffffffffffffc0, 0x0, @perf_config_ext={0x20, 0xe9}, 0x0, 0x7fff, 0x0, 0x7, 0x1, 0x0, 0x9d2}, 0x0, 0x6, r0, 0x0) r2 = memfd_create(&(0x7f00000000c0)="000000008c00000000000000000000", 0x0) pwritev(r2, &(0x7f0000f50f90), 0x0, 0x81003) 22:30:56 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec0000440dac00000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 607.467054] binder: 10136:10137 got transaction to invalid handle 22:30:56 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000681000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 607.549118] binder: 10141:10149 unknown command 1208247045 [ 607.569897] EXT4-fs (loop0): invalid inodes per group: 8192 [ 607.569897] 22:30:56 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x68, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:56 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(0xffffffffffffffff, 0x4004af61, &(0x7f0000000200)) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @dev}, 0x10) ioctl$SIOCSIFMTU(0xffffffffffffffff, 0x8922, &(0x7f0000000440)={'veth0_to_bond\x00'}) syz_open_dev$sndtimer(&(0x7f00000007c0)='/dev/snd/timer\x00', 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xd, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r2 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) bind$rds(0xffffffffffffffff, &(0x7f0000000740)={0x2, 0x0, @remote}, 0x10) shmget(0x1, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) shmat(0x0, &(0x7f0000ffb000/0x2000)=nil, 0x0) perf_event_open(&(0x7f0000000280)={0x2, 0x70, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x2, 0x4, 0xfffffffffffffffd, 0x9, 0x4, 0x0, 0x5, 0x0, 0xfffffffffffffff8, 0xed, 0x0, 0x2, 0x0, 0x3f, 0x0, 0xffffffff, 0xfffffffffffffffc, 0x0, 0x0, 0xffffffffffffffc0, 0x0, @perf_config_ext={0x20, 0xe9}, 0x0, 0x7fff, 0x0, 0x7, 0x1, 0x0, 0x9d2}, 0x0, 0x6, r0, 0x0) r3 = memfd_create(&(0x7f00000000c0)="000000008c00000000000000000000", 0x0) pwritev(r3, &(0x7f0000f50f90), 0x0, 0x81003) [ 607.625036] binder: 10141:10149 ioctl c0306201 20000140 returned -22 22:30:56 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000010000000a7030000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 607.683092] binder: 10141:10149 unknown command 1208247045 [ 607.696463] EXT4-fs (loop0): invalid inodes per group: 8192 [ 607.696463] [ 607.715658] binder: 10141:10149 ioctl c0306201 20000140 returned -22 [ 607.736966] binder: 10161:10169 got transaction to invalid handle 22:30:56 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec000044feffffff0000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:56 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) r1 = openat(0xffffffffffffffff, &(0x7f0000003d80)='./file0\x00', 0x440380, 0x10) sendmsg$unix(r1, &(0x7f0000005180)={&(0x7f0000004ec0)=@abs={0x1, 0x0, 0x4e23}, 0x6e, &(0x7f0000005140)=[{&(0x7f0000004f40)="d4ede50651d944d95652efcadb9078d705fa84fc87254854512e7d11e19416829607fdbc15300eefa9aacd51d3e35931356b1b2b07b8047f2e527ba08f1b3e5908994bf96004aa315df7eb92498888cc9d04f56486a611ba12c5ad98f9c17ccfa753e25601df7b23f2a1e462a963f95a66049e9680b87e706e5f16808e2196c5f3400feeca9fa20ae8059fe23a796e15623d77f277beec95ca7caf51eb1631caa557fa2eaeac625dea3ffbee3d6032600bfa7375f8cb09a4a315b9a8", 0xbc}, {&(0x7f0000005000)="3079465597a7bd76cde1daef13e3f524656711f84c22affefbc6343ecae581f1e20003a08881b4c35c63eb1b3ac401a9168bec923a158f6c8e940070dcf628d311d09d9c3ff94ba275fe2d1192aa14226036460cc50c12b3ee815f40c4ccd5d8ce2d5935ec967d314b756c5c5d99fbc2fbd48c07c1575ff3d13b5a78f5b9d9a250b577d58157a4e85d4dff6f393fdd2f7b6ffc65738b0cca5b945e7fda948f5e18dbd1c97513e85160276e49dff06552fa790602e30b6499ed2e6bca04870ce1cc864eb05e0c1b8fb4339dcf3ed5aaadf0b896139c2876f92f090872c7dba6fb94aebf", 0xe3}, {&(0x7f0000005100)="d4cc6ee642cc65924d78b91ef8f92de7173bbcb2fae94390a5b5", 0x1a}], 0x3, 0x0, 0x0, 0x4000800}, 0x10) ioctl$INOTIFY_IOC_SETNEXTWD(r1, 0x40044900, 0xffff) recvmmsg(0xffffffffffffffff, &(0x7f0000004b40)=[{{0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)=""/122, 0x7a}, {&(0x7f0000000180)=""/146, 0x92}], 0x2, &(0x7f0000000240)=""/73, 0x49, 0x9}, 0xfffffffffffffe00}, {{&(0x7f0000000340)=@nl=@proc, 0x80, &(0x7f0000000740)=[{&(0x7f00000003c0)=""/217, 0xd9}, {&(0x7f00000000c0)=""/49, 0x31}, {&(0x7f00000004c0)=""/145, 0x91}, {&(0x7f0000000580)=""/205, 0xcd}, {&(0x7f0000000680)=""/155, 0x9b}], 0x5, &(0x7f00000007c0)=""/219, 0xdb, 0x5}, 0x9}, {{0x0, 0x0, &(0x7f0000001c40)=[{&(0x7f00000008c0)=""/223, 0xdf}, {&(0x7f00000009c0)=""/143, 0x8f}, {&(0x7f0000000a80)=""/129, 0x81}, {&(0x7f0000000b40)=""/69, 0x45}, {&(0x7f0000000bc0)=""/109, 0x6d}, {&(0x7f00000002c0)=""/49, 0x31}, {&(0x7f0000000c40)=""/4096, 0x1000}], 0x7, &(0x7f0000001cc0)=""/205, 0xcd, 0xb24}, 0x6}, {{0x0, 0x0, &(0x7f0000002240)=[{&(0x7f0000001dc0)=""/150, 0x96}, {&(0x7f0000001e80)=""/201, 0xc9}, {&(0x7f0000001f80)=""/89, 0x59}, {&(0x7f0000002000)=""/68, 0x44}, {&(0x7f0000002080)=""/30, 0x1e}, {&(0x7f00000020c0)=""/192, 0xc0}, {&(0x7f0000002180)=""/167, 0xa7}], 0x7, &(0x7f00000022c0)=""/1, 0x1, 0xc86}, 0xffffffffffffff85}, {{&(0x7f0000002300)=@in6={0xa, 0x0, 0x0, @mcast1}, 0x80, &(0x7f0000002740)=[{&(0x7f0000002380)=""/154, 0x9a}, {&(0x7f0000002440)=""/194, 0xc2}, {&(0x7f0000002540)=""/206, 0xce}, {&(0x7f0000002640)=""/6, 0x6}, {&(0x7f0000002680)=""/131, 0x83}], 0x5, &(0x7f00000027c0)=""/43, 0x2b, 0x1}, 0x100}, {{&(0x7f0000002800)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @rand_addr}}}, 0x80, &(0x7f0000003c00)=[{&(0x7f0000002880)=""/135, 0x87}, {&(0x7f0000002940)=""/69, 0x45}, {&(0x7f00000029c0)=""/14, 0xe}, {&(0x7f0000002a00)=""/127, 0x7f}, {&(0x7f0000002a80)=""/4096, 0x1000}, {&(0x7f0000003a80)=""/92, 0x5c}, {&(0x7f0000003b00)=""/88, 0x58}, {&(0x7f0000003b80)=""/126, 0x7e}], 0x8, &(0x7f0000003c80)=""/1, 0x1, 0x401}, 0x1}, {{&(0x7f0000003cc0)=@sco, 0x80, &(0x7f0000003dc0)=[{&(0x7f0000003d40)=""/53, 0x35}, {&(0x7f0000003d80)}], 0x2, &(0x7f0000003e00)=""/140, 0x8c, 0x7fffffff}, 0x4}, {{0x0, 0x0, &(0x7f0000004040)=[{&(0x7f0000003ec0)=""/130, 0x82}, {&(0x7f0000003f80)=""/92, 0x5c}, {&(0x7f0000004000)=""/40, 0x28}], 0x3, &(0x7f0000004080)=""/81, 0x51, 0x7}}, {{&(0x7f0000004100)=@nfc_llcp, 0x80, &(0x7f00000046c0)=[{&(0x7f0000004180)=""/71, 0x47}, {&(0x7f0000004200)=""/84, 0x54}, {&(0x7f0000004280)=""/232, 0xe8}, {&(0x7f0000004380)=""/113, 0x71}, {&(0x7f0000004400)=""/152, 0x98}, {&(0x7f00000044c0)=""/224, 0xe0}, {&(0x7f00000045c0)=""/165, 0xa5}, {&(0x7f0000004680)=""/58, 0x3a}], 0x8, &(0x7f0000004740)=""/26, 0x1a, 0x5}}, {{&(0x7f0000004780)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, 0x80, &(0x7f0000004a00)=[{&(0x7f0000004800)=""/54, 0x36}, {&(0x7f0000004840)=""/201, 0xc9}, {&(0x7f0000004940)=""/135, 0x87}], 0x3, &(0x7f0000004a40)=""/233, 0xe9, 0x100}, 0x9}], 0xa, 0x40, &(0x7f0000004dc0)={0x77359400}) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r2, 0x84, 0x71, &(0x7f00000051c0)={0x0, 0x1}, &(0x7f0000005200)=0x8) unlinkat(r1, &(0x7f0000004e00)='./file0\x00', 0x0) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r2, 0x84, 0x76, &(0x7f0000005240)={0x0, 0x20}, &(0x7f0000005280)=0x8) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(0xffffffffffffffff, 0x84, 0x75, &(0x7f00000052c0)={r3, 0x101}, &(0x7f0000004e40)=0x7) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r2, 0x84, 0x22, &(0x7f0000004e80)={0x9, 0xa, 0x8, 0x4, r4}, 0x10) 22:30:57 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x4800000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:57 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(0xffffffffffffffff, 0x4004af61, &(0x7f0000000200)) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @dev}, 0x10) ioctl$SIOCSIFMTU(0xffffffffffffffff, 0x8922, &(0x7f0000000440)={'veth0_to_bond\x00'}) syz_open_dev$sndtimer(&(0x7f00000007c0)='/dev/snd/timer\x00', 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xd, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r2 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) bind$rds(0xffffffffffffffff, &(0x7f0000000740)={0x2, 0x0, @remote}, 0x10) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000780)) shmget(0x1, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) shmat(0x0, &(0x7f0000ffb000/0x2000)=nil, 0x0) perf_event_open(&(0x7f0000000280)={0x2, 0x70, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x2, 0x4, 0xfffffffffffffffd, 0x9, 0x4, 0x0, 0x5, 0x0, 0xfffffffffffffff8, 0xed, 0x0, 0x2, 0x0, 0x3f, 0x0, 0xffffffff, 0xfffffffffffffffc, 0x0, 0x0, 0xffffffffffffffc0, 0x0, @perf_config_ext={0x20, 0xe9}, 0x0, 0x7fff, 0x0, 0x7, 0x1, 0x0, 0x9d2}, 0x0, 0x6, r0, 0x0) r3 = memfd_create(&(0x7f00000000c0)="000000008c00000000000000000000", 0x0) pwritev(r3, &(0x7f0000f50f90), 0x0, 0x81003) [ 607.931317] binder_transaction: 30 callbacks suppressed [ 607.931333] binder: 10173:10191 transaction failed 29189/-22, size 0-0 line 2834 [ 607.971435] binder_thread_write: 7 callbacks suppressed 22:30:57 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000004c1000000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 607.971452] binder: 10194:10196 Acquire 1 refcount change on invalid ref 4 ret -22 [ 607.997391] EXT4-fs (loop0): invalid inodes per group: 8192 [ 607.997391] [ 608.006666] binder: 10189:10197 Acquire 1 refcount change on invalid ref 0 ret -22 22:30:57 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000000000100000009b030000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 608.034390] binder: 10194:10196 BC_FREE_BUFFER u0000000000000000 no match [ 608.034406] binder: 10194:10196 ERROR: BC_REGISTER_LOOPER called without request [ 608.036892] binder: 10194:10196 Acquire 1 refcount change on invalid ref 4 ret -22 [ 608.070398] binder: 10189:10197 got transaction to invalid handle 22:30:57 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec0000442d0000000000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:57 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(0xffffffffffffffff, 0x4004af61, &(0x7f0000000200)) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @dev}, 0x10) ioctl$SIOCSIFMTU(0xffffffffffffffff, 0x8922, &(0x7f0000000440)={'veth0_to_bond\x00'}) syz_open_dev$sndtimer(&(0x7f00000007c0)='/dev/snd/timer\x00', 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xd, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r2 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) bind$rds(0xffffffffffffffff, &(0x7f0000000740)={0x2, 0x0, @remote}, 0x10) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000780)=0x0) tgkill(0x0, r3, 0x0) shmget(0x1, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) shmat(0x0, &(0x7f0000ffb000/0x2000)=nil, 0x0) perf_event_open(&(0x7f0000000280)={0x2, 0x70, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x2, 0x4, 0xfffffffffffffffd, 0x9, 0x4, 0x0, 0x5, 0x0, 0xfffffffffffffff8, 0xed, 0x0, 0x2, 0x0, 0x3f, 0x0, 0xffffffff, 0xfffffffffffffffc, 0x0, 0x0, 0xffffffffffffffc0, 0x0, @perf_config_ext={0x20, 0xe9}, 0x0, 0x7fff, 0x0, 0x7, 0x1, 0x0, 0x9d2}, 0x0, 0x6, r0, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000f50f90), 0x0, 0x81003) [ 608.112609] binder: 10189:10197 transaction failed 29201/-22, size 0-0 line 2834 [ 608.117367] binder: 10194:10196 BC_FREE_BUFFER u0000000000000000 no match [ 608.129464] binder: 10201:10203 transaction failed 29189/-22, size 0-0 line 2834 [ 608.151746] binder: 10189:10197 Acquire 1 refcount change on invalid ref 0 ret -22 [ 608.156006] binder: 10194:10196 ERROR: BC_REGISTER_LOOPER called without request [ 608.164997] binder: 10189:10197 got transaction to invalid handle [ 608.186260] binder: 10210:10217 transaction failed 29189/-22, size 0-0 line 2834 22:30:57 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=[@acquire={0x40046305, 0x4}, @free_buffer, @register_looper], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 608.215731] binder: 10189:10197 transaction failed 29201/-22, size 0-0 line 2834 [ 608.240785] binder: 10210:10227 transaction failed 29189/-22, size 0-0 line 2834 22:30:57 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec000044fffffff40000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:57 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(0xffffffffffffffff, 0x4004af61, &(0x7f0000000200)) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @dev}, 0x10) ioctl$SIOCSIFMTU(0xffffffffffffffff, 0x8922, &(0x7f0000000440)={'veth0_to_bond\x00'}) syz_open_dev$sndtimer(&(0x7f00000007c0)='/dev/snd/timer\x00', 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xd, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r2 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) bind$rds(0xffffffffffffffff, &(0x7f0000000740)={0x2, 0x0, @remote}, 0x10) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000780)=0x0) tgkill(0x0, r3, 0x0) shmget(0x1, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) shmat(0x0, &(0x7f0000ffb000/0x2000)=nil, 0x0) perf_event_open(&(0x7f0000000280)={0x2, 0x70, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x2, 0x4, 0xfffffffffffffffd, 0x9, 0x4, 0x0, 0x5, 0x0, 0xfffffffffffffff8, 0xed, 0x0, 0x2, 0x0, 0x3f, 0x0, 0xffffffff, 0xfffffffffffffffc, 0x0, 0x0, 0xffffffffffffffc0, 0x0, @perf_config_ext={0x20, 0xe9}, 0x0, 0x7fff, 0x0, 0x7, 0x1, 0x0, 0x9d2}, 0x0, 0x6, r0, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000f50f90), 0x0, 0x81003) 22:30:57 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0xa000000, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 608.309468] binder: 10201:10234 transaction failed 29189/-22, size 0-0 line 2834 22:30:57 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000025000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 608.368898] binder: 10235:10236 Acquire 1 refcount change on invalid ref 4 ret -22 22:30:57 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec000044ffffffffffff070007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:57 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000002f00000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 608.409728] binder: 10235:10236 BC_FREE_BUFFER u0000000000000000 no match [ 608.430208] binder: 10235:10236 ERROR: BC_REGISTER_LOOPER called without request 22:30:57 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="056304400400000003630840", @ANYRES64=0x0, @ANYBLOB="00012b00"], 0x0, 0xfffffdfd, &(0x7f0000000180)}) pipe(&(0x7f0000000080)={0xffffffffffffffff}) getsockopt$inet_sctp6_SCTP_NODELAY(r1, 0x84, 0x3, &(0x7f00000000c0), &(0x7f0000000180)=0x4) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x20802, 0x0) setsockopt$inet_sctp_SCTP_RECVNXTINFO(r2, 0x84, 0x21, &(0x7f0000000040), 0x4) [ 608.486738] binder: 10248:10250 Acquire 1 refcount change on invalid ref 0 ret -22 [ 608.526544] EXT4-fs (loop0): Unsupported filesystem blocksize 0 (524287 log_block_size) 22:30:57 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(0xffffffffffffffff, 0x4004af61, &(0x7f0000000200)) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @dev}, 0x10) ioctl$SIOCSIFMTU(0xffffffffffffffff, 0x8922, &(0x7f0000000440)={'veth0_to_bond\x00'}) syz_open_dev$sndtimer(&(0x7f00000007c0)='/dev/snd/timer\x00', 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xd, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r2 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) bind$rds(0xffffffffffffffff, &(0x7f0000000740)={0x2, 0x0, @remote}, 0x10) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000780)=0x0) tgkill(0x0, r3, 0x0) shmget(0x1, 0x3000, 0x0, &(0x7f0000ffb000/0x3000)=nil) shmat(0x0, &(0x7f0000ffb000/0x2000)=nil, 0x0) perf_event_open(&(0x7f0000000280)={0x2, 0x70, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x2, 0x4, 0xfffffffffffffffd, 0x9, 0x4, 0x0, 0x5, 0x0, 0xfffffffffffffff8, 0xed, 0x0, 0x2, 0x0, 0x3f, 0x0, 0xffffffff, 0xfffffffffffffffc, 0x0, 0x0, 0xffffffffffffffc0, 0x0, @perf_config_ext={0x20, 0xe9}, 0x0, 0x7fff, 0x0, 0x7, 0x1, 0x0, 0x9d2}, 0x0, 0x6, r0, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000f50f90), 0x0, 0x81003) [ 608.541058] binder: 10245:10259 transaction failed 29189/-22, size 0-0 line 2834 [ 608.545242] binder: 10248:10250 got transaction to invalid handle [ 608.583872] binder: 10245:10266 transaction failed 29189/-22, size 0-0 line 2834 [ 608.601930] binder: 10248:10250 transaction failed 29201/-22, size 0-0 line 2834 [ 608.632510] binder_release_work: 29 callbacks suppressed [ 608.632517] binder: undelivered TRANSACTION_ERROR: 29189 [ 608.646556] kasan: CONFIG_KASAN_INLINE enabled [ 608.657436] binder: 10270:10274 Acquire 1 refcount change on invalid ref 4 ret -22 [ 608.667622] binder: undelivered TRANSACTION_ERROR: 29189 [ 608.675779] kasan: GPF could be caused by NULL-ptr deref or user memory access 22:30:57 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000000000100000003d000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 608.682435] binder: undelivered TRANSACTION_ERROR: 29201 [ 608.702400] general protection fault: 0000 [#1] PREEMPT SMP KASAN [ 608.703714] kobject: 'loop2' (000000002c6d671c): kobject_uevent_env [ 608.708693] CPU: 0 PID: 10273 Comm: syz-executor5 Not tainted 4.20.0-rc1-next-20181107+ #107 [ 608.717821] kobject: 'loop0' (00000000cd71149a): kobject_uevent_env [ 608.723668] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 608.723695] RIP: 0010:loop_validate_file+0x247/0x470 [ 608.723714] Code: 00 00 48 89 f8 48 c1 e8 03 80 3c 18 00 0f 85 2e 02 00 00 4d 8b a4 24 f0 00 00 00 49 8d bc 24 b8 01 00 00 48 89 f8 48 c1 e8 03 <80> 3c 18 00 0f 85 03 02 00 00 4d 8b a4 24 b8 01 00 00 4c 89 e0 48 [ 608.723723] RSP: 0018:ffff8801811778f8 EFLAGS: 00010202 [ 608.723734] RAX: 0000000000000037 RBX: dffffc0000000000 RCX: ffffc9000f6f7000 [ 608.723743] RDX: 000000000000007e RSI: ffffffff845401a7 RDI: 00000000000001b8 [ 608.723753] RBP: ffff880181177918 R08: ffff880185a385c0 R09: ffffed003b5c5b67 [ 608.723760] R10: 0000000000000002 R11: ffff8801dae2db3b R12: 0000000000000000 [ 608.723767] R13: ffff8801c46f35c0 R14: 0000000000000002 R15: ffff8801c46f35c0 [ 608.723783] FS: 00007fd72b1e0700(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000 [ 608.741687] kobject: 'loop2' (000000002c6d671c): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 608.744630] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 22:30:58 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000700000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 608.744641] CR2: 000000000072c000 CR3: 00000001be56e000 CR4: 00000000001406f0 [ 608.744653] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 608.744667] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 608.765991] kobject: 'loop0' (00000000cd71149a): fill_kobj_path: path = '/devices/virtual/block/loop0' [ 608.768911] Call Trace: [ 608.768939] lo_ioctl+0x55c/0x1d60 [ 608.768958] ? find_held_lock+0x36/0x1c0 [ 608.768978] ? lo_rw_aio+0x1ef0/0x1ef0 [ 608.777870] binder: undelivered TRANSACTION_ERROR: 29189 [ 608.783513] blkdev_ioctl+0x98e/0x21b0 22:30:58 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4c, 0x0, &(0x7f0000000300)=[@acquire, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f00000000c0)}}], 0x0, 0xfffffdfd, &(0x7f0000000180)}) 22:30:58 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec000044000000230000000007000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 608.783526] ? blkpg_ioctl+0xc10/0xc10 [ 608.783540] ? lock_downgrade+0x900/0x900 [ 608.783553] ? check_preemption_disabled+0x48/0x280 [ 608.783570] ? rcu_read_unlock_special+0x1c0/0x1c0 [ 608.795831] binder: undelivered TRANSACTION_ERROR: 29189 [ 608.798114] ? kasan_check_read+0x11/0x20 [ 608.798130] ? rcu_dynticks_curr_cpu_in_eqs+0xa2/0x170 [ 608.798145] ? rcu_softirq_qs+0x20/0x20 [ 608.837923] binder: 10270:10274 BC_FREE_BUFFER u0000000000000000 no match [ 608.843505] ? __fget+0x4d1/0x740 [ 608.843527] ? ksys_dup3+0x680/0x680 [ 608.843542] ? __might_fault+0x12b/0x1e0 [ 608.843559] ? lock_downgrade+0x900/0x900 [ 608.843578] block_ioctl+0xee/0x130 [ 608.843591] ? blkdev_fallocate+0x400/0x400 [ 608.843604] do_vfs_ioctl+0x1de/0x1790 [ 608.843622] ? ioctl_preallocate+0x300/0x300 [ 608.843634] ? __fget_light+0x2e9/0x430 [ 608.843651] ? fget_raw+0x20/0x20 [ 608.882710] kobject: 'loop3' (000000005b4ad2c7): kobject_uevent_env [ 608.883705] ? _copy_to_user+0xc8/0x110 [ 608.883726] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 608.887619] kobject: 'loop3' (000000005b4ad2c7): fill_kobj_path: path = '/devices/virtual/block/loop3' [ 608.891756] ? put_timespec64+0x10f/0x1b0 [ 608.891770] ? nsecs_to_jiffies+0x30/0x30 [ 608.891793] ? do_syscall_64+0x9a/0x820 [ 608.899206] binder: 10270:10274 unknown command 2818304 [ 608.901709] ? do_syscall_64+0x9a/0x820 [ 608.901726] ? lockdep_hardirqs_on+0x3bb/0x5b0 [ 608.901746] ? security_file_ioctl+0x94/0xc0 [ 608.901764] ksys_ioctl+0xa9/0xd0 [ 608.901782] __x64_sys_ioctl+0x73/0xb0 [ 608.935840] kobject: 'loop0' (00000000cd71149a): kobject_uevent_env [ 608.938708] do_syscall_64+0x1b9/0x820 [ 608.938729] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 608.954965] binder: 10270:10274 ioctl c0306201 20000140 returned -22 [ 608.959086] ? syscall_return_slowpath+0x5e0/0x5e0 [ 608.959102] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 608.959118] ? trace_hardirqs_on_caller+0x310/0x310 [ 608.959136] ? prepare_exit_to_usermode+0x291/0x3b0 [ 608.969848] kobject: 'loop0' (00000000cd71149a): fill_kobj_path: path = '/devices/virtual/block/loop0' [ 608.972950] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 608.972971] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 608.972986] RIP: 0033:0x457569 [ 608.990764] kobject: 'loop0' (00000000cd71149a): kobject_uevent_env [ 608.991909] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 608.991918] RSP: 002b:00007fd72b1dfc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 608.991932] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457569 [ 608.991946] RDX: 0000000000000006 RSI: 0000000000004c00 RDI: 0000000000000005 [ 608.996197] kobject: 'loop0' (00000000cd71149a): fill_kobj_path: path = '/devices/virtual/block/loop0' [ 609.000227] RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000 [ 609.000237] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fd72b1e06d4 [ 609.000247] R13: 00000000004c06c0 R14: 00000000004d0af0 R15: 00000000ffffffff [ 609.000263] Modules linked in: 22:30:58 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec000044000000000000001f07000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:58 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="056304400400000003630840", @ANYRES64=0x0, @ANYBLOB="84b67b175626f59abc5064739898a423f9362b8ede3493dac6260e1d1f0d004efb0d633a2e5d965d92a68a001cac148ae1e365474e01f44583cf24fc6a6c7a948e105510193f85db8d20e54cfcdba912f7ff2ce5b04056e11c3a8458b7ffc6950f31d2eb16b08a610993b967a586f474bb1ea30bac4c958135903db2ee870429bad5e8026169871ce6605ecaeb6aacaf162b6315fb6e4f182da4e5b1da558091111d16e7fea1a47d699c7d974a46066dc658ead76821db81530738001bbd1a60be33301b947af87dfb5159bcd14a751a0fc801be687fee48f52f42db93bd484d64cdcba6b20fec0119263602bc7509381a77"], 0x0, 0xfffffdfd, &(0x7f0000000180)}) [ 609.028335] binder: 10270:10274 Acquire 1 refcount change on invalid ref 4 ret -22 [ 609.032459] EXT4-fs (loop0): invalid inodes per group: 8192 [ 609.032459] [ 609.039398] binder: 10270:10274 BC_FREE_BUFFER u0000000000000000 no match [ 609.049733] ---[ end trace 23e88456827e3867 ]--- [ 609.062871] binder: 10270:10274 unknown command 2818304 [ 609.099877] RIP: 0010:loop_validate_file+0x247/0x470 [ 609.112344] binder: 10270:10274 ioctl c0306201 20000140 returned -22 [ 609.153662] Code: 00 00 48 89 f8 48 c1 e8 03 80 3c 18 00 0f 85 2e 02 00 00 4d 8b a4 24 f0 00 00 00 49 8d bc 24 b8 01 00 00 48 89 f8 48 c1 e8 03 <80> 3c 18 00 0f 85 03 02 00 00 4d 8b a4 24 b8 01 00 00 4c 89 e0 48 [ 609.195853] binder: 10309:10310 Acquire 1 refcount change on invalid ref 4 ret -22 [ 609.201593] kobject: 'loop0' (00000000cd71149a): kobject_uevent_env [ 609.206347] binder: 10309:10310 BC_FREE_BUFFER u0000000000000000 no match [ 609.216356] binder: undelivered TRANSACTION_ERROR: 29189 [ 609.220017] binder: 10309:10310 unknown command 393983620 [ 609.224309] binder: undelivered TRANSACTION_ERROR: 29189 [ 609.261256] binder: 10309:10310 ioctl c0306201 20000140 returned -22 22:30:58 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000001000000053000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:58 executing program 3: socket$inet6(0xa, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000500000001000000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) 22:30:58 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec000044000000000000000507000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) [ 609.264208] kobject: 'loop0' (00000000cd71149a): fill_kobj_path: path = '/devices/virtual/block/loop0' [ 609.287844] binder: 10309:10317 Acquire 1 refcount change on invalid ref 4 ret -22 [ 609.323393] kobject: 'loop1' (00000000afc28a53): kobject_uevent_env [ 609.330645] binder: undelivered TRANSACTION_ERROR: 29189 [ 609.336124] binder: undelivered TRANSACTION_ERROR: 29189 [ 609.341723] kobject: 'loop1' (00000000afc28a53): fill_kobj_path: path = '/devices/virtual/block/loop1' [ 609.355198] binder: 10309:10317 BC_FREE_BUFFER u0000000000000000 no match [ 609.355812] kobject: 'loop2' (000000002c6d671c): kobject_uevent_env [ 609.368909] kobject: 'loop2' (000000002c6d671c): fill_kobj_path: path = '/devices/virtual/block/loop2' 22:30:58 executing program 0: syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000300)="0501000a0200000066f6ffffc8030000ec00004400000000ffffffff07000000002000000020000003000000000000006e5fbe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)) 22:30:58 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x0, 0x0, @loopback}, 0x1c) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x19, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000010000000d1030000000000005c49"], 0x0, 0x0, &(0x7f00000003c0)}) stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)) [ 609.383610] binder: 10309:10317 unknown command 393983620 [ 609.384895] RSP: 0018:ffff8801811778f8 EFLAGS: 00010202 [ 609.396062] kobject: 'loop3' (000000005b4ad2c7): kobject_uevent_env [ 609.402806] kobject: 'loop3' (000000005b4ad2c7): fill_kobj_path: path = '/devices/virtual/block/loop3' [ 609.408811] binder: 10309:10317 ioctl c0306201 20000140 returned -22 [ 609.419784] binder: undelivered TRANSACTION_ERROR: 29189 [ 609.426084] RAX: 0000000000000037 RBX: dffffc0000000000 RCX: ffffc9000f6f7000 [ 609.455238] RDX: 000000000000007e RSI: ffffffff845401a7 RDI: 00000000000001b8 [ 609.468142] kobject: 'loop0' (00000000cd71149a): kobject_uevent_env [ 609.491337] kobject: 'loop0' (00000000cd71149a): fill_kobj_path: path = '/devices/virtual/block/loop0' [ 609.500966] RBP: ffff880181177918 R08: ffff880185a385c0 R09: ffffed003b5c5b67 [ 609.518623] kobject: 'loop2' (000000002c6d671c): kobject_uevent_env [ 609.523376] R10: 0000000000000002 R11: ffff8801dae2db3b R12: 0000000000000000 [ 609.530695] kobject: 'loop2' (000000002c6d671c): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 609.533816] R13: ffff8801c46f35c0 R14: 0000000000000002 R15: ffff8801c46f35c0 [ 609.557296] kobject: 'loop0' (00000000cd71149a): kobject_uevent_env [ 609.557738] FS: 00007fd72b1e0700(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000 [ 609.574994] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 609.582786] CR2: 00007ffc7a9f3dbc CR3: 00000001be56e000 CR4: 00000000001406f0 [ 609.592190] kobject: 'loop0' (00000000cd71149a): fill_kobj_path: path = '/devices/virtual/block/loop0' [ 609.597233] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 609.618350] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 609.637726] Kernel panic - not syncing: Fatal exception [ 609.644311] Kernel Offset: disabled [ 609.647942] Rebooting in 86400 seconds..