01e2391edfb57a7714db8a866b2561e14a6d66f59088e25dee47732f03164ac31eefb666efd4429ed59bb25bc23fe9175710bb80906289940336aec57064b29c4456cd3c0ee2e836447a0d9e51bb173c3f766667927a09e38a7501266bec53b5c2ef526114594b049533163c2ad0ddb6cf8a8d470bd56f0afa28388e7333645b3a3dcdb9b4a37c7659257c3114ece11517f14e2954a77b749321e6e05303756904a1d1388c77a2ae2d30f0097e273cf58a0ab5535bad658a83e378c14cb8e550c6ee9e461e39f672e592fab1f4b44af845af3e9ab6d9efbbbff54bebbd6ff28f47a70d11139ad742638a4ecb874d8609406a7ac5ed11d17b612d948b3cea6c96327178183d12bbfb221fa4ea92a13be785be3a61cdb5a398d04d04e955eb3a625a3bdd5b081ce725042dec11737c9101916e871a65f9f82a178f78b4c1535b7261a3481845fab922d7ed893dcebfdf7d4b45199fa5da483a5c5149b2eb2716915fe48af22b3df975e10f6c3f7d0f4e8e414b839173a049557d4cdad16f6d9ca44d023855b8eadedbd82d78ded03b9f34e9c89693eea5eb546865bab6484ad5f7cd812c16af25d99b60d8cc6409dcde0b7de2a00b0c7a39d5b0d55bf4f7baaf9e29d4aaa0323b1e171fe03e9ceb17b86fb0eecf2886176c2639ea7c97f0fd13baeeedf03798a405c20a03fd8d724baebc3f1038a279a3866e055883ccc66c4b538cf7ced99fc5847006df2866a151466438f0376d1c7bb07a77c91768a97d4f801e30ccfcc26ae7dd821544a3ccf0153eb111d27d41e24dd1055bf77d645a2a02199297fafff734decae03bd36a3a14a1acce391a413fcaadc498207bfc5218e15f8463f9551f515d16e7d7b4d74c0960ffc6d91a7a0e9ae8bc543f7055c8d26d7df7b17366b53f1ff130a89d105984f3b50883c9b7417ee11187f3e84282d7e48bb705a475d6db2fce76040c726086146d34e9be90b809631162ff37505d92a0facf44b465587ecf09c61285c4d4717e29b71bb575a2451940576fb2cf5072f2ac7da884cb038ec54cb61b9184d2122aab3c1745df131899e4f0e35190e7b5b25d1148c4191b52b49ff66101f40361d65d424b2a86054f07537ea0751f86a10c52d73755a712ee950c727b0b1cf47694305cca82d6b126a7d2ce010112bf7f5de5bf22e5181924b15c53277ecbeb636b6c9458840cd172950c5e6c77bdd7d0471324e7762cfc3aeccd6982b21c383a9e", [[], [], [], [], [], []]}, 0x1620) 03:36:43 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) readahead(r0, 0x8, 0x20) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='rdma.current\x00', 0x0, 0x0) 03:36:43 executing program 4: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) setreuid(0x0, 0x0) [ 487.024113] binder: 23986:23995 transaction failed 29201/-28, size 6144-2048 line 3155 [ 487.051755] binder: 24002:24007 unknown command 536871488 [ 487.057357] binder: 24002:24007 ioctl c0306201 20000440 returned -22 [ 487.069393] binder: 23986:23995 ioctl c0306201 20000440 returned -14 [ 487.077088] binder: BINDER_SET_CONTEXT_MGR already set [ 487.091654] binder: 24000:24010 ioctl 40046207 0 returned -16 03:36:43 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 03:36:43 executing program 4: clone(0x2102009ff8, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000140)=@nat={'nat\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0x19, 0x2, 0x1d8, [0x20000280, 0x0, 0x0, 0x20000350, 0x20000380], 0x0, 0x0, &(0x7f0000000280)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'bridge_slave_0\x00', 'sit0\x00', 'ip6gretap0\x00', 'ipddp0\x00', @broadcast, [], @dev, [], 0x70, 0x70, 0xa0}}, @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x5, 0x40000, 0x0, 'rose0\x00', 'ip6gre0\x00', 'veth0_to_bridge\x00', 'vlan0\x00', @remote, [], @link_local, [], 0x70, 0x70, 0xa8}}, @arpreply={'arpreply\x00', 0x10}}]}]}, 0x250) 03:36:43 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x6) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000040)=ANY=[@ANYBLOB="00e0acd852c60002000072b0af"]], 0x0, 0x0, 0x0}) [ 487.102144] binder: 24002:24015 unknown command 536871488 [ 487.107891] binder: 24000:24010 unknown command 0 [ 487.114593] binder: 24002:24015 ioctl c0306201 20000440 returned -22 [ 487.129773] binder: 24000:24010 ioctl c0306201 20000040 returned -22 [ 487.160739] binder_alloc: binder_alloc_mmap_handler: 24000 20ffc000-20ffe000 already mapped failed -16 [ 487.171239] binder: 24022:24024 unknown command 536870976 [ 487.181139] binder: 24017:24027 ioctl c018620b 0 returned -14 [ 487.189785] binder: 24022:24024 ioctl c0306201 20000000 returned -22 [ 487.197355] binder: BINDER_SET_CONTEXT_MGR already set [ 487.202814] binder: 24000:24010 ioctl 40046207 0 returned -16 [ 487.208901] binder: 24000:24023 unknown command 0 [ 487.222138] binder: 24000:24023 ioctl c0306201 20000040 returned -22 03:36:44 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000005f0000000000000000000000000000180000000000000008000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040), 0x4) sched_rr_get_interval(0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') 03:36:44 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) r1 = accept$unix(0xffffffffffffff9c, 0x0, &(0x7f0000000000)) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000080)='bcsf0\x00', 0x10) dup(r0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='rdma.current\x00', 0x0, 0x0) 03:36:44 executing program 4: openat$ppp(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ppp\x00', 0x0, 0x0) syz_open_dev$evdev(&(0x7f00000002c0)='/dev/input/event#\x00', 0x0, 0x0) creat(&(0x7f00000001c0)='./file0\x00', 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) pipe(&(0x7f0000000180)={0xffffffffffffffff}) write(0xffffffffffffffff, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) 03:36:44 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x80000000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) r1 = gettid() ptrace$peekuser(0x3, r1, 0x0) 03:36:44 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='+'}) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 487.731622] binder: 23986:23988 ioctl c0306201 20000140 returned -14 [ 487.738815] binder: undelivered TRANSACTION_ERROR: 29201 [ 487.770561] binder: 24035:24039 unknown command 536871488 [ 487.775975] binder: 24042:24044 ioctl c018620b 0 returned -14 03:36:44 executing program 0: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="1000"]], 0x0, 0x0, 0x0}) r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x204102, 0x0) write$selinux_create(r0, &(0x7f0000000040)=@access={'system_u:object_r:dhcp_etc_t:s0', 0x20, '/usr/sbin/ntpd', 0x20, 0x400}, 0x44) [ 487.783323] binder: 24040:24045 ioctl c018620b 0 returned -14 [ 487.783352] binder: 24038:24043 unknown command 536872064 [ 487.796498] binder: 24035:24039 ioctl c0306201 20000440 returned -22 [ 487.800236] binder: 24038:24043 ioctl c0306201 20000440 returned -22 [ 487.807745] binder: 24035:24046 unknown command 536871488 [ 487.815296] binder: 24038:24043 unknown command 536872064 [ 487.815307] binder: 24038:24043 ioctl c0306201 20000440 returned -22 03:36:44 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) fdatasync(r0) ioctl$FICLONERANGE(r0, 0x4020940d, &(0x7f0000000000)={r0, 0x0, 0x2, 0x2, 0x9}) 03:36:44 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='memory.events\x00', 0x0, 0x0) setsockopt$EBT_SO_SET_COUNTERS(r1, 0x0, 0x81, &(0x7f0000000100)={'filter\x00', 0x0, 0x0, 0x0, [], 0x1, &(0x7f0000000080)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x0, [{}]}, 0x88) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='rdma.current\x00', 0x0, 0x0) [ 487.834625] binder: 24035:24046 ioctl c0306201 20000440 returned -22 [ 487.841913] binder_alloc: 3591: binder_alloc_buf size 8192 failed, no address space [ 487.865542] binder_alloc: allocated: 6496 (num: 212 largest: 32), free: 5792 (num: 1 largest: 5792) [ 487.870622] binder: 24056:24057 unknown command 536872064 [ 487.892424] binder: 24042:24052 transaction failed 29201/-28, size 6144-2048 line 3155 [ 487.896294] binder: 24040:24061 ioctl c0306201 200003c0 returned -14 [ 487.908002] binder: 24056:24057 ioctl c0306201 20000440 returned -22 [ 487.918248] binder: 24042:24052 ioctl c0306201 20000440 returned -14 [ 487.926552] binder: 24056:24057 unknown command 536872064 [ 487.929154] binder: 24063:24065 unknown command 536871488 03:36:44 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="543ec7042bc4162f13dfc5626f37"]], 0x0, 0x0, 0x0}) [ 487.932443] binder: 24056:24057 ioctl c0306201 20000440 returned -22 [ 487.938184] binder: 24063:24065 ioctl c0306201 20000440 returned -22 [ 487.954405] binder: 24063:24066 unknown command 536871488 [ 487.966479] binder: 24063:24066 ioctl c0306201 20000440 returned -22 [ 487.972754] binder: 24068:24069 unknown command 536870912 [ 487.978893] binder: 24017:24034 ioctl c018620b 0 returned -14 [ 487.979333] binder: 24068:24069 ioctl c0306201 20000440 returned -22 [ 487.993373] binder: 24017:24070 BC_ACQUIRE_DONE node 1081 has no pending acquire request [ 488.010241] binder: 24017:24070 unknown command 0 [ 488.015997] binder: 24017:24070 ioctl c0306201 200003c0 returned -22 [ 488.027606] binder: release 24017:24034 transaction 1073 out, still active 03:36:44 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 03:36:44 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x3) ioctl$EVIOCSKEYCODE(r0, 0x40084504, &(0x7f0000000000)=[0x4, 0x2]) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0xffffffffffffffac, 0x0, &(0x7f00000001c0)=ANY=[], 0x0, 0x0, 0x0}) 03:36:44 executing program 2: r0 = creat(&(0x7f0000000100)='./file0\x00', 0xe0) ioctl$KDGKBTYPE(r0, 0x4b33, &(0x7f0000000140)) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000180)=ANY=[@ANYBLOB="00000012abd9a96800000000"]], 0x0, 0x0, 0x0}) r2 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) r3 = openat$cgroup_ro(r2, &(0x7f0000000080)='rdma.current\x00', 0x0, 0x0) linkat(r3, &(0x7f0000000040)='./file0\x00', r2, &(0x7f00000000c0)='./file0\x00', 0x1400) [ 488.037597] binder: release 24017:24034 transaction 1080 out, still active [ 488.045455] binder: unexpected work type, 4, not freed [ 488.051148] binder: undelivered TRANSACTION_COMPLETE [ 488.076075] binder: 24074:24077 ioctl c018620b 0 returned -14 [ 488.088033] binder: 24073:24079 ioctl 40084504 20000000 returned -22 [ 488.089619] binder: 24075:24078 unknown command 536871296 [ 488.101047] binder: 24075:24078 ioctl c0306201 20000440 returned -22 [ 488.109008] binder: 24073:24079 ioctl 40084504 20000000 returned -22 [ 488.116727] binder: 24075:24081 unknown command 536871296 [ 488.122822] binder: 24075:24081 ioctl c0306201 20000440 returned -22 03:36:45 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000005f0000000000000000000000000000180000000000000008000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040), 0x4) sched_rr_get_interval(0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') 03:36:45 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000040)=ANY=[@ANYBLOB="008abd0cb1df2c0daf"]], 0x0, 0x0, 0x0}) [ 488.574434] binder: 24042:24044 ioctl c0306201 20000140 returned -14 [ 488.577098] binder: 24040:24051 ioctl c018620b 0 returned -14 [ 488.581361] binder: undelivered TRANSACTION_ERROR: 29201 [ 488.611238] binder: 24088:24089 ioctl c018620b 0 returned -14 [ 488.618231] binder: 24087:24090 unknown command 536870976 [ 488.624134] binder: 24087:24090 ioctl c0306201 20000440 returned -22 [ 488.632446] binder: 24087:24090 unknown command 536870976 [ 488.638640] binder: 24087:24090 ioctl c0306201 20000440 returned -22 [ 488.640928] binder: release 24040:24051 transaction 1077 out, still active [ 488.664452] binder: release 24040:24092 transaction 1086 out, still active 03:36:45 executing program 4: 03:36:45 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000080)={'syz', 0x0}, &(0x7f00000000c0)="866c4132c04bbe395426e74a9f33475672c18751c2416f1ea766f3900a2d8e39558d08e702ab17ce24ef1a2790e3c0ea35df2f507a7705fa899de0cacc5ef13cff029081c6c618cc34e1cdac97daa0c5ba30f4ef857d1310f82e06cca06e7d1c85048ccaffa80b88dec2e1ebce878d05451685a59c608a90d11659f60da1e4386a0472874a6b915fc702a8efd04a5956b9428c94acab3451c0e159bd09aa16ee7839058677423d3ea35aade4d8096d8154e36ce9beaf5eeccbb2204ee7440794f08b7bcddb449051755d155cf2c75f2488195340b58f91a48851f0dcb411095d19", 0xe1, 0x0) keyctl$KEYCTL_PKEY_VERIFY(0x1c, &(0x7f00000001c0)={r1, 0x6, 0x40}, 0x0, &(0x7f0000000200)="a7c52a10fd", &(0x7f0000000280)="df406e9fa79344224977738e401e6fc65c30f5da2a4e4861940059d64d8c5bcba8f6b939a800de583f570d799bf7c28eac99694fbfe9d039dd") openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='rdma.current\x00', 0x0, 0x0) 03:36:45 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="edae3d91d75c81548133dd1204133f6fac107708f561e691e546419d25f9ac7ecfb02bfe627d836b309e3820d5f530d2649dd19db2a72e0f903658e47abd2bb4018ca323634a15f3283179cf368f3295ba7271f1c7f3745a6fefc2ff63f82267465fd276232012ba444ad57d56a464f2402b0f0a9f208f0a5516353860a85dc00b975a8452a8f43b42dccd2bdf959f422c75334850a15f975c2bfd9cfffae6025e0af9ec65d5b5a75814b07de02d6f3fb7765bf8ae736f46cf68a9d5683f61349f2ac458583e"]], 0xfffffdc0, 0x0, 0x0}) clock_gettime(0x0, &(0x7f0000000100)) getcwd(&(0x7f0000000180)=""/212, 0xd4) 03:36:45 executing program 5: seccomp(0x1, 0x0, &(0x7f0000000240)={0x1, &(0x7f0000000000)=[{0x4000000000006, 0x0, 0x0, 0xffffffff}]}) creat(&(0x7f0000000180)='./file0\x00', 0x0) chown(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) [ 488.665237] binder_alloc: 3591: binder_alloc_buf size 8192 failed, no address space [ 488.685508] binder_alloc: allocated: 6624 (num: 216 largest: 32), free: 5664 (num: 1 largest: 5664) [ 488.695921] binder: 24088:24094 transaction failed 29201/-28, size 6144-2048 line 3155 [ 488.753709] binder: 24098:24102 unknown command 536871488 [ 488.760455] binder: 24099:24104 unknown command 536870912 [ 488.770775] binder: 24098:24102 ioctl c0306201 20000440 returned -22 [ 488.778998] audit: type=1326 audit(2000000205.620:48): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=24100 comm="syz-executor.5" exe="/root/syz-executor.5" sig=31 arch=c000003e syscall=228 compat=0 ip=0x45b06a code=0xffff0000 03:36:45 executing program 4: 03:36:45 executing program 4: [ 488.780180] binder: 24099:24104 ioctl c0306201 20000140 returned -22 [ 488.831297] binder: 24098:24106 unknown command 536871488 03:36:45 executing program 4: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x6, 0x4, 0x4, 0x8}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000640)={r0, &(0x7f0000000780), 0x0, 0x400002}, 0x20) 03:36:45 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 488.856991] binder: 24098:24106 ioctl c0306201 20000440 returned -22 [ 488.871697] binder: release 24074:24082 transaction 1083 out, still active 03:36:45 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/zero\x00', 0x288000, 0x0) ioctl$TIOCSWINSZ(r1, 0x5414, &(0x7f0000000140)={0xffffffffffffffa3, 0x9, 0x7ff, 0x9}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="00000000000000004e0e22a58015c2789821b23a2f6abeb29d62a5ffdb24d2c0de7e88fbf4c689a6b204693f4a07b58e9c7798a3e20365432b6c97cf21c227ec44ecb2a2c2f77bf1adb317113900009c6c1c3a66f187d1901d45f11ae7f4f86b20cdbaf52b5fd7e080de0aa42612fb29aaf032bbba9a9f752084606993396534d0faa9e65d0081eb86b2b3f3145710fc2fcded3ef596a9b32b0ab4c5a3948d2a362504b01cd9a47bab3e616ddce658e11435fc76"]], 0x0, 0x0, 0x0}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='rdma.current\x00', 0x0, 0x0) 03:36:45 executing program 4: r0 = socket$inet(0x2, 0x200000002, 0x200000088) r1 = dup2(r0, r0) sendto$inet(r1, 0x0, 0x0, 0x0, 0x0, 0x0) [ 488.904534] binder: 24099:24104 unknown command 536870912 [ 488.913309] binder: 24112:24115 ioctl c018620b 0 returned -14 [ 488.919522] binder: 24099:24104 ioctl c0306201 20000140 returned -22 [ 488.931720] binder: 24114:24118 ioctl c018620b 0 returned -14 [ 488.945525] binder: 24114:24118 unknown command 536871424 [ 488.960652] binder: 24114:24118 ioctl c0306201 20000440 returned -22 [ 488.980697] binder: 24114:24124 unknown command 536871424 [ 488.980727] binder: 24114:24118 ioctl c018620b 0 returned -14 [ 488.986461] binder: 24114:24124 ioctl c0306201 20000440 returned -22 03:36:46 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000005f0000000000000000000000000000180000000000000008000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040), 0x4) sched_rr_get_interval(0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') 03:36:46 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB]], 0x0, 0x0, 0x0}) 03:36:46 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = getpgid(0x0) getpgid(r1) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpuacct.stat\x00', 0x0, 0x0) ioctl$RTC_AIE_OFF(r2, 0x7002) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='rdma.current\x00', 0x0, 0x0) setsockopt$SO_TIMESTAMPING(r3, 0x1, 0x25, &(0x7f00000001c0), 0x4) ioctl$RTC_AIE_ON(r3, 0x7001) ioctl$VT_ACTIVATE(r3, 0x5606, 0x7f) recvfrom$inet(r2, &(0x7f0000000080)=""/218, 0xda, 0x2020, &(0x7f0000000180)={0x2, 0x4e22, @multicast1}, 0x10) 03:36:46 executing program 4: r0 = socket$inet6(0xa, 0x2000000802, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000f68000)={@loopback, 0x0, 0x0, 0x102, 0x1, 0x0, 0x21}, 0x20) [ 489.410481] binder: 24088:24089 ioctl c0306201 20000140 returned -14 [ 489.417312] binder: undelivered TRANSACTION_ERROR: 29201 [ 489.449001] binder: 24129:24135 unknown command 536871488 03:36:46 executing program 4: [ 489.459857] binder: 24133:24137 ioctl c018620b 0 returned -14 [ 489.460232] binder: 24130:24136 unknown command 536872064 [ 489.467241] binder: 24129:24135 ioctl c0306201 20000440 returned -22 [ 489.474353] binder: 24130:24136 ioctl c0306201 20000440 returned -22 [ 489.499520] binder: 24129:24140 unknown command 536871488 [ 489.514377] binder_alloc: 3591: binder_alloc_buf size 8192 failed, no address space [ 489.519163] binder: 24129:24140 ioctl c0306201 20000440 returned -22 [ 489.532747] binder_alloc: allocated: 6656 (num: 217 largest: 32), free: 5632 (num: 1 largest: 5632) [ 489.545585] binder: 24133:24141 transaction failed 29201/-28, size 6144-2048 line 3155 03:36:46 executing program 5: 03:36:46 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="00af1b61c352bd779e9c5dc7fefd90192123c664a5d3e840369a69ac5521ac29e2741d6ac3517b534337ac01c6c9418547c244bdae0088a919f84337d69473255d6943191cc8a3bbb72c26eb4e4678aa4425d876c2f08cdf2363682946a8075442c638103c4bbb514a877d04f630cf20a14b50029d74484a2bf3e458d93a01111de02c29d9b136ad29130a735b97e7937ba1c16d4c475d4389a4d92414471f61ffa464a59a7290"]], 0x0, 0x0, 0x0}) 03:36:46 executing program 4: 03:36:46 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000000c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000280)={0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xd8, 0x0, &(0x7f0000000480)=[@reply={0x40406301, {0x4, 0x0, 0x3, 0x0, 0x1, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)=[@flat={0x77622a85, 0xa, r1, 0x2}], &(0x7f00000000c0)}}, @transaction={0x40406300, {0x4, 0x0, 0x3, 0x0, 0x1, 0x0, 0x0, 0x68, 0x0, &(0x7f0000000180)=[@fd={0x66642a85, 0x0, r0, 0x0, 0x2}, @ptr={0x70742a85, 0x1, &(0x7f0000000100), 0x1, 0x4, 0x5}, @ptr={0x70742a85, 0x1, &(0x7f0000000140), 0x1, 0x3, 0x3b}], &(0x7f0000000200)}}, @increfs_done={0x40106308, r2, 0x1}, @exit_looper, @request_death={0x400c630e, 0x4, 0x3}, @exit_looper, @request_death={0x400c630e, 0x3, 0x1}, @decrefs={0x40046307, 0x2}, @dead_binder_done], 0xad, 0x0, &(0x7f0000000340)="54954029b6179f6b4b020f6fb09031b1c6ecb0ad201ed90d1d40722dff444020d34bf43ca7e80622bd0f2d7b2fd0718c9b3af572c3fffc9ad7ebfe97a00a5a3613c579d7827c01c4dc271a6411701044c0bc9ee8b65ff3edc5e99ed8aef28fb94a87f85443b35fe702555c8543c24c25b9f97a34baf6229a1175f03100542355bde570e36e5f150f27ad5ad1515435bbccb5805bcd43ebf8a8ac9b9154086ab4643a13cabdf7aacbf7a9785277"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='rdma.current\x00', 0x0, 0x0) ioctl$BLKZEROOUT(r3, 0x127f, &(0x7f0000000000)={0x2, 0x16f}) [ 489.561988] audit: type=1326 audit(2000000206.410:49): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 pid=24100 comm="syz-executor.5" exe="/root/syz-executor.5" sig=31 arch=c000003e syscall=228 compat=0 ip=0x45b06a code=0xffff0000 [ 489.599008] binder: 24133:24141 ioctl c0306201 20000440 returned -14 [ 489.631613] binder: 24149:24153 unknown command 536871168 [ 489.651956] binder: 24149:24153 ioctl c0306201 20000440 returned -22 [ 489.661172] binder: 24152:24156 got reply transaction with no transaction stack [ 489.672337] binder: 24152:24156 transaction failed 29201/-71, size 24-0 line 2926 03:36:46 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 03:36:46 executing program 4: 03:36:46 executing program 5: [ 489.683349] binder: 24152:24156 unknown command 536871488 [ 489.689709] binder: 24152:24156 ioctl c0306201 20000440 returned -22 [ 489.703314] binder: 24152:24158 got reply transaction with no transaction stack [ 489.710792] binder: release 24112:24123 transaction 1090 out, still active [ 489.711492] binder: 24152:24158 transaction failed 29201/-71, size 24-0 line 2926 [ 489.741640] binder: 24152:24156 unknown command 536871488 [ 489.747463] binder: 24152:24156 ioctl c0306201 20000440 returned -22 [ 489.759536] binder: 24162:24163 ioctl c018620b 0 returned -14 03:36:47 executing program 4: 03:36:47 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x2042, 0x0) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1b, &(0x7f0000000040)={@rand_addr, 0x0}, &(0x7f0000000080)=0x14) setsockopt$inet6_mreq(r1, 0x29, 0x1d, &(0x7f00000000c0)={@local, r2}, 0x14) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) 03:36:47 executing program 5: 03:36:47 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000005f0000000000000000000000000000180000000000000008000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040), 0x4) sched_rr_get_interval(0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') 03:36:47 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) r1 = dup(r0) r2 = getpgrp(0xffffffffffffffff) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000080)={{{@in6, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@initdev}, 0x0, @in6=@mcast1}}, &(0x7f0000000000)=0xe8) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000180)={0x0, 0x0, 0x0}, &(0x7f00000001c0)=0xc) setsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000200)={r2, r3, r4}, 0xc) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='rdma.current\x00', 0x0, 0x0) [ 490.253218] binder: 24133:24137 ioctl c0306201 20000140 returned -14 [ 490.260266] binder: undelivered TRANSACTION_ERROR: 29201 03:36:47 executing program 4: 03:36:47 executing program 5: [ 490.295003] binder: 24171:24173 unknown command 536871488 [ 490.307683] binder: 24169:24174 unknown command 536872064 [ 490.327387] binder: 24171:24173 ioctl c0306201 20000440 returned -22 03:36:47 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="0400"]], 0x0, 0x0, 0x0}) pipe(&(0x7f0000000000)) 03:36:47 executing program 4: [ 490.339868] binder: 24169:24174 ioctl c0306201 20000440 returned -22 [ 490.348981] binder: 24175:24180 ioctl c018620b 0 returned -14 [ 490.354922] binder: 24169:24182 unknown command 536872064 [ 490.354936] binder: 24169:24182 ioctl c0306201 20000440 returned -22 [ 490.380358] binder: 24171:24181 unknown command 536871488 [ 490.385978] binder: 24171:24181 ioctl c0306201 20000440 returned -22 [ 490.401054] binder_alloc: 3591: binder_alloc_buf size 8192 failed, no address space [ 490.408936] binder_alloc: allocated: 6688 (num: 218 largest: 32), free: 5600 (num: 1 largest: 5600) [ 490.419091] binder: 24187:24188 unknown command 536872064 [ 490.425036] binder: 24187:24188 ioctl c0306201 20000440 returned -22 [ 490.432869] binder: 24175:24185 transaction failed 29201/-28, size 6144-2048 line 3155 [ 490.450355] binder: 24175:24185 ioctl c0306201 20000440 returned -14 [ 490.457357] binder: 24187:24188 unknown command 536872064 [ 490.478442] binder: undelivered TRANSACTION_ERROR: 29201 [ 490.494547] binder: 24187:24188 ioctl c0306201 20000440 returned -22 03:36:47 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 03:36:47 executing program 5: 03:36:47 executing program 4: 03:36:47 executing program 2: r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x11) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="000070e574ce360400004a4600"]], 0x0, 0x0, 0x0}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='rdma.current\x00', 0x0, 0x0) ioctl$LOOP_GET_STATUS(r0, 0x4c03, &(0x7f00000000c0)) r2 = add_key$user(&(0x7f0000000180)='user\x00', &(0x7f00000001c0)={'syz', 0x1}, &(0x7f0000000200)="ee5af04b0afa524410e15cf7d61e7e9a8ab5d2bd5c67ec85cbb427c49b37f95179cf0040cd77e6e39a3c1aa155fbb6408d74e708926bcb00fa09ce6dc2529b297cf2812cdc4ada0ca4d3e9924ac682d93f4278", 0x53, 0xfffffffffffffff8) keyctl$KEYCTL_PKEY_VERIFY(0x1c, &(0x7f0000000280)={r2, 0x4d6, 0x5}, &(0x7f0000000340)={'enc=', 'raw', ' hash=', {'sm3\x00'}}, &(0x7f0000000480)="6d5a8540c18af0505928618b680b3b27bc37da4e5eca4372d9428a0945640355b301b9c463bbe4a19d5b6311b0adf7927e1d68425b8a5b9a34556977f9e03fb68c70a2067bd62f2fb0ce6d829f00912cfc8bc1474b1234c2459ee8974709a6", &(0x7f00000002c0)) ioctl$KDGKBSENT(r0, 0x4b48, &(0x7f00000002c0)={0x3dbd6027, 0x7fff}) 03:36:47 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000005f0000000000000000000000000000180000000000000008000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040), 0x4) sched_rr_get_interval(0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') 03:36:47 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$sock_SIOCINQ(r1, 0x541b, &(0x7f0000000140)) write$binfmt_elf64(r0, &(0x7f00000004c0)={{0x7f, 0x45, 0x4c, 0x46, 0x8, 0x6, 0x6c, 0x2, 0x393d, 0x2, 0x3, 0x4, 0x31b, 0x40, 0x30f, 0x40, 0x5, 0x38, 0x1, 0x1c, 0xfffffffffffffff9, 0x4}, [{0x2, 0xe83, 0x5, 0x80000001, 0x7, 0x63, 0x7ff, 0x2}, {0x6474e555, 0x1ff, 0xffff, 0x8, 0x800, 0x6b, 0x4}], "fa1aaf9d4541ce9a05540154e4d796fe94465f60015c5277ff20241f237359853580a40021a4bafa178fabf01088f939bb373ebef10164bc52f4b9ed9718", [[], []]}, 0x2ee) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="0098"]], 0x0, 0x0, 0x0}) ppoll(&(0x7f0000000040)=[{r0, 0x1670}, {r1}, {r1, 0xc004}], 0x3, &(0x7f0000000080)={0x77359400}, &(0x7f00000000c0), 0x8) 03:36:47 executing program 5: 03:36:47 executing program 4: [ 490.547734] binder: release 24162:24167 transaction 1096 out, still active [ 490.583751] binder: 24199:24202 ioctl c018620b 0 returned -14 03:36:47 executing program 4: [ 490.592536] binder: 24203:24205 ioctl c018620b 0 returned -14 [ 490.609767] binder: 24200:24204 unknown command 536872064 [ 490.624156] binder: 24200:24204 ioctl c0306201 20000440 returned -22 [ 490.633536] binder: 24200:24211 unknown command 536872064 03:36:47 executing program 5: 03:36:47 executing program 4: [ 490.644604] binder: 24198:24210 unknown command 536870912 [ 490.651448] binder: 24198:24210 ioctl c0306201 20000440 returned -22 [ 490.652672] binder: 24203:24213 BC_ACQUIRE_DONE u0000000000000000 no match [ 490.668958] binder: 24198:24215 unknown command 536870912 [ 490.675103] binder: 24200:24211 ioctl c0306201 20000440 returned -22 [ 490.689939] binder_alloc: 3591: binder_alloc_buf size 8192 failed, no address space 03:36:47 executing program 5: [ 490.706093] binder: 24198:24215 ioctl c0306201 20000440 returned -22 [ 490.737396] binder_alloc: allocated: 6688 (num: 218 largest: 32), free: 5600 (num: 1 largest: 5600) [ 490.765595] binder: 24199:24216 transaction failed 29201/-28, size 6144-2048 line 3155 [ 490.787088] binder: 24199:24216 ioctl c0306201 20000440 returned -14 03:36:48 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 03:36:48 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x7, 0x40) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="09bf"]], 0x0, 0x0, 0x0}) setxattr$security_evm(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='security.evm\x00', &(0x7f00000000c0)=@v1={0x2, "ad8cdb4908877f0c0acf9163bee4062e6b0b2aa8"}, 0x15, 0x3) 03:36:48 executing program 4: 03:36:48 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/status\x00', 0x0, 0x0) write$cgroup_subtree(r1, &(0x7f0000000140)={[{0x2b, 'cpu'}, {0x2f, 'pids'}, {0x2b, 'memory'}, {0x2f, 'io'}, {0x0, 'io'}, {0x2b, 'cpu'}]}, 0x20) sync_file_range(r0, 0x2, 0x3, 0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="10426a9f5dfbd39cfc12d05f203e26c9b35c3c66c57af52b417cbe5141aab848f66ebe88f5c1c8983734ea68868f914fdf00486a61be8fbcdeb62e45d68701033f2eaaa9cf46be6e01e6af7e5fe20c24ca47955d76a1ac7aa61005d02f3fe45f827cc7d7fd95005e276e04f139f5fad24b8e39e66899dcd203fba8fd1a49f27f112ee5cd5eb475c43aa4fb9dba0d51d22d8211848d9e7920f5882713634d955f137f0b"]], 0x0, 0x0, 0x0}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='rdma.current\x00', 0x0, 0x0) [ 491.375938] binder: 24199:24202 ioctl c0306201 20000140 returned -14 [ 491.383355] binder: undelivered TRANSACTION_ERROR: 29201 03:36:48 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000005f0000000000000000000000000000180000000000000008000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040), 0x4) sched_rr_get_interval(0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') 03:36:48 executing program 5: 03:36:48 executing program 4: [ 491.428845] binder: 24229:24232 unknown command 536872064 [ 491.440270] binder: 24229:24232 ioctl c0306201 20000440 returned -22 [ 491.447453] binder: 24231:24236 unknown command 536871040 [ 491.464410] binder: 24231:24236 ioctl c0306201 20000440 returned -22 [ 491.464847] binder: 24235:24237 ioctl c018620b 0 returned -14 03:36:48 executing program 4: 03:36:48 executing program 5: 03:36:48 executing program 4: [ 491.493126] binder: 24241:24243 ioctl c018620b 0 returned -14 [ 491.493405] binder: 24229:24242 unknown command 536872064 [ 491.507692] binder: 24231:24236 unknown command 536871040 [ 491.518845] binder: 24229:24242 ioctl c0306201 20000440 returned -22 [ 491.525627] binder: 24231:24236 ioctl c0306201 20000440 returned -22 03:36:48 executing program 5: 03:36:48 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x1) ioctl$sock_inet_SIOCDARP(r1, 0x8953, &(0x7f0000000040)={{0x2, 0x4e23, @loopback}, {0x307, @local}, 0xe, {0x2, 0x4e24, @multicast2}, 'team_slave_0\x00'}) ioctl$SNDRV_TIMER_IOCTL_START(r1, 0x54a0) [ 491.541965] binder: 24235:24249 BC_ACQUIRE_DONE u0000000000000000 no match [ 491.560379] binder_alloc: 3591: binder_alloc_buf size 8192 failed, no address space [ 491.568322] binder_alloc: allocated: 6688 (num: 218 largest: 32), free: 5600 (num: 1 largest: 5600) [ 491.616787] binder: 24241:24251 transaction failed 29201/-28, size 6144-2048 line 3155 [ 491.644231] binder: 24241:24251 ioctl c0306201 20000440 returned -14 [ 491.659248] binder: 24258:24261 unknown command 536872064 [ 491.665419] binder: 24258:24261 ioctl c0306201 20000440 returned -22 [ 491.676108] binder: 24258:24261 unknown command 536872064 [ 491.683410] binder: 24258:24261 ioctl c0306201 20000440 returned -22 03:36:49 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 03:36:49 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000180)=ANY=[@ANYBLOB="3693e11dd06801c7db9b83b767edb675f95515b18b36bb7e0117528ccf025cc513f3fed557c88c70ef4c591a8e5fb3e080bf6d3f164a2f15839e41e9ab42"]], 0x0, 0x0, 0x0}) clock_nanosleep(0x3, 0x0, &(0x7f00000001c0)={0x77359400}, &(0x7f0000000200)) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$int_out(r0, 0x2, &(0x7f0000000240)) getsockname$inet(r1, &(0x7f0000000100)={0x2, 0x0, @broadcast}, &(0x7f0000000140)=0x10) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='cpuset\x00') ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f00000000c0)={0x8, 0x6, 0x1, r2}) ioctl$sock_inet_SIOCGIFPFLAGS(r1, 0x8935, &(0x7f0000000280)={'veth1_to_bond\x00', 0x6}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='rdma.current\x00', 0x0, 0x0) 03:36:49 executing program 4: 03:36:49 executing program 5: 03:36:49 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000005f0000000000000000000000000000180000000000000008000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040), 0x4) sched_rr_get_interval(0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') 03:36:49 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xffffff4c, 0x0, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0}) 03:36:49 executing program 4: [ 492.279905] binder: 24241:24243 ioctl c0306201 20000140 returned -14 [ 492.295740] binder: 24271:24273 ioctl c018620b 0 returned -14 [ 492.298787] binder: undelivered TRANSACTION_ERROR: 29201 [ 492.311931] binder: 24266:24269 unknown command 536871296 03:36:49 executing program 5: [ 492.327303] binder: 24266:24269 ioctl c0306201 20000440 returned -22 [ 492.345159] binder: 24271:24273 BC_ACQUIRE_DONE u0000000000000000 no match [ 492.346646] binder: 24277:24281 ioctl c018620b 0 returned -14 [ 492.361246] binder: 24266:24278 unknown command 536871296 [ 492.363733] binder: 24274:24279 unknown command 0 03:36:49 executing program 4: 03:36:49 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 492.376485] binder: 24266:24278 ioctl c0306201 20000440 returned -22 [ 492.386218] binder: 24274:24279 ioctl c0306201 20000440 returned -22 03:36:49 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCADDRT(r0, 0x890c, &(0x7f0000000080)={0x750, {}, {0x2, 0x0, @remote}, {0x2, 0x0, @loopback}, 0x45, 0x8, 0x5, 0x46a, 0x3}) 03:36:49 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f000002c000)='./file0\x00', &(0x7f0000000040)='ramfs\x00', 0x0, 0x0) mount(&(0x7f0000000000), &(0x7f00000000c0)='.', 0x0, 0x3080, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='debugfs\x006B\x88\xdeXQ7~yS\x98\x9dj 8\bF\xeehAn\xb2`\x02\x03\x87<\x8c\x8eS\xae[\xc3\xa4>\xb0\xf8\xdeRHwI\x83\x8c\xa7\xb4\xdb\xed1\xf2Mz\x89\xba-\x00\xd7S\a\xf5\xd8\x01\xbc\x1dG#^\xa8EMw\x86\x04\x00\xd2\xa6\xaao+\x9a\xd1\x11\xe8<\xf7\xfe\xde\xef\xaaLem\x83', 0x0, 0x0) 03:36:49 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/avc/cache_stats\x00', 0x0, 0x0) epoll_wait(r1, &(0x7f00000000c0)=[{}], 0x1, 0x3) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) socket$inet6(0xa, 0xe, 0xa45) openat$cgroup_ro(r1, &(0x7f0000000180)='rdma.current\x00', 0x0, 0x0) [ 492.432758] binder_alloc: 3591: binder_alloc_buf size 8192 failed, no address space 03:36:49 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="ffff0f0000000000007708bb"]], 0x0, 0x0, 0x0}) [ 492.481496] binder: 24288:24292 ioctl c018620b 0 returned -14 [ 492.496244] binder_alloc: allocated: 6688 (num: 218 largest: 32), free: 5600 (num: 1 largest: 5600) 03:36:49 executing program 5: socket$unix(0x1, 0x1, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) 03:36:49 executing program 4: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x2400, 0x0) ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, 0x0) perf_event_open(&(0x7f00000000c0)={0x5, 0x70, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0, 0x1}, 0x0, 0x0, 0x0, 0xb}, 0x0, 0x0, 0xffffffffffffffff, 0x3) [ 492.527859] binder: 24297:24302 unknown command 536871488 [ 492.535232] binder: 24277:24289 transaction failed 29201/-28, size 6144-2048 line 3155 [ 492.543756] binder: 24297:24302 ioctl c0306201 20000440 returned -22 [ 492.557905] binder: 24277:24289 ioctl c0306201 20000440 returned -14 [ 492.560577] binder: 24300:24304 unknown command 536870912 [ 492.572525] binder: 24288:24307 BC_ACQUIRE_DONE node 1104 has no pending acquire request [ 492.581343] binder: 24300:24304 ioctl c0306201 20000440 returned -22 [ 492.588344] binder: 24297:24302 unknown command 536871488 [ 492.594237] binder: 24297:24302 ioctl c0306201 20000440 returned -22 [ 492.604471] binder: 24300:24304 unknown command 536870912 [ 492.611535] binder: 24300:24304 ioctl c0306201 20000440 returned -22 [ 492.651832] binder: BINDER_SET_CONTEXT_MGR already set [ 492.657733] binder: 24308:24310 ioctl 40046207 0 returned -16 [ 492.711136] binder: 24308:24312 BC_INCREFS_DONE node 1107 has no pending increfs request [ 492.720115] binder: 24308:24312 Release 1 refcount change on invalid ref 1 ret -22 03:36:50 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000005f0000000000000000000000000000180000000000000008000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040), 0x4) sched_rr_get_interval(0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') 03:36:50 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) eventfd2(0x1d, 0x800) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='rdma.current\x00', 0x0, 0x0) 03:36:50 executing program 0: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="62aff7e2307fb2025e74"]], 0x0, 0x0, 0x0}) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000040)={{{@in=@local, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}}}, &(0x7f0000000140)=0xe8) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000180)={{{@in6=@mcast1, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in=@empty}}, &(0x7f0000000280)=0xe8) r3 = fcntl$dupfd(0xffffffffffffff9c, 0x0, 0xffffffffffffff9c) recvfrom(r3, &(0x7f00000002c0)=""/21, 0x15, 0x2, &(0x7f0000000340)=@can={0x1d, r1}, 0x80) setreuid(r0, r2) ioctl$ION_IOC_ALLOC(r3, 0xc0184900, &(0x7f00000003c0)={0x6d3, 0x10, 0x1, r3}) 03:36:50 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'veth1_to_bridge\x00', 0x0}) ioctl$sock_inet6_SIOCADDRT(r1, 0x890b, &(0x7f00000002c0)={@local, @loopback, @rand_addr="fe3e59b0b053503d84c7647cca06b71f", 0x2, 0x0, 0x0, 0x0, 0x3ff, 0x4000ce, r2}) [ 493.146303] binder: 24277:24281 ioctl c0306201 20000140 returned -14 [ 493.154030] binder: undelivered TRANSACTION_ERROR: 29201 [ 493.185997] binder: 24319:24325 unknown command 536871488 03:36:50 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_proto_private(r1, 0x89e7, &(0x7f00000000c0)="2e6ff1409299375ae7a4ce5186fb928152ac0526d2f4ef7be3f7d94f891a37a5abec32fd484696acfaf35837c24feebc6b9c87b0bafea30939ba1e53") pipe2(&(0x7f0000000080)={0xffffffffffffffff}, 0x0) ioctl$BLKREPORTZONE(r2, 0xc0101282, &(0x7f0000000480)=ANY=[@ANYBLOB="0400000000000000070000000000000000000000000000000900000000000000040000000000000001030001000000000000000000000000000000000000000000000000000000000024fc0000000000ff0f006700000000060000000000000003000000000000000908b609000000000000000000000000000000000000000000000000000000000000000100000000000000ec070000000000000100010000000000c300fa710000000000000000000000000000000000000000000000000000000000000000000000000b030000000000000500000000000000010000000000000001cbe623000000000000000000000000000000000000000000000000000000000000000000000000070000000000000006000000000000008e0000000006ff05050000000000000000000000000300000000000000000000000000000062ce495644000000000000000006000000000000000200000000000000050000000000000009ff610200000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000010903020004000000000000000000000000000000000000000000000000000000000000000000008135e22464cc1b578823cb44d58ed63cb2bc1ee1ce335354f6c4277d3494a9cf91c10000000000"]) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x381, 0x0, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0}) r3 = dup2(r2, r0) setsockopt$IP_VS_SO_SET_FLUSH(r3, 0x0, 0x485, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='rdma.current\x00', 0x0, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000000), 0x4) [ 493.193452] binder: 24319:24325 ioctl c0306201 20000440 returned -22 [ 493.201871] binder: 24319:24325 unknown command 536871488 [ 493.207726] binder: 24323:24328 ioctl c018620b 0 returned -14 [ 493.215208] binder: 24319:24325 ioctl c0306201 20000440 returned -22 03:36:50 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 03:36:50 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@increfs={0x40046304, 0x1}], 0xba, 0x0, &(0x7f0000000040)="f5e2f26ba48ab60b8f23510429ea69fccbed8a929283f74de75f55d5f2adbd3e9a7c09da026d2cf643c2a9b75ba277370cd3cec719541b995be80d0670e7f265a491952c1827c7a7bdd28d5d18285bf7275020a75a806a3a96f323addd0b8c343c11db88521aacd84b2c1c40fc4468086a29b96e95b2161ef0c43254f3b4287c9ac49c677e0296e830eb46f08bbf39754563f7eddc7cd6cc7c646a4973890c31715dcdf4ca63332de4e5888ff38f78bbca9115fa31ee949820bb"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) 03:36:50 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9a9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='map_files\x00') keyctl$invalidate(0x15, 0x0) getdents64(r0, &(0x7f0000000200)=""/116, 0x184) [ 493.268250] binder: release 24288:24292 transaction 1103 out, still active [ 493.281340] binder: 24334:24338 ioctl c018620b 0 returned -14 [ 493.282609] binder: unexpected work type, 4, not freed [ 493.294818] binder_alloc: 3591: binder_alloc_buf size 8192 failed, no address space [ 493.295392] binder: 24334:24338 unknown command 0 [ 493.305767] binder_alloc: allocated: 6752 (num: 220 largest: 32), free: 5536 (num: 1 largest: 5536) [ 493.321007] binder: undelivered TRANSACTION_COMPLETE [ 493.325244] binder: 24334:24338 ioctl c0306201 20000440 returned -22 [ 493.340865] binder: 24323:24339 transaction failed 29201/-28, size 6144-2048 line 3155 [ 493.350510] binder: 24343:24347 IncRefs 0 refcount change on invalid ref 1 ret -22 [ 493.362076] binder: 24323:24339 ioctl c0306201 20000440 returned -14 03:36:50 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x2a, 0x0, 0x78) [ 493.365346] binder: 24343:24347 unknown command 536872064 [ 493.379845] binder: 24334:24338 ioctl c018620b 0 returned -14 [ 493.379882] binder: 24345:24351 ioctl c018620b 0 returned -14 [ 493.392490] binder: 24334:24350 unknown command 0 [ 493.392948] binder: 24343:24347 ioctl c0306201 20000440 returned -22 [ 493.397559] binder: 24334:24350 ioctl c0306201 20000440 returned -22 03:36:50 executing program 4: r0 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'veth0\x00', 0x0}) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r2, 0x8916, &(0x7f00000001c0)={@ipv4={[], [], @multicast1}, 0x0, r1}) [ 493.422688] binder: BINDER_SET_CONTEXT_MGR already set [ 493.430015] binder: 24308:24355 ioctl 40046207 0 returned -16 [ 493.453705] binder: 24343:24347 IncRefs 0 refcount change on invalid ref 1 ret -22 [ 493.462960] binder: release 24308:24312 transaction 1113 out, still active 03:36:50 executing program 5: socket$unix(0x1, 0x1, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) 03:36:50 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) r1 = creat(&(0x7f0000000040)='./file0\x00', 0x48) inotify_add_watch(r1, &(0x7f0000000240)='./file0\x00', 0x105) r2 = add_key$keyring(&(0x7f00000000c0)='keyring\x00', &(0x7f0000000100)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffe) r3 = request_key(&(0x7f0000000140)='.dead\x00', &(0x7f0000000180)={'syz', 0x0}, &(0x7f00000001c0)='/dev/binder#\x00', 0x0) keyctl$instantiate(0xc, r2, 0x0, 0x0, r3) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x14, 0x0, &(0x7f0000000000)=ANY=[@ANYRESDEC=0x0], 0x0, 0x0, 0x0}) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000200)='rdma.current\x00', 0x0, 0x0) ioctl$sock_inet_udp_SIOCOUTQ(r4, 0x5411, &(0x7f0000000080)) [ 493.477836] binder: release 24308:24310 transaction 1106 out, still active [ 493.477906] binder: 24345:24364 BC_ACQUIRE_DONE node 1111 has no pending acquire request [ 493.490074] binder: 24343:24360 unknown command 536872064 [ 493.507701] binder: unexpected work type, 4, not freed [ 493.517508] binder: 24343:24360 ioctl c0306201 20000440 returned -22 [ 493.526460] binder: undelivered TRANSACTION_COMPLETE [ 493.532956] binder: 24367:24369 ioctl c018620b 0 returned -14 [ 493.555244] binder: 24367:24369 unknown command 808464432 [ 493.562262] binder: 24367:24369 ioctl c0306201 20000440 returned -22 [ 493.571031] binder: 24367:24369 ioctl c018620b 0 returned -14 [ 493.580964] binder: 24367:24374 unknown command 808464432 [ 493.587573] binder: 24367:24374 ioctl c0306201 20000440 returned -22 [ 493.640612] binder: BINDER_SET_CONTEXT_MGR already set [ 493.646914] binder: 24370:24372 ioctl 40046207 0 returned -16 [ 493.704112] binder: 24370:24377 BC_INCREFS_DONE node 1117 has no pending increfs request [ 493.715842] binder: 24370:24377 Release 1 refcount change on invalid ref 1 ret -22 03:36:50 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000005f0000000000000000000000000000180000000000000008000000000000", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040), 0x4) sched_rr_get_interval(0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') 03:36:50 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$selinux_create(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/create\x00', 0x2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) 03:36:50 executing program 4: socket$inet(0x10, 0x3, 0x0) ioctl$VT_WAITACTIVE(0xffffffffffffffff, 0x5607) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x82) add_key$keyring(&(0x7f0000000180)='keyring\x00', 0x0, 0x0, 0x0, 0xfffffffffffffffc) r2 = memfd_create(&(0x7f0000000100)='t\bnu\x00\x00\x00\x00\x85nG\x13g\xa6\x05', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) sendfile(r1, r1, &(0x7f00000001c0), 0x20002000005) ioctl$LOOP_CLR_FD(r1, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, 0xffffffffffffffff) socketpair$unix(0x1, 0x0, 0x0, 0x0) openat$pfkey(0xffffffffffffff9c, 0x0, 0xbfffe, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(0xffffffffffffffff, 0xc0145401, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) r3 = perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_REFRESH(r0, 0x2402, 0x6946) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(0xffffffffffffffff, 0x2405, 0xffffffffffffffff) write(0xffffffffffffffff, &(0x7f00000001c0), 0x7ba27d3a) 03:36:50 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0xfffffffffffffd2b, 0x0, &(0x7f0000000080)=ANY=[@ANYPTR], 0x0, 0x0, 0x0}) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/rtc0\x00', 0x40000, 0x0) ioctl$TUNSETVNETLE(r1, 0x400454dc, &(0x7f0000000180)) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='rdma.current\x00', 0x0, 0x0) ioctl$KDSKBSENT(r1, 0x4b49, &(0x7f0000000140)="e377affc07be55aac2e8") [ 493.994676] binder: 24323:24328 ioctl c0306201 20000140 returned -14 [ 494.001434] binder: undelivered TRANSACTION_ERROR: 29201 [ 494.032743] binder: 24380:24386 ioctl c018620b 0 returned -14 03:36:50 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = open(&(0x7f0000000100)='./file0\x00', 0x281, 0x4) write$P9_RSETATTR(r1, &(0x7f0000000140)={0x7, 0x1b, 0x2}, 0x7) r2 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$EVIOCSABS0(r2, 0x401845c0, &(0x7f00000000c0)={0xfffffffffffffffc, 0x3ff, 0x5, 0x6, 0x40}) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB="000000ee99000000"]], 0x0, 0x0, 0x0}) fcntl$F_GET_FILE_RW_HINT(r0, 0x40d, &(0x7f0000000000)) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='rdma.current\x00', 0x0, 0x0) [ 494.039641] binder: 24381:24384 unknown command 536872064 [ 494.050934] binder: 24381:24384 ioctl c0306201 20000440 returned -22 [ 494.067817] binder: 24381:24391 unknown command 536872064 [ 494.077114] binder: 24381:24391 ioctl c0306201 20000440 returned -22 [ 494.089019] binder: 24389:24394 unknown command 536871488 [ 494.093253] binder_alloc: 3591: binder_alloc_buf size 8192 failed, no address space [ 494.096399] binder: 24389:24394 ioctl c0306201 20000440 returned -22 [ 494.109628] binder_alloc: allocated: 6848 (num: 223 largest: 32), free: 5440 (num: 1 largest: 5440) [ 494.122628] binder: 24389:24396 unknown command 536871488 [ 494.129244] binder: 24380:24395 transaction failed 29201/-28, size 6144-2048 line 3155 [ 494.130927] binder: 24389:24396 ioctl c0306201 20000440 returned -22 03:36:51 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 03:36:51 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x20000, 0x0) openat$cgroup(r1, &(0x7f0000000040)='syz1\x00', 0x200002, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) 03:36:51 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR64], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='rdma.current\x00', 0x0, 0x0) r2 = syz_genetlink_get_family_id$fou(&(0x7f00000000c0)='fou\x00') sendmsg$FOU_CMD_ADD(r1, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="24010007427b0cdf811d64870af88c5d82af2a7047040000d7ba41ba4503c7421843cf2505884e87735fc35f7c5f43fb010d8686ed43ea7edc30965b75ab955363fa7dcae9e2215e0a00632635d8ed6c", @ANYRES16=r2, @ANYBLOB="000325bd7000fddbdf2501000000080003002f0000000800020002000000"], 0x24}, 0x1, 0x0, 0x0, 0x4}, 0x44000) [ 494.158688] binder: 24380:24395 ioctl c0306201 20000440 returned -14 [ 494.169112] binder: release 24345:24351 transaction 1110 out, still active [ 494.189801] binder: unexpected work type, 4, not freed [ 494.202141] binder: undelivered TRANSACTION_COMPLETE [ 494.208368] binder: 24401:24403 unknown command 536872064 [ 494.215080] binder: 24401:24403 ioctl c0306201 20000440 returned -22 [ 494.231131] binder: 24402:24404 unknown command 0 [ 494.237324] binder: 24402:24404 ioctl c0306201 20000440 returned -22 [ 494.250963] binder: 24407:24409 ioctl c018620b 0 returned -14 03:36:51 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) sendfile(r0, r0, 0x0, 0x800007) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000040)=0x1, 0x4) [ 494.257252] binder: 24401:24403 unknown command 536872064 [ 494.264069] binder: 24401:24403 ioctl c0306201 20000440 returned -22 [ 494.289773] binder: 24402:24414 unknown command 0 [ 494.295639] binder: 24402:24414 ioctl c0306201 20000440 returned -22 03:36:51 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB="000000d2fc971f9c"]], 0x0, 0x0, 0x0}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='rdma.current\x00', 0x0, 0x0) read(r0, &(0x7f0000000000)=""/8, 0x8) [ 494.327985] binder: 24407:24419 BC_ACQUIRE_DONE node 1121 has no pending acquire request [ 494.334148] binder: 24417:24420 unknown command 536872064 [ 494.342630] binder: 24417:24420 ioctl c0306201 20000440 returned -22 [ 494.351392] binder: 24417:24420 unknown command 536872064 [ 494.370123] binder: release 24370:24372 transaction 1116 out, still active 03:36:51 executing program 5: socket$unix(0x1, 0x1, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) 03:36:51 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000480)='/dev/loop#\x00', 0x0, 0x0) r1 = memfd_create(&(0x7f0000000280)='\x00', 0x0) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) ioctl$LOOP_SET_STATUS64(r0, 0x4c04, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x552f, 0x0, 0x0, 0x0, 0x0, "7001e0f57c8cf6270b24e415e96042aae51d871554c11cd59cc8fb47081025bad6b39d778066f9d1ac8a570e3a42f70a7c0f30f66157a96aae15813f0dceb297", "a8a4cd01e527e6fd3de45387daf7b1ac786d0e8a75e8904655361fe06f308fe6033a61edb75c8d51c055faf7f4fdb16e0cdaa4276939a341033400", "2f18ffffffffffff4116893616105829576914e70bfeb59800f97c97644ab8a7"}) sendmsg$FOU_CMD_GET(0xffffffffffffffff, 0x0, 0x1) [ 494.377202] binder: unexpected work type, 4, not freed [ 494.384561] binder: 24417:24420 ioctl c0306201 20000440 returned -22 [ 494.403932] binder: undelivered TRANSACTION_COMPLETE [ 494.449348] binder: 24424:24432 unknown command 536871488 [ 494.459694] binder: 24424:24432 ioctl c0306201 20000440 returned -22 [ 494.479388] binder: 24424:24438 unknown command 536871488 [ 494.488458] binder: 24424:24438 ioctl c0306201 20000440 returned -22 [ 494.505379] binder: BINDER_SET_CONTEXT_MGR already set [ 494.511331] binder: 24427:24431 ioctl 40046207 0 returned -16 [ 494.575500] binder: 24427:24437 BC_INCREFS_DONE node 1124 has no pending increfs request [ 494.590898] binder: 24427:24437 Release 1 refcount change on invalid ref 1 ret -22 03:36:51 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000005f0000000000000000000000000000180000000000000008000000000000", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040), 0x4) sched_rr_get_interval(0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') 03:36:51 executing program 0: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x802) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x0, 0x0) ioctl$RTC_UIE_ON(r1, 0x7003) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) 03:36:51 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB="0000040020000000"]], 0x0, 0x0, 0x0}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='rdma.current\x00', 0x0, 0x0) 03:36:51 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r2) r3 = gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000540)={r3, r1, 0x0, 0x0, 0x0}, 0x30) [ 494.831003] binder: 24380:24386 ioctl c0306201 20000140 returned -14 [ 494.837841] binder: undelivered TRANSACTION_ERROR: 29201 [ 494.863854] binder: 24443:24446 unknown command 536872064 [ 494.869455] binder: 24443:24446 ioctl c0306201 20000440 returned -22 03:36:51 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r2) r3 = gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000540)={r3, r1, 0x0, 0x0, 0x0}, 0x30) [ 494.883446] binder: 24444:24449 unknown command 536871488 [ 494.887796] binder: 24450:24451 ioctl c018620b 0 returned -14 [ 494.890507] binder: 24444:24449 ioctl c0306201 20000440 returned -22 [ 494.908305] binder: 24443:24454 unknown command 536872064 [ 494.913988] binder: 24443:24454 ioctl c0306201 20000440 returned -22 [ 494.925665] binder: 24444:24449 unknown command 536871488 [ 494.933807] binder: 24444:24449 ioctl c0306201 20000440 returned -22 [ 494.946167] binder_alloc: 3591: binder_alloc_buf size 8192 failed, no address space [ 494.954939] binder_alloc: allocated: 6912 (num: 225 largest: 32), free: 5376 (num: 1 largest: 5376) [ 494.965465] binder: 24450:24458 transaction failed 29201/-28, size 6144-2048 line 3155 03:36:51 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 03:36:51 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) getgroups(0x5, &(0x7f0000000000)=[0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0]) r2 = getgid() r3 = getegid() setresgid(r1, r2, r3) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB='\x00\x00']], 0x0, 0x0, 0x0}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) syz_execute_func(&(0x7f0000000040)="2ed9f9c462319bc3660f5e7efc440f00a427a0b30000c4c38d7c1cca06c4a205bd8283410000c4627d59f1ab3665660f1bc8c441d9deba00100000") fsetxattr$trusted_overlay_opaque(r4, &(0x7f00000000c0)='trusted.overlay.opaque\x00', &(0x7f0000000100)='y\x00', 0x2, 0x3) flock(r0, 0xe) 03:36:51 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='rdma.current\x00', 0x0, 0x0) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r0, 0x660c) 03:36:51 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r0, 0x89a1, &(0x7f0000000580)={@local={0xfe, 0x80, [0x600, 0x3ef, 0x0, 0x3f00000000000000, 0x100000000000000, 0x0, 0x1103, 0x0, 0x0, 0x0, 0x0, 0x6]}}) [ 495.050418] binder: release 24407:24409 transaction 1120 out, still active [ 495.057748] binder: unexpected work type, 4, not freed [ 495.072157] binder: undelivered TRANSACTION_COMPLETE [ 495.089581] binder: 24465:24472 unknown command 536871488 [ 495.090331] binder: 24464:24470 unknown command 536872064 03:36:51 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="20af"]], 0x0, 0x0, 0x0}) [ 495.095552] binder: 24465:24472 ioctl c0306201 20000440 returned -22 [ 495.105959] binder: 24464:24470 ioctl c0306201 20000440 returned -22 [ 495.111834] binder: 24465:24472 ioctl 660c 0 returned -22 [ 495.123119] binder: 24465:24474 unknown command 536871488 [ 495.133347] binder: 24465:24474 ioctl c0306201 20000440 returned -22 [ 495.142508] binder: 24466:24476 BC_ACQUIRE_DONE node 1128 has no pending acquire request 03:36:52 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x9) 03:36:52 executing program 4: setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'\x00\x00\x00\x00\x00\x00 \xf5\x00'}) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind(r0, &(0x7f0000000180)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e20, @local}, 0x3, 0x1, 0x3}}, 0x80) setsockopt$sock_int(r0, 0x1, 0x14, &(0x7f0000000040), 0x50) [ 495.151296] binder: 24465:24474 ioctl 660c 0 returned -22 [ 495.168159] binder: 24477:24478 unknown command 536872064 [ 495.177892] binder: 24477:24478 ioctl c0306201 20000440 returned -22 [ 495.236614] sock: sock_set_timeout: `syz-executor.4' (pid 24483) tries to set negative timeout [ 495.236742] binder: release 24427:24431 transaction 1123 out, still active [ 495.259269] sock: sock_set_timeout: `syz-executor.4' (pid 24486) tries to set negative timeout [ 495.268426] binder: unexpected work type, 4, not freed [ 495.274502] binder: undelivered TRANSACTION_COMPLETE 03:36:52 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000005f0000000000000000000000000000180000000000000008000000000000", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040), 0x4) sched_rr_get_interval(0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') 03:36:52 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) prctl$PR_MCE_KILL(0x21, 0x0, 0x1) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/policy\x00', 0x0, 0x0) ioctl$EVIOCSABS0(r1, 0x401845c0, &(0x7f00000000c0)={0x2, 0x2d, 0xfffffffffffffffa, 0xffffffffffffff00, 0x2, 0x80}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="00000000000020ea5cb1cdd4403b430c918f1595620d95a92a3b03a513d0cffb4841442c3f9da89790363ba36fec936fe68bfc4708b4d56a5aef50ae370d0d5f4b"]], 0x0, 0x0, 0x0}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='rdma.current\x00', 0x0, 0x0) 03:36:52 executing program 0: r0 = accept4$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev}, &(0x7f0000000080)=0x1c, 0x80800) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f00000000c0)=0x40, 0x4) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300)=ANY=[], 0xffffffffffffff32, 0x0, 0x0}) syz_execute_func(&(0x7f0000000000)="42744036664575a367f7c90a00000080bcbe0000802073c4e22992b491715ea0cc2edf6fd1440f0d16c4a29196e9c4029992141c65660f73f00d") 03:36:52 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) 03:36:52 executing program 5: syz_mount_image$f2fs(&(0x7f0000000080)='f2fs\x00', &(0x7f0000000340)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f00000000c0)="1020f5f20100070009000000030000000c0000000900000001000000020000000000000000300000000000000e00000016", 0x31, 0x1400}], 0x0, 0x0) [ 495.684510] binder: 24450:24451 ioctl c0306201 20000140 returned -14 [ 495.691355] binder: undelivered TRANSACTION_ERROR: 29201 [ 495.749229] F2FS-fs (loop5): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 495.757965] binder: 24492:24500 ioctl c0306201 20000440 returned -14 [ 495.758706] binder: 24496:24502 ioctl c018620b 0 returned -14 [ 495.768704] binder: 24491:24497 unknown command 536871168 [ 495.774943] F2FS-fs (loop5): Can't find valid F2FS filesystem in 1th superblock [ 495.786836] F2FS-fs (loop5): Invalid Fs Meta Ino: node(0) meta(0) root(0) [ 495.793041] binder: 24491:24497 ioctl c0306201 20000440 returned -22 [ 495.794656] F2FS-fs (loop5): Can't find valid F2FS filesystem in 2th superblock [ 495.808867] F2FS-fs (loop5): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 495.816238] F2FS-fs (loop5): Can't find valid F2FS filesystem in 1th superblock [ 495.824753] F2FS-fs (loop5): Invalid Fs Meta Ino: node(0) meta(0) root(0) [ 495.832499] F2FS-fs (loop5): Can't find valid F2FS filesystem in 2th superblock [ 495.834130] binder_alloc: 3591: binder_alloc_buf size 8192 failed, no address space [ 495.849097] binder_alloc: allocated: 6944 (num: 226 largest: 32), free: 5344 (num: 1 largest: 5344) [ 495.858716] binder: 24496:24507 transaction failed 29201/-28, size 6144-2048 line 3155 03:36:52 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 03:36:52 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x0, 0x0) r1 = socket$packet(0x11, 0x2000000000000003, 0x300) socket$packet(0x11, 0x10000000000000a, 0x300) pipe(0x0) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0x50c7e3e3) r2 = socket$inet6(0xa, 0x2, 0x0) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) connect$inet6(r2, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) getsockopt$IP_VS_SO_GET_TIMEOUT(0xffffffffffffffff, 0x0, 0x486, 0x0, &(0x7f00000001c0)) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) prctl$PR_TASK_PERF_EVENTS_DISABLE(0x1f) r3 = creat(&(0x7f0000000040)='./file0\x00', 0x0) ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x400854d5, &(0x7f0000000140)={0x1, &(0x7f00000000c0)=[{0x2, 0x7, 0x5, 0x1}]}) ioctl$sock_inet_SIOCSIFNETMASK(0xffffffffffffffff, 0x891c, &(0x7f0000000080)={'bcsf0\x00', {0x2, 0x4e21, @empty}}) read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0x50c7e3e3) r4 = add_key(&(0x7f0000000340)='trusted\x00', &(0x7f0000000380)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffff9) keyctl$update(0x2, r4, 0x0, 0x12a) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000640)={'team0\x00'}) io_destroy(0x0) ioctl$GIO_FONT(r3, 0x4b60, &(0x7f00000003c0)=""/159) setsockopt$inet6_tcp_TLS_RX(0xffffffffffffffff, 0x6, 0x2, 0x0, 0x0) io_destroy(0x0) ioctl$RTC_IRQP_SET(r0, 0x4004700c, 0x13b0) syz_open_dev$sndtimer(&(0x7f0000000180)='/dev/snd/timer\x00', 0x0, 0x0) 03:36:52 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="6425bb9cf35f7dd207edd426a76c73ba80560e1edc30a00032883fdb2b18e71e92f16d4b4e1d112c5210e3acaab3c76b653e7b5c564767b8393f280ab959e5b03663a95e5107ac7e6ebbb9d922cfb59470418d3e0586c3b52873b33429b60ae3adf98f7ca0fb74050e666a63b145dac307f3fad2bbe0ce5fee41efd725ba26b4344269b53d3a"]], 0x0, 0x0, 0x0}) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x1, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000100)='net/ip6_flowlabel\x00') setsockopt$EBT_SO_SET_COUNTERS(r2, 0x0, 0x81, &(0x7f00000014c0)={'filter\x00', 0x0, 0x0, 0x0, [], 0x8, &(0x7f0000000140)=[{}, {}, {}], 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, 0xf8) set_robust_list(&(0x7f0000000580), 0x18) r3 = socket$inet6(0xa, 0x2, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000380)='/dev/zero\x00', 0x1c0, 0x0) close(r3) syz_genetlink_get_family_id$SEG6(&(0x7f0000000340)='SEG6\x00') r4 = socket$netlink(0x10, 0x3, 0xa) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000280)={0x0, r2, 0x7, 0x1}, 0x14) r5 = open(&(0x7f00000000c0)='./bus\x00', 0x141042, 0x100) ftruncate(r1, 0x6) sendfile(r3, r5, 0x0, 0x8000fffffffe) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0)='nbd\x00') sendmsg$NBD_CMD_DISCONNECT(r4, 0x0, 0x10) fgetxattr(r0, &(0x7f0000000000)=@known='trusted.overlay.metacopy\x00', &(0x7f00000004c0)=""/4096, 0x1000) 03:36:52 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x20000000802) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='rdma.current\x00', 0x0, 0x0) [ 495.890682] binder: release 24466:24469 transaction 1127 out, still active [ 495.897772] binder: unexpected work type, 4, not freed [ 495.903731] F2FS-fs (loop5): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 495.913282] F2FS-fs (loop5): Can't find valid F2FS filesystem in 1th superblock [ 495.925195] binder: undelivered TRANSACTION_COMPLETE [ 495.935083] F2FS-fs (loop5): Invalid Fs Meta Ino: node(0) meta(0) root(0) [ 495.955485] binder: 24513:24520 unknown command 536871360 [ 495.955736] binder: 24515:24519 unknown command 536871488 [ 495.964668] F2FS-fs (loop5): Can't find valid F2FS filesystem in 2th superblock [ 495.976309] binder: 24513:24520 ioctl c0306201 20000440 returned -22 [ 495.980829] binder: 24515:24519 ioctl c0306201 20000440 returned -22 [ 495.983845] F2FS-fs (loop5): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 496.005170] binder: 24515:24519 unknown command 536871488 [ 496.011823] binder: 24515:24519 ioctl c0306201 20000440 returned -22 03:36:52 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000080)='/dev/zero\x00', 0x10000, 0x0) openat$cgroup_ro(r1, &(0x7f00000000c0)='cpuacct.usage_all\x00', 0x0, 0x0) [ 496.015006] audit: type=1400 audit(2000000212.860:50): avc: denied { create } for pid=24513 comm="syz-executor.0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_fib_lookup_socket permissive=1 [ 496.046595] binder: 24518:24525 BC_ACQUIRE_DONE node 1132 has no pending acquire request [ 496.050528] F2FS-fs (loop5): Can't find valid F2FS filesystem in 1th superblock [ 496.089770] binder: 24527:24529 unknown command 536871488 [ 496.089988] F2FS-fs (loop5): Invalid Fs Meta Ino: node(0) meta(0) root(0) [ 496.103132] binder: 24527:24529 ioctl c0306201 20000440 returned -22 [ 496.104589] audit: type=1400 audit(2000000212.930:51): avc: denied { write } for pid=24513 comm="syz-executor.0" path="socket:[75437]" dev="sockfs" ino=75437 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_fib_lookup_socket permissive=1 [ 496.126060] binder: 24527:24532 unknown command 536871488 [ 496.139345] F2FS-fs (loop5): Can't find valid F2FS filesystem in 2th superblock [ 496.159425] binder: 24513:24520 unknown command 536871360 [ 496.165854] binder: 24513:24520 ioctl c0306201 20000440 returned -22 03:36:53 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="00baa684de57a9ddc98f8e05caaf"]], 0x0, 0x0, 0x0}) r1 = dup2(r0, r0) open(&(0x7f0000000080)='./file0\x00', 0x1, 0x60c7e127e27400ab) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r3 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r3, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) fsetxattr$security_ima(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) fcntl$setpipe(r3, 0x407, 0x0) connect$inet6(r3, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0xb}, 0x1c) syz_emit_ethernet(0x3e, &(0x7f0000000640)={@local, @broadcast, [], {@ipv6={0x86dd, {0x0, 0x6, "50a09c", 0x8, 0xffffff11, 0x0, @remote, @local, {[], @udp={0x0, 0x4e20, 0x8}}}}}}, 0x0) pipe(&(0x7f0000000280)={0xffffffffffffffff}) ioctl$sock_inet_SIOCSIFADDR(r3, 0x8916, &(0x7f00000000c0)={'veth0_to_team\x00', {0x2, 0x4e24, @empty}}) pipe2(&(0x7f0000000180)={0xffffffffffffffff}, 0x84800) write$selinux_attr(r1, &(0x7f0000000100)='system_u:object_r:vmware_device_t:s0\x00', 0x25) ioctl$TIOCLINUX4(r5, 0x541c, &(0x7f0000000140)) ioctl$FIGETBSZ(r4, 0x2, &(0x7f0000000040)) 03:36:53 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x2f) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="054fcff8f1b02fc73cb00040efb7ee236bec6f71a223306865b6ffffb960b10002000000000000fa4b46299e1bc444edcf06002c38fa0a0e42"], 0x39) ptrace$cont(0x18, r1, 0x0, 0x0) ptrace$setregs(0xd, r1, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r1, 0x0, 0x0) [ 496.185460] binder: 24527:24532 ioctl c0306201 20000440 returned -22 [ 496.235487] binder: 24538:24541 unknown command 536870912 [ 496.241291] binder: 24538:24541 ioctl c0306201 20000440 returned -22 [ 496.252975] binder: 24538:24541 unknown command 536870912 [ 496.267837] binder: 24538:24541 ioctl c0306201 20000440 returned -22 [ 496.297994] syz-executor.0 (24541) used greatest stack depth: 23232 bytes left 03:36:53 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000005f0000000000000000000000000000180000000000000008000000000000", @ANYPTR], 0x0, 0x0, &(0x7f00000003c0)}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040), 0x4) sched_rr_get_interval(0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') 03:36:53 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vga_arbiter\x00', 0x40100, 0x0) ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f0000000100)={0x5, &(0x7f00000000c0)=[{}, {}, {}, {}, {}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB="00000000cb89816c"]], 0x0, 0x0, 0x0}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='rdma.current\x00', 0x0, 0x0) 03:36:53 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x400000, 0x0) ioctl$PPPIOCGNPMODE(r1, 0xc008744c, &(0x7f0000000080)={0xc025, 0x1}) ioctl$KDGKBDIACR(r1, 0x4b4a, &(0x7f00000000c0)=""/45) 03:36:53 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0) fchdir(r0) mkdir(&(0x7f0000001340)='./file0\x00', 0x0) open(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) [ 496.539796] binder: 24496:24502 ioctl c0306201 20000140 returned -14 [ 496.547042] binder: undelivered TRANSACTION_ERROR: 29201 03:36:53 executing program 4: socketpair(0x8000000000001e, 0x1, 0x0, &(0x7f000000dff8)={0xffffffffffffffff, 0xffffffffffffffff}) writev(r0, &(0x7f00006c4f60)=[{&(0x7f0000317fa3)="b5", 0x1}], 0x1) clock_gettime(0x0, &(0x7f0000002080)={0x0, 0x0}) recvmmsg(r1, &(0x7f0000001f00)=[{{0x0, 0x0, &(0x7f0000000b40)=[{&(0x7f0000000500)=""/17, 0x11}], 0x1}}], 0x1, 0x10000, &(0x7f00000020c0)={r2, r3+10000000}) [ 496.589777] binder: 24558:24562 unknown command 536871488 [ 496.595204] binder: 24559:24564 ioctl c018620b 0 returned -14 [ 496.602203] binder: 24557:24563 unknown command 536872064 [ 496.608235] binder: 24558:24562 ioctl c0306201 20000440 returned -22 [ 496.616335] binder: 24557:24563 ioctl c0306201 20000440 returned -22 [ 496.626969] binder: 24557:24563 unknown command 536872064 [ 496.632571] binder: 24558:24568 unknown command 536871488 [ 496.632584] binder: 24558:24568 ioctl c0306201 20000440 returned -22 [ 496.654391] binder_alloc: 3591: binder_alloc_buf size 8192 failed, no address space [ 496.668265] binder_alloc: allocated: 6976 (num: 227 largest: 32), free: 5312 (num: 1 largest: 5312) [ 496.669488] binder: 24557:24563 ioctl c0306201 20000440 returned -22 [ 496.686332] binder: 24559:24570 transaction failed 29201/-28, size 6144-2048 line 3155 03:36:53 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 03:36:53 executing program 5: socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, 0x0, 0x400002, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={0xffffffffffffffff, 0x0, 0x0, 0x1}, 0x20) creat(&(0x7f0000000640)='./file0\x00', 0x0) unlink(&(0x7f0000000940)='./file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0), 0x47, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff"}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) 03:36:53 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FIBMAP(r0, 0x1, &(0x7f0000000080)=0xffffffff7fffffff) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB="00004900bf010000"]], 0x0, 0x0, 0x0}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='rdma.current\x00', 0x0, 0x0) finit_module(r0, &(0x7f0000000000)='\x00', 0x2) 03:36:53 executing program 0: r0 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$sock_inet_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000040)={'bond0\x00', {0x2, 0x4e20, @broadcast}}) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="0500"]], 0x0, 0x0, 0x0}) 03:36:53 executing program 4: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setresuid(0x0, 0x0, 0x0) r1 = socket$inet(0x2, 0x1, 0x0) ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000100)) bind$inet(0xffffffffffffffff, 0x0, 0x0) [ 496.768039] binder: release 24518:24522 transaction 1131 out, still active [ 496.781369] binder: unexpected work type, 4, not freed [ 496.797543] binder: undelivered TRANSACTION_COMPLETE [ 496.807472] binder: 24585:24589 unknown command 536872064 03:36:53 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f319bc070") socket$packet(0x11, 0x2, 0x300) socket$inet_udp(0x2, 0x2, 0x0) syz_emit_ethernet(0xfc5d, &(0x7f00000001c0)={@local, @dev, [], {@ipv4={0x800, {{0xffffff89, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x0, 0x0, @dev, @remote={0xac, 0x14, 0x223}, {[@rr={0x7, 0xb, 0x4, [@loopback]}]}}, @icmp=@timestamp_reply}}}}, &(0x7f0000000100)) [ 496.817534] binder: 24584:24590 ioctl 1 20000080 returned -22 [ 496.825490] binder: 24585:24589 ioctl c0306201 20000440 returned -22 [ 496.832853] binder: 24584:24590 ioctl c018620b 0 returned -14 03:36:53 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000500)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) r1 = fcntl$dupfd(r0, 0x406, r0) getsockname$packet(0xffffffffffffff9c, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000380)=0x14) ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f00000003c0)=r2) r3 = inotify_add_watch(r1, &(0x7f00000001c0)='./file0\x00', 0x8) inotify_rm_watch(r1, r3) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000000000)=0x0) waitid(0x0, r4, &(0x7f0000000040), 0xc0000002, &(0x7f00000000c0)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000004c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$TIOCCONS(r5, 0x541d) r6 = syz_genetlink_get_family_id$team(&(0x7f0000000880)='team\x00') sendmsg$TEAM_CMD_OPTIONS_SET(r5, &(0x7f0000000e00)={&(0x7f0000000840)={0x10, 0x0, 0x0, 0x2100080}, 0xc, &(0x7f0000000dc0)={&(0x7f00000008c0)={0x4cc, r6, 0x100, 0x70bd26, 0x25dfdbfb, {}, [{{0x8, 0x1, r2}, {0xd0, 0x2, [{0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x3f}}, {0x8, 0x6, r2}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x8000}}, {0x8}}}, {0x4c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0x1c, 0x4, 'hash_to_port_mapping\x00'}}}]}}, {{0x8, 0x1, r2}, {0xc8, 0x2, [{0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r2}}}, {0x4c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x1c, 0x4, [{0x1, 0x9, 0x100000001, 0x2}, {0x8000, 0x81, 0x6, 0x4}, {0x8, 0xffff, 0x4, 0x7}]}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r2}}, {0x8}}}]}}, {{0x8, 0x1, r2}, {0x148, 0x2, [{0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r2}}}, {0x4c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0x1c, 0x4, 'hash_to_port_mapping\x00'}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r2}}, {0x8}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x10001}}, {0x8, 0x6, r2}}}]}}, {{0x8, 0x1, r2}, {0x78, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r2}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x27}}}]}}, {{0x8, 0x1, r2}, {0x44, 0x2, [{0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x10, 0x4, 'broadcast\x00'}}}]}}, {{0x8, 0x1, r2}, {0xec, 0x2, [{0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r2}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r2}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x9}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x40}}}]}}]}, 0x4cc}, 0x1, 0x0, 0x0, 0x40}, 0x80) setsockopt$inet_tcp_TCP_REPAIR(r5, 0x6, 0x13, &(0x7f0000000540)=0xffffffffffffffff, 0x4) ioctl$FIGETBSZ(r1, 0x2, &(0x7f0000000400)) setxattr$security_selinux(&(0x7f0000000580)='./file1\x00', &(0x7f00000005c0)='security.selinux\x00', &(0x7f0000000600)='system_u:object_r:default_t:s0\x00', 0x1f, 0x2) setsockopt$packet_buf(r5, 0x107, 0x5, &(0x7f0000000200)="3da8b08a47fd4abfa3d18b94b7738760adf20a6024dee6c023eecb8faba8254cb97276cfd3a3aedb0a2beb9be1", 0x2d) getsockopt$SO_COOKIE(r1, 0x1, 0x39, &(0x7f0000000240), &(0x7f0000000280)=0x8) ioctl$FS_IOC_GETFSMAP(r1, 0xc0c0583b, &(0x7f0000000640)={0x0, 0x0, 0x5, 0x0, [], [{0x1f, 0x1ff, 0x10000, 0xfff, 0x200, 0x9}, {0x0, 0x100000000, 0x7, 0x0, 0x9, 0x401}], [[], [], [], [], []]}) ioctl$KDSKBLED(r1, 0x4b65, 0x9) ioctl$IOC_PR_PREEMPT_ABORT(r5, 0x401870cc, &(0x7f00000002c0)={0x2, 0x9232, 0x5, 0x4}) clock_gettime(0x5, &(0x7f0000000180)) [ 496.859843] binder: BINDER_SET_CONTEXT_MGR already set [ 496.861433] binder: 24584:24590 unknown command 536871488 [ 496.871392] binder: 24587:24599 BC_ACQUIRE_DONE node 1136 has no pending acquire request [ 496.876264] binder: 24583:24588 ioctl 40046207 0 returned -16 [ 496.889383] binder: 24584:24590 ioctl c0306201 20000440 returned -22 [ 496.913412] binder: 24583:24588 Release 1 refcount change on invalid ref 1 ret -22 [ 496.914017] binder: 24584:24590 ioctl 1 20000080 returned -22 [ 496.924051] binder: 24584:24601 ioctl c018620b 0 returned -14 [ 496.934930] binder: 24584:24601 unknown command 536871488 [ 496.937591] binder: 24604:24606 ioctl 400454da 200003c0 returned -22 [ 496.949203] binder: 24584:24601 ioctl c0306201 20000440 returned -22 [ 496.949641] binder: 24604:24606 unknown command 536872064 [ 496.961998] binder: 24604:24606 ioctl c0306201 20000440 returned -22 [ 496.963705] binder: BINDER_SET_CONTEXT_MGR already set [ 496.983019] binder: 24604:24606 ioctl c0c0583b 20000640 returned -22 [ 496.990915] binder: 24604:24606 ioctl 4b65 9 returned -22 [ 496.992275] binder: 24583:24607 Release 1 refcount change on invalid ref 1 ret -22 [ 497.005376] binder: release 24583:24607 transaction 1141 out, still active [ 497.007573] binder: 24604:24606 ioctl 400454da 200003c0 returned -22 [ 497.014238] binder: 24583:24588 ioctl 40046207 0 returned -16 [ 497.025532] binder: 24604:24611 unknown command 536872064 [ 497.025545] binder: 24604:24611 ioctl c0306201 20000440 returned -22 [ 497.026643] binder: 24604:24611 ioctl c0c0583b 20000640 returned -22 [ 497.040116] binder: release 24583:24588 transaction 1138 out, still active [ 497.057370] binder: 24604:24610 ioctl 4b65 9 returned -22 03:36:54 executing program 4: clone(0x2302001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x26) ptrace$cont(0x18, r0, 0x0, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0xcf}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 03:36:54 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='rdma.current\x00', 0x0, 0x0) 03:36:54 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="ffff"]], 0x0, 0x0, 0x0}) r1 = getuid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000080)={{{@in6=@loopback, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in6=@remote}}, &(0x7f0000000180)=0xe8) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f00000001c0)={{{@in=@dev, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in6=@loopback}}, &(0x7f00000002c0)=0xe8) mount$bpf(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='bpf\x00', 0x2000044, &(0x7f00000005c0)=ANY=[@ANYBLOB='mode=00000000000000000000003,mode=00000000000000000000003,mode=00000000000000000000011,euid=', @ANYRESDEC=r1, @ANYBLOB=',euid>', @ANYRESDEC=r2, @ANYBLOB=',obj_type=/dev/binder#\x00,dont_hash,euid=', @ANYRESDEC=r3, @ANYBLOB="248809a16f00"]) 03:36:54 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000005f0000000000000000000000000000180000000000000008000000000000", @ANYPTR], 0x0, 0x0, &(0x7f00000003c0)}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040), 0x4) sched_rr_get_interval(0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') 03:36:54 executing program 5: socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, 0x0, 0x400002, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={0xffffffffffffffff, 0x0, 0x0, 0x1}, 0x20) creat(&(0x7f0000000640)='./file0\x00', 0x0) unlink(&(0x7f0000000940)='./file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0), 0x47, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff"}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) [ 497.387697] binder: 24559:24564 ioctl c0306201 20000140 returned -14 [ 497.394967] binder: undelivered TRANSACTION_ERROR: 29201 [ 497.426163] binder: 24616:24620 unknown command 536871488 [ 497.435053] binder: 24618:24622 unknown command 536872064 [ 497.441196] binder: 24616:24620 ioctl c0306201 20000440 returned -22 [ 497.448027] binder: 24618:24622 ioctl c0306201 20000440 returned -22 [ 497.452528] binder: 24623:24627 ioctl c018620b 0 returned -14 [ 497.458052] binder: 24616:24630 unknown command 536871488 [ 497.466430] binder: 24616:24630 ioctl c0306201 20000440 returned -22 [ 497.475163] binder: 24618:24622 unknown command 536872064 [ 497.482254] binder: 24618:24622 ioctl c0306201 20000440 returned -22 [ 497.497421] binder: BINDER_SET_CONTEXT_MGR already set [ 497.507242] binder: 24619:24632 ioctl 40046207 0 returned -16 [ 497.528312] binder_alloc: 3591: binder_alloc_buf size 8192 failed, no address space [ 497.550934] binder_alloc: allocated: 7072 (num: 230 largest: 32), free: 5216 (num: 1 largest: 5216) [ 497.563402] binder: 24619:24624 Release 1 refcount change on invalid ref 1 ret -22 [ 497.570404] binder: 24623:24636 transaction failed 29201/-28, size 6144-2048 line 3155 [ 497.576793] binder: release 24619:24624 transaction 1145 out, still active 03:36:54 executing program 1: ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='+'}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 03:36:54 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) readahead(r0, 0x1, 0x2) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB="0800000000f9ff00"]], 0x0, 0x0, 0x0}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='rdma.current\x00', 0x0, 0x0) 03:36:54 executing program 0: prctl$PR_SET_PDEATHSIG(0x1, 0x19) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) fcntl$F_GET_FILE_RW_HINT(r0, 0x40d, &(0x7f0000000000)) preadv(r0, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/246, 0xf6}, {&(0x7f00000004c0)=""/4096, 0x1000}, {&(0x7f0000000140)=""/211, 0xd3}, {&(0x7f0000000240)=""/96, 0x60}, {&(0x7f0000000340)=""/188, 0xbc}, {&(0x7f00000014c0)=""/4096, 0x1000}], 0x6, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB='0']], 0x0, 0x0, 0x0}) 03:36:54 executing program 4: r0 = socket$packet(0x11, 0x20000000000002, 0x300) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000000000)=[{0xb1}, {0x80000006}]}, 0x10) 03:36:54 executing program 5: socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, 0x0, 0x400002, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={0xffffffffffffffff, 0x0, 0x0, 0x1}, 0x20) creat(&(0x7f0000000640)='./file0\x00', 0x0) unlink(&(0x7f0000000940)='./file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0), 0x47, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff"}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) [ 497.620447] binder: release 24587:24592 transaction 1135 out, still active [ 497.627520] binder: unexpected work type, 4, not freed [ 497.634659] binder: undelivered TRANSACTION_COMPLETE [ 497.658558] binder: 24642:24648 unknown command 536871488 03:36:54 executing program 1: ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='+'}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 497.674018] binder: 24644:24651 unknown command 536872064 [ 497.681033] binder: 24642:24648 ioctl c0306201 20000440 returned -22 [ 497.685574] binder: 24644:24651 ioctl c0306201 20000440 returned -22 [ 497.701187] binder: 24642:24648 unknown command 536871488 [ 497.707006] binder: 24644:24655 unknown command 536872064 [ 497.710539] binder: 24642:24648 ioctl c0306201 20000440 returned -22 03:36:54 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="650000000000000080"]], 0x0, 0x0, 0x0}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='rdma.current\x00', 0x0, 0x0) [ 497.725765] binder: 24644:24655 ioctl c0306201 20000440 returned -22 [ 497.761425] binder: BINDER_SET_CONTEXT_MGR already set 03:36:54 executing program 4: socket$inet(0x10, 0x0, 0x0) ioctl$VT_WAITACTIVE(0xffffffffffffffff, 0x5607) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x82) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) r2 = memfd_create(&(0x7f0000000100)='t\bnu\x00\x00\x00\x00\x85nG\x13g\xa6\x05', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) sendfile(r1, r1, 0x0, 0x20002000005) ioctl$LOOP_CLR_FD(r1, 0x4c01) socketpair$unix(0x1, 0x0, 0x0, 0x0) openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(0xffffffffffffffff, 0xc0145401, 0x0) perf_event_open(&(0x7f0000000080)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_REFRESH(r0, 0x2402, 0x6946) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(0xffffffffffffffff, 0x2405, 0xffffffffffffffff) write(0xffffffffffffffff, &(0x7f00000001c0), 0x7ba27d3a) 03:36:54 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) epoll_create(0x7) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) 03:36:54 executing program 1: ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='+'}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 497.773174] binder: 24645:24656 ioctl 40046207 0 returned -16 [ 497.821321] binder: 24645:24649 Release 1 refcount change on invalid ref 1 ret -22 [ 497.841722] binder: 24663:24671 unknown command 536872064 [ 497.841825] binder: 24661:24670 unknown command 536870912 [ 497.847327] binder: 24663:24671 ioctl c0306201 20000440 returned -22 [ 497.853189] binder: release 24645:24649 transaction 1148 out, still active [ 497.878274] binder: 24663:24672 unknown command 536872064 [ 497.881933] binder: 24661:24670 ioctl c0306201 20000440 returned -22 [ 497.896913] binder: 24661:24674 unknown command 536870912 [ 497.901408] binder: 24663:24672 ioctl c0306201 20000440 returned -22 [ 497.903147] binder: 24661:24674 ioctl c0306201 20000440 returned -22 03:36:55 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000005f0000000000000000000000000000180000000000000008000000000000", @ANYPTR], 0x0, 0x0, &(0x7f00000003c0)}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040), 0x4) sched_rr_get_interval(0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') 03:36:55 executing program 1: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 03:36:55 executing program 5: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) r1 = memfd_create(&(0x7f0000000100)='t\bnu\x00\x00\x00\x00\x85nG\x13g\xa6\x05', 0x0) pwritev(0xffffffffffffffff, 0x0, 0x0, 0x81805) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x20002000005) ioctl$LOOP_CLR_FD(r0, 0x4c01) socketpair$unix(0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(0xffffffffffffffff, 0xc0145401, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_REFRESH(0xffffffffffffffff, 0x2402, 0x6946) 03:36:55 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/status\x00', 0x0, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000600)=ANY=[@ANYBLOB="6d616e678c6500000000000000000000000000000000000000000000000000001f0000000600000020080000c0030000f005000000000000c003000000000000500700005007000050070000500700005007000006000000", @ANYPTR=&(0x7f0000000580)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="00000000000000000000000000000000ff010000000000000000000000000001ffffffff000000ffffffffff00000000ffffffffff000000ffffff00ffffffff76657468315f746f5f6272696467650067726574617030000000000000000000000000000000000000ff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003c0003040e000000000000000000000000000000480270020000000000000000000000000000000000000000000000002800727066696c7465720000000000000000000000000000000000000000000001000000000000005801706f6c696379000000000000000000000000000000000000000000000000ac1e0101000000000000000000000000fffffffffffffffffffffffffffffffffe880000000000000000000000000001ff000000ff000000ffffff00ffffffff000004d5000000002f00030100000000000000000000000000000001000000ffffffffffffffffffffffffff00000008000000000000000000000000000000ff000000ff0000000000000000000004d3033500007301021400000000000000000000000000000001ffffffff000000ffffffff00ff000000fe800000000000000000000000000017ffffffffff00000000000000ff0000ff000004d30000000000011208ac1414bb00000000000000000000000000000000ffffffff00000000000000ffff020000000000000000000000000001ffffffff000000ffffffff00ffffff00000004d5043500008801010007000400000000002800484c0000000000000000000000000000000000000000000000000000000001e6000000000000fe8000000000000000000000000000bb00000000000000000000000000000001ff000000ff000000ffffffffffffffffff000000ffffffffffffffffffffffff7465616d5f736c6176655f310000000076657468300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff00000000000000000000000000000000bb00030005000000000000000000000000000000280150010000000000000000000000000000000000000000000000003000737268000000000000000000000000000000000000000000000000000000bb08000007001800000400000000000030006672616700000000000000000000000000000000000000000000000000001a00000001000000070000000c0300002800544f5300000000000000000000000000000000000000000000000000000003ff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000180140010000000000000000000000000000000000000000000000002800727066696c7465720000000000000000000000000000000000000000000003000000000000002800727066696c74657200000000000000000000000000000000000000000000060000000000000028004453435000000000000000000000000000000000000000000000000000002f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c800f0000000000000000000000000000000000000000000000000002800484c000000000000000000000000000000000000000000000000000000000255000000000000ff0200000000000000000000000000015d50ba73cd4178c83e7cbc71ddf11839ffffffffffffffffffffff0000000000ffffffffffffff00ffffff00ffffff006272696467655f736c6176655f3100006e6c6d6f6e3000000000000000000000000000000000000000ff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003a000502400000000000000000000000000000003801600100000000000000000000000000000000000000000000000048006473740000000000000000000000000000000000000000000000000000007f0000000001e1030600f7ff080002000200090000000100000006000700000002003afe040002002800727066696c7465720000000000000000000000000000000000000000000002000000000000002800544f53000000000000000000000000000000000000000000000000000000c0ff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a800d0000000000000000000000000000000000000000000000000002800000000000000000000000000000000000000000000000000000000000000feffffff00000000"], 0x880) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x800, 0x0) 03:36:55 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='rdma.current\x00', 0x0, 0x0) 03:36:55 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000000)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='attr/current\x00') preadv(r0, &(0x7f0000000700), 0xdd, 0x0) [ 498.244313] binder: 24623:24627 ioctl c0306201 20000140 returned -14 [ 498.251227] binder: undelivered TRANSACTION_ERROR: 29201 03:36:55 executing program 1: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 498.290816] binder: 24689:24694 ioctl c018620b 0 returned -14 [ 498.297563] binder: 24690:24695 unknown command 536872064 [ 498.305268] binder: 24690:24695 ioctl c0306201 20000440 returned -22 [ 498.306214] binder: 24687:24693 unknown command 536871488 [ 498.313552] binder: 24690:24695 unknown command 536872064 [ 498.319271] binder: 24687:24693 ioctl c0306201 20000440 returned -22 [ 498.326034] binder: 24690:24695 ioctl c0306201 20000440 returned -22 03:36:55 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = dup2(r0, 0xffffffffffffff9c) ioctl$UI_SET_FFBIT(r1, 0x4004556b, 0x5f) eventfd(0x8000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) [ 498.351605] binder: 24687:24701 unknown command 536871488 [ 498.355755] binder_alloc: 3591: binder_alloc_buf size 8192 failed, no address space [ 498.365808] binder_alloc: allocated: 7136 (num: 232 largest: 32), free: 5152 (num: 1 largest: 5152) [ 498.383991] binder: 24687:24701 ioctl c0306201 20000440 returned -22 03:36:55 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='rdma.current\x00', 0x0, 0x0) write$binfmt_elf64(r1, &(0x7f0000000480)={{0x7f, 0x45, 0x4c, 0x46, 0x4, 0x0, 0x0, 0x8b, 0x6, 0x3, 0x6, 0x7ff, 0xe, 0x40, 0x3cf, 0x7, 0xfffffffffffffffc, 0x38, 0x1, 0x100, 0x3, 0x2}, [{0x7, 0x0, 0x0, 0x0, 0x7, 0x5, 0x224, 0x9882}], "00b10df39c3f9114f872122cd3416901b0bda1f5b43b8a1ad29940c6f5adce155768121f9deb8ddf2247e75628641909e1973654b892eaa19eefff8378da6f8351633b9c38d6271704aca849d8ff507d6da3fd03d0e29d754cc68136d840f3bb13b03d5d4f619f742675bcef9d7057549ceb9526b86fec31d847bfa14d330ad0a687b931c7a56f8594252eb055dd7c2fe49e77b6bd22584a6919ddb3b6cb753c3bbc9428e21c0db5fc305dfdea1afcd73e0846fe41", [[], [], [], [], []]}, 0x62d) 03:36:55 executing program 1: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 498.396325] binder: 24689:24702 transaction failed 29201/-28, size 6144-2048 line 3155 [ 498.414909] binder: 24707:24712 unknown command 536872064 [ 498.423256] binder: 24689:24702 ioctl c0306201 20000440 returned -14 [ 498.434559] binder: 24707:24712 ioctl c0306201 20000440 returned -22 03:36:55 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000004c0)={0xffffffffffffffff}) setsockopt$sock_attach_bpf(r0, 0x1, 0x2a, &(0x7f0000000000), 0x4) 03:36:55 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 498.507410] binder: 24716:24722 unknown command 536871488 [ 498.526770] binder: 24716:24722 ioctl c0306201 20000440 returned -22 [ 498.542893] binder: 24707:24724 unknown command 536872064 [ 498.569957] binder: 24716:24727 unknown command 536871488 [ 498.572017] binder: 24707:24724 ioctl c0306201 20000440 returned -22 [ 498.583748] binder: 24716:24727 ioctl c0306201 20000440 returned -22 [ 498.641677] binder: 24726:24732 BC_ACQUIRE_DONE node 1153 has no pending acquire request 03:36:55 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000005f0000000000000000000000000000180000000000000008000000000000", @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040), 0x4) sched_rr_get_interval(0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') 03:36:55 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000003000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x26, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000061c080000000000000000000040"], 0x0, 0x0, 0x0}) 03:36:55 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = dup2(r0, r0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000580)=ANY=[@ANYBLOB="d163075cb53c37dd7e4273201b093018b566ae5f0a8957ac5a1cef350135f388ad4c9b8a41b09056b3b206c6ba91277cc0202f894a91b3936cce4137ef00941b5dd9580497817891221cf15e38c690d1bfa9271e0f687a381492a5074168cdf0c0723dd9dfce787be55dd4d93b072fe448703a735020e58cd7202967e3e325eed6305532ab0ef34f4a7dfe123f269daf49c4da12d04a79aa9f98b1ebad7c7a91f5d743c9197df46bef859e4b0db1f1b4572ce7c780a806e54441bd130f27af0720ea80a923651253f5fc18c91e74a4e70d0e149027fff7d9ff3ba8b3509997a4b63cf15fdb61dddfad3694594214c5a7f2c4c97815501ea25b7e2d46b970a150f96a635d259f076026781c96c0e28f783923a24ce63bd345f119f16a0de7e82f2a4f82ee94909ab941bfd43b8774344a0b227953b25fef60b097bff0c28ff38f59a7a231023799d1d6d7f44b26553f740d243ccebae4f8e02fa6b32eca1ef7394aa90d96753ca03dbb3701211938871928cc807ac30b"]], 0x0, 0x0, 0x0}) r2 = add_key(&(0x7f0000000280)='id_resolver\x00', &(0x7f00000002c0)={'syz', 0x1}, &(0x7f0000000480)="e839f5328181cb45f896e8367dca0cbd9f48ffc7e8ae80e1c9c25bab3d5aeadd2dc946ced260cf5c107e6ecbca909fe7f4b70af7651b098cba5528c2dbefd06ded9ef95f4e122c99a41c3d270e98b3f69953297814dc4fedb1014825c4ddebf1a64d9649849c05c45776d924d063a88e7eb7111c41591477183b5928e40dfee61d0a371e8bf09fc8904041cca52ff7c8a86e903196f5792b68ef31dc38374c47d32374f21a48a4991b0c79298693001193dee69cd9877d7edbb84715e73bdf5d4c25cb8084507c3ef4338b1718b1052f131cc61419c3a0783b0be62694508f986aed130913c9dd90a8098528ea2c0aa15124ba23ab384a157bb6f4d1cbdc", 0xfe, 0xfffffffffffffffe) add_key(&(0x7f00000001c0)='keyring\x00', &(0x7f0000000200)={'syz', 0x1}, 0x0, 0x0, r2) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000080)={{{@in6=@mcast1, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in=@multicast1}}, &(0x7f0000000000)=0xe8) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000180)={'team0\x00', r3}) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='rdma.current\x00', 0x0, 0x0) ioctl$KDENABIO(r4, 0x4b36) ioctl$RTC_PIE_OFF(r4, 0x7006) 03:36:55 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000540)=0x0) sendfile(r0, r0, 0x0, 0x100000) fcntl$lock(r0, 0x27, &(0x7f0000000580)={0x3, 0x3, 0x22, 0x7, r1}) fcntl$setlease(r0, 0x400, 0x1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000140)=ANY=[], 0x0, 0x0, 0x0}) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f00000005c0)={0x0, r0, 0x0, 0x8d4e, 0x40, 0x8}) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000600)='/dev/full\x00', 0x381000, 0x0) ioctl$EVIOCGPROP(r2, 0x80404509, &(0x7f0000000640)=""/175) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpuacct.usage_user\x00', 0x0, 0x0) setsockopt$packet_fanout_data(r0, 0x107, 0x16, &(0x7f0000000500)={0x4, &(0x7f00000004c0)=[{0x2, 0x3, 0xff, 0x9}, {0x336, 0xe922, 0x2f7e80, 0x3ff}, {0x4, 0x0, 0x7, 0x1}, {0x8001, 0x8471, 0xb5d3, 0x4}]}, 0x10) ioctl$TIOCLINUX2(r2, 0x541c, &(0x7f0000000700)={0x2, 0x0, 0x2, 0x9, 0x8000, 0xfff}) ioctl$KDGETLED(r3, 0x4b31, &(0x7f0000000480)) write$P9_RLERROR(r3, &(0x7f00000003c0)={0x1f, 0x7, 0x2, {0x16, '/*selfvmnet0wlan0lo(}*'}}, 0x1f) write$tun(r3, &(0x7f0000000040)=ANY=[@ANYBLOB="000000606181b9c0032432ffff02000000000000000000000000000100000000000000000000000000000001030201e600000000ff0200000000000000000000000000016719000000000000c2040000000207c4cc8e9a1b2441c525e97e20fd0153eb0c81c82862606a608a2b8f248016d59a448af1db1a11da64d7a10b71591de866aaae33a677ce61b7a015c6e3e03e3da1cebe52bf307d4e2800be149e6bd47768d6b44db468a0167d894290a2c7304a871840d761dec7e99f096c8030f6b4ec94b0b722cd8f52df84682ef4f901576aef3d54a3b4c464df678014f22b366ae99efd11afe7ef893f522877e02e56c319447935e4b98fc28ee727c5dadbbaa07f8b9a157e2cb14f542f5ea8739ade75885b00000000020a260700000000ff02000000000000000000000000000100000000000000000000000000000000fe8000000000000000000000000000aa00000000000000000000000000000001ff01000000000000000000000000013204040207301f00fe800000000000000000000000000019ff0200000000000000000000000000010604040201300700fe880000000000000000000000000001ff0100000000000000000000000000013f0404020840000000000000000000000000ffffac1e0001e13a67f0477a9d2a27fa966a3eebe87c3b08000700000000fe8000000000000000000000000000bb00000000000000000000000000000000fe8000000000000000000000000000bbff020000000000000000000000000001ff03000000000000000100071800000ba70404030046a3000000000000fbffffffffffffff0000003f000430670000000000000000000000000000000000000200004e2200004e24000000040000000000000000000000000000000000000003000001000000000100000008000000040000005000006a7500000005fffffebe0000000200000008000000090000008000000006000000048000000000000200000000090000000700a4ff8b0000300000095600000400000000030000003f0000000100000001000000100000bdfffffff2eb0000000300005e26000000060000000200000000000008000000a66d0000007f0000a76f000000040000e8e10000006000000004000000090000800000008001000000080000000200"], 0x350) 03:36:55 executing program 4: [ 499.088709] binder: 24689:24694 ioctl c0306201 20000140 returned -14 [ 499.096510] binder: undelivered TRANSACTION_ERROR: 29201 03:36:56 executing program 4: [ 499.132864] binder: BINDER_SET_CONTEXT_MGR already set [ 499.138928] binder: 24740:24742 ioctl c018620b 0 returned -14 [ 499.142372] binder: 24735:24744 unknown command 536872320 [ 499.145488] binder: 24736:24741 ioctl 40046207 0 returned -16 [ 499.160734] binder: 24738:24743 ioctl c028660f 200005c0 returned -22 [ 499.172992] binder: 24735:24744 ioctl c0306201 20000440 returned -22 03:36:56 executing program 4: 03:36:56 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="00cd726841ff"]], 0x0, 0x0, 0x0}) getitimer(0x2, &(0x7f0000000080)) [ 499.173328] binder_alloc: 3591: binder_alloc_buf size 16384 failed, no address space [ 499.182763] binder: 24735:24744 ioctl 8933 20000180 returned -22 [ 499.194497] binder: 24738:24747 ioctl c028660f 200005c0 returned -22 [ 499.196825] binder: 24735:24744 unknown command 536872320 [ 499.207845] binder: 24735:24744 ioctl c0306201 20000440 returned -22 [ 499.209508] binder_alloc: allocated: 7168 (num: 233 largest: 32), free: 5120 (num: 1 largest: 5120) [ 499.225765] binder: 24735:24748 ioctl 8933 20000180 returned -22 03:36:56 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='rdma.current\x00', 0x0, 0x0) getsockopt$sock_buf(r1, 0x1, 0x0, &(0x7f0000000000)=""/64, &(0x7f0000000080)=0x40) 03:36:56 executing program 4: [ 499.253628] binder_alloc: 3591: binder_alloc_buf size 8192 failed, no address space [ 499.261936] binder: 24736:24741 transaction failed 29201/-28, size 16384-0 line 3155 [ 499.273463] binder_alloc: allocated: 7168 (num: 233 largest: 32), free: 5120 (num: 1 largest: 5120) [ 499.286279] binder: 24755:24757 unknown command 536870912 [ 499.292949] binder: 24755:24757 ioctl c0306201 20000440 returned -22 [ 499.301939] binder: 24740:24749 transaction failed 29201/-28, size 6144-2048 line 3155 [ 499.311623] binder_alloc: binder_alloc_mmap_handler: 24736 20003000-20006000 already mapped failed -16 [ 499.327366] binder: 24755:24757 unknown command 536870912 [ 499.334452] binder: 24740:24749 ioctl c0306201 20000440 returned -14 [ 499.337261] binder: 24760:24764 unknown command 536871488 [ 499.341455] binder: 24755:24757 ioctl c0306201 20000440 returned -22 03:36:56 executing program 4: [ 499.353559] binder: 24760:24764 ioctl c0306201 20000440 returned -22 [ 499.358363] binder: 24760:24766 unknown command 536871488 [ 499.370458] binder: BINDER_SET_CONTEXT_MGR already set [ 499.375791] binder: 24736:24741 ioctl 40046207 0 returned -16 [ 499.380690] binder: 24760:24766 ioctl c0306201 20000440 returned -22 [ 499.381909] binder: release 24726:24729 transaction 1152 out, still active 03:36:56 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 499.407160] binder_alloc: 3591: binder_alloc_buf size 16384 failed, no address space [ 499.421739] binder: unexpected work type, 4, not freed [ 499.435219] binder_alloc: allocated: 7168 (num: 233 largest: 32), free: 5120 (num: 1 largest: 5120) [ 499.454318] binder: undelivered TRANSACTION_COMPLETE [ 499.459661] binder: undelivered TRANSACTION_ERROR: 29201 [ 499.472588] binder: 24736:24769 transaction failed 29201/-28, size 16384-0 line 3155 [ 499.483756] binder: undelivered TRANSACTION_ERROR: 29201 [ 499.516339] binder: 24772:24777 BC_ACQUIRE_DONE node 1159 has no pending acquire request 03:36:56 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000005f0000000000000000000000000000180000000000000008000000000000", @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040), 0x4) sched_rr_get_interval(0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') 03:36:56 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0xfffffffffffffffc) timerfd_create(0x3, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) 03:36:56 executing program 2: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x180, 0x0) ioctl$LOOP_GET_STATUS(r0, 0x4c03, &(0x7f0000000080)) ioctl$UI_GET_SYSNAME(r0, 0x8040552c, &(0x7f0000000140)) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="0000000000000004925e90ce1b3383f117edade363b65db9cf0091d7166dc406418723ac02d8b1068da708bd59a4cb45ab37e70b945b74a5a3ae72a055fb32f2e28e172e13d87ee11203068d5939268b69441b5b9be16a525019efeddabf8bb419222dfcf5e8c02f6ee0cdc22be3b7008b2743287f9766c5af2db1f5b04501bb102d0513e960be6895797e02c3a25567b26471a272aec0af6eb5c3c8c9b923332ccad1db43eca8c16e9daa1b40692ca8e32aa733df8ca48dbff31a29dd37e5d1604721b771"]], 0x0, 0x0, 0x0}) inotify_init1(0x800) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='rdma.current\x00', 0x0, 0x0) 03:36:56 executing program 4: 03:36:56 executing program 5: [ 499.932827] binder: 24740:24742 ioctl c0306201 20000140 returned -14 [ 499.939754] binder: undelivered TRANSACTION_ERROR: 29201 03:36:56 executing program 4: 03:36:56 executing program 5: 03:36:56 executing program 0: syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x800) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) 03:36:56 executing program 4: [ 499.991964] binder: 24783:24786 ioctl c018620b 0 returned -14 [ 500.014767] binder: 24780:24784 unknown command 536872064 03:36:56 executing program 5: [ 500.058323] binder: 24780:24784 ioctl c0306201 20000440 returned -22 [ 500.058660] binder: 24793:24794 unknown command 536872064 [ 500.075684] binder_alloc: 3591: binder_alloc_buf size 8192 failed, no address space [ 500.095976] binder: 24780:24784 unknown command 536872064 [ 500.100164] binder: 24793:24794 ioctl c0306201 20000440 returned -22 03:36:56 executing program 4: [ 500.102758] binder: 24780:24784 ioctl c0306201 20000440 returned -22 [ 500.124484] binder_alloc: allocated: 7200 (num: 234 largest: 32), free: 5088 (num: 1 largest: 5088) [ 500.138308] binder: 24793:24804 unknown command 536872064 [ 500.153793] binder: 24793:24804 ioctl c0306201 20000440 returned -22 [ 500.158723] binder: 24783:24798 transaction failed 29201/-28, size 6144-2048 line 3155 [ 500.175393] binder: 24783:24798 ioctl c0306201 20000440 returned -14 03:36:57 executing program 4: [ 500.240734] binder: release 24772:24773 transaction 1158 out, still active [ 500.249314] binder: unexpected work type, 4, not freed [ 500.261247] binder: undelivered TRANSACTION_COMPLETE 03:36:57 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000005f0000000000000000000000000000180000000000000008000000000000", @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040), 0x4) sched_rr_get_interval(0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') 03:36:57 executing program 5: 03:36:57 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x3) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) 03:36:57 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 03:36:57 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x10000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='rdma.current\x00', 0x0, 0x0) 03:36:57 executing program 4: [ 500.790184] binder: 24783:24786 ioctl c0306201 20000140 returned -14 [ 500.797505] binder: undelivered TRANSACTION_ERROR: 29201 03:36:57 executing program 5: 03:36:57 executing program 4: [ 500.846218] binder: 24816:24820 unknown command 536872064 [ 500.847367] binder: 24819:24823 ioctl c018620b 0 returned -14 [ 500.862757] binder: 24816:24820 ioctl c0306201 20000440 returned -22 [ 500.875806] binder: 24817:24821 unknown command 536871488 [ 500.881748] binder: 24817:24821 ioctl c0306201 20000440 returned -22 03:36:57 executing program 4: 03:36:57 executing program 0: r0 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) write$P9_RSTAT(r0, &(0x7f0000000340)={0x5c, 0x7d, 0x1, {0x0, 0x55, 0xcd2b, 0x8, {0xa2, 0x4, 0x1}, 0x8010000, 0x1b4, 0x4, 0xffffffff, 0xb, '/dev/loop#\x00', 0xb, '/dev/loop#\x00', 0xb, '/dev/loop#\x00', 0x1, '.'}}, 0x5c) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_open_dev$loop(&(0x7f0000000040)='/dev/loop#\x00', 0x7ff, 0x200) r3 = mmap$binder(&(0x7f0000fec000/0x12000)=nil, 0x12000, 0x0, 0x10, 0xffffffffffffff9c, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xac, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {{0x4, 0x0, 0x1, 0x0, 0x10, 0x0, 0x0, 0x30, 0x10, &(0x7f0000000080)=[@fd={0x66642a85, 0x0, r1}, @fd={0x66642a85, 0x0, r2}], &(0x7f00000000c0)=[0x78, 0x38]}, 0x3}}, @acquire_done={0x40106309, r3, 0x4}, @reply={0x40406301, {0x3, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x68, 0x20, &(0x7f0000000140)=[@fda={0x66646185, 0x7, 0x1, 0x23}, @ptr={0x70742a85, 0x0, &(0x7f0000000100), 0x1, 0x0, 0x2c}, @fda={0x66646185, 0x7, 0x1, 0x34}], &(0x7f00000001c0)=[0x60, 0x30, 0x48, 0x48]}}, @release={0x40046306, 0x4}], 0xdb, 0x0, &(0x7f00000004c0)="4bdff1d5fc99900dc05a3e2200cbf698cfecfb6bc4c900c4c13e48e1e242507db91c178373be34e5497700d0a40bc837f9b896ab1841f9ce05774e4d84b026324c04668b37e52b83e13e1453296544bb6ba68b69c1ad8528ede22c8900abf289fc79d0bc2c65b9c34143fe99647261ca7fbca6fd4edea5f0f7e359ba83d1125c4e5a99ae15ba96b812ae0f45a1d18a79e5c638c3c95ba9510d6118c113edeb76006e3f9099f14dd43c66b29eaa0b22f2d95d11a0e545a593ff1282ac7b980f954bb6fed31fa442b6bbaa2e4f6d02afc7369bbdf2df722ed2166fe7"}) r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f00000005c0)=ANY=[@ANYBLOB="00af9d79e95eb467d0f232992125ed3fdb5e968659fdd618dede6b165a3c4c867e9d3a2a4690944420bec0df07b827aff7024f81c431d16c5b23eb3f6822ae92df29c0d53e3552df2da24f59d78159a86867163df98ea85a6cd20a8922888430faab14336012acad1fc8881549a2465ed4aec44c1f75dca5c1953998a0f9d4b1ce7c5575a00e4ed3667e7900d7804617b0766c923886afea9b5bae1130f2d499ae603c5a4d242a3caa0bd514f45eb38f918a9929ac5ca91ca5eb528f4db63362604ea5e688ef587230"]], 0x0, 0x0, 0x0}) 03:36:57 executing program 5: [ 500.898806] binder: 24814:24828 BC_ACQUIRE_DONE node 1163 has no pending acquire request [ 500.917511] binder_alloc: 3591: binder_alloc_buf size 8192 failed, no address space [ 500.918831] binder: 24817:24821 unknown command 536871488 [ 500.962607] binder: 24817:24821 ioctl c0306201 20000440 returned -22 [ 500.970653] binder_alloc: allocated: 7232 (num: 235 largest: 32), free: 5056 (num: 1 largest: 5056) [ 500.991254] binder: 24836:24839 unknown command 536872384 [ 501.003973] binder: 24836:24839 ioctl c0306201 20000440 returned -22 03:36:57 executing program 4: [ 501.013331] binder: 24819:24829 transaction failed 29201/-28, size 6144-2048 line 3155 [ 501.042343] binder: 24819:24829 ioctl c0306201 20000440 returned -14 03:36:58 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000005f0000000000000000000000000000180000000000000008000000000000", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB]], 0x0, 0x0, &(0x7f00000003c0)}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040), 0x4) sched_rr_get_interval(0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') 03:36:58 executing program 2: r0 = open(&(0x7f0000000000)='./file0\x00', 0x4000, 0x80) r1 = socket$packet(0x11, 0x2, 0x300) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000080)) r2 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) creat(&(0x7f0000000100)='./file0\x00', 0x30) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='rdma.current\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0x7, &(0x7f00000000c0)={0x59d4, 0x5, 0x0, 0x80000001}, 0x10) 03:36:58 executing program 5: 03:36:58 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000000)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0xfffffcd6, 0x0, 0x0}) 03:36:58 executing program 4: 03:36:58 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 501.646304] binder: 24819:24823 ioctl c0306201 20000140 returned -14 [ 501.657680] binder: release 24814:24822 transaction 1162 out, still active [ 501.670144] binder: undelivered TRANSACTION_ERROR: 29201 03:36:58 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/policy\x00', 0x0, 0x0) r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080)='nbd\x00') r3 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x100, 0x0) r4 = dup2(r0, r0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/mls\x00', 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x78, r2, 0x703, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_SOCKETS={0x1c, 0x7, [{0x8, 0x1, r3}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7fffffff}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x6}, @NBD_ATTR_CLIENT_FLAGS={0xc}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x80000000}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x2}]}, 0x78}, 0x1, 0x0, 0x0, 0x4008040}, 0x4004) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) 03:36:58 executing program 4: [ 501.713760] binder: 24851:24855 ioctl c018620b 0 returned -14 [ 501.720988] binder: 24853:24856 ioctl c018620b 0 returned -14 [ 501.723782] binder: 24850:24858 unknown command 536871488 [ 501.732532] binder: 24854:24857 unknown command 536872064 [ 501.732543] binder: 24854:24857 ioctl c0306201 20000440 returned -22 [ 501.747511] binder: 24850:24858 ioctl c0306201 20000440 returned -22 03:36:58 executing program 5: [ 501.769196] binder: 24850:24858 unknown command 536871488 [ 501.776201] binder: 24850:24858 ioctl c0306201 20000440 returned -22 [ 501.792890] binder_alloc: 3591: binder_alloc_buf size 8192 failed, no address space [ 501.800951] binder: 24851:24865 BC_ACQUIRE_DONE node 1167 has no pending acquire request 03:36:58 executing program 4: 03:36:58 executing program 5: [ 501.814429] binder_alloc: allocated: 7264 (num: 236 largest: 32), free: 5024 (num: 1 largest: 5024) [ 501.824627] binder: 24853:24866 transaction failed 29201/-28, size 6144-2048 line 3155 03:36:58 executing program 4: [ 501.860533] binder: 24853:24866 ioctl c0306201 20000440 returned -14 [ 501.906966] binder: 24863:24869 unknown command 536872064 [ 501.913132] binder: 24863:24869 ioctl c0306201 20000440 returned -22 [ 501.953362] binder: 24863:24869 unknown command 536872064 [ 501.959073] binder: 24863:24869 ioctl c0306201 20000440 returned -22 03:36:59 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000005f0000000000000000000000000000180000000000000008000000000000", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB]], 0x0, 0x0, &(0x7f00000003c0)}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040), 0x4) sched_rr_get_interval(0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') 03:36:59 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x40, 0x0) ioctl$BLKRRPART(r1, 0x125f, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='rdma.current\x00', 0x0, 0x0) 03:36:59 executing program 5: 03:36:59 executing program 4: 03:36:59 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB]], 0x0, 0x0, 0x0}) 03:36:59 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 502.506399] binder: release 24851:24855 transaction 1166 out, still active [ 502.514458] binder: 24853:24856 ioctl c0306201 20000140 returned -14 [ 502.530436] binder: undelivered TRANSACTION_ERROR: 29201 03:36:59 executing program 5: 03:36:59 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) [ 502.580894] binder: 24891:24893 ioctl c018620b 0 returned -14 [ 502.587880] binder: 24889:24892 unknown command 536872064 [ 502.587885] binder: 24886:24895 unknown command 536871488 [ 502.587896] binder: 24886:24895 ioctl c0306201 20000440 returned -22 [ 502.594392] binder: 24890:24894 ioctl c018620b 0 returned -14 [ 502.603891] binder: 24886:24895 unknown command 536871488 [ 502.613883] binder: 24889:24892 ioctl c0306201 20000440 returned -22 03:36:59 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB='\x00\x00']], 0x0, 0x0, 0x0}) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0xc) lstat(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000004c0)={{{@in=@local, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in6=@initdev}}, &(0x7f00000003c0)=0xe8) write$P9_RSTATu(r1, &(0x7f00000005c0)={0x89, 0x7d, 0x1, {{0x0, 0x67, 0x0, 0x4, {0x10, 0x3, 0x2}, 0x100000, 0x8, 0x2, 0xffffffffffffff7f, 0x1, '[', 0x0, '', 0x16, '-GPL}user\\keyringwlan0', 0x1d, '/selinux/avc/cache_threshold\x00'}, 0xd, '/dev/binder#\x00', r2, r3, r4}}, 0x89) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000100)={{{@in=@dev, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in=@remote}}, &(0x7f0000000040)=0xe8) ioprio_set$uid(0x3, r5, 0x9) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) r6 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/avc/cache_stats\x00', 0x0, 0x0) write$P9_RLOPEN(r6, &(0x7f00000000c0)={0x75e4914c8a056974, 0xd, 0x2, {{0x0, 0x3, 0x5}, 0x1ff}}, 0x18) 03:36:59 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) r1 = mmap$binder(&(0x7f0000fef000/0x10000)=nil, 0x10000, 0x1000002, 0x100010, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x108, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="0e630c40010000000000000000000000066304400100000000634040020000000000000003000000000000000000000011000000000000000000000050000000000000002000000000000000", @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="852a747001000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000003000000000000002700000000000000852a747001000000", @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000002000000000000001900000000000000"], @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB='8\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="0563044002000000056304400400000003630840", @ANYRES64=r1, @ANYBLOB="00634040040000000000000004000000000000000000000001000000000000000000000038000000000000001000000000000000", @ANYPTR=&(0x7f0000000180)=ANY=[@ANYBLOB="8561646600000000030000000000000002000000000000002600000000000000852a646600000000", @ANYRES32=r0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="11634840040000000000000004000000000000000000000011000000000000000000000000000000000000001800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="0000000000000000300000000000000000000000d0000000"], @ANYBLOB='\b\x00\x00\x00\x00\x00\x00\x00'], 0xce, 0x0, &(0x7f00000005c0)="af06a68950a9f2a6abcb0e824cb6118876ab37a2cec2973e205075ac6640e05d3dd2075311df9bad6eef8e512f3bdcf4692a59e23df34d1f0ce9d25febf7a11d469ee0c6293f7d032fc4b94953ec47d721ff0a6dfda6a797e1a102f0c6e001b95b26d2dedb50851663dbfd44c7efd239e1339cd57ae2bf80f0f8faa2a5c12aaed92db1fb2ddd50d5365e50401ed2f8a60ea69d3ebaf2ddcf6db4d2084f8320786bfd206ad4dbedfc0447eceae8cda8979ff0e9228e0e951b1cdb3627197466530a6e1db37350e075f5a46b71135d"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$FS_IOC_FSGETXATTR(r0, 0x801c581f, &(0x7f0000000300)={0x80000000004, 0x4, 0x9, 0xe69, 0xfffffffffffffffa}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2, 0x0, &(0x7f0000000200)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='rdma.current\x00', 0x0, 0x0) ioctl$UI_SET_SNDBIT(r2, 0x4004556a, 0x7fff) [ 502.632229] binder: 24886:24895 ioctl c0306201 20000440 returned -22 [ 502.653169] binder: 24891:24901 BC_ACQUIRE_DONE node 1171 has no pending acquire request 03:36:59 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) fstatfs(r0, &(0x7f0000001680)=""/216) [ 502.683454] binder: BINDER_SET_CONTEXT_MGR already set [ 502.688813] binder: 24898:24902 ioctl 40046207 0 returned -16 [ 502.695362] binder_alloc: 3591: binder_alloc_buf size 8192 failed, no address space [ 502.717392] binder: 24904:24909 unknown command 536872064 03:36:59 executing program 5: r0 = socket$inet(0x2, 0x200000002, 0x200000088) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e21}, 0x10) r1 = dup2(r0, r0) sendto$inet(r1, 0x0, 0x0, 0x8000, &(0x7f0000000180)={0x2, 0x4e21}, 0x10) setsockopt$inet6_udp_encap(r1, 0x11, 0x64, &(0x7f0000000080)=0x1, 0x4) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") sendmsg$IPVS_CMD_DEL_DEST(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000002c0)=ANY=[@ANYBLOB], 0x1}}, 0x0) [ 502.727724] binder_alloc: allocated: 7296 (num: 237 largest: 32), free: 4992 (num: 1 largest: 4992) [ 502.737474] binder: 24904:24909 ioctl c0306201 20000440 returned -22 [ 502.745625] binder: 24907:24913 BC_REQUEST_DEATH_NOTIFICATION invalid ref 1 [ 502.754205] binder: 24904:24909 unknown command 536872064 [ 502.759871] binder: 24890:24905 transaction failed 29201/-28, size 6144-2048 line 3155 [ 502.769727] binder: 24898:24902 ioctl c0306201 0 returned -14 [ 502.775853] binder: 24907:24913 Release 1 refcount change on invalid ref 1 ret -22 [ 502.780897] binder: 24898:24902 Release 1 refcount change on invalid ref 1 ret -22 [ 502.785940] binder: 24904:24909 ioctl c0306201 20000440 returned -22 [ 502.795131] binder: 24907:24920 ioctl 801c581f 20000300 returned -22 [ 502.802852] binder: 24890:24905 ioctl c0306201 20000440 returned -14 [ 502.812782] binder: 24907:24913 got transaction to invalid handle [ 502.816053] binder_alloc: binder_alloc_mmap_handler: 24898 20001000-20004000 already mapped failed -16 [ 502.831688] binder: 24907:24913 transaction failed 29201/-22, size 80-32 line 3018 [ 502.832090] binder: 24907:24920 unknown command 536871488 [ 502.851280] binder: 24907:24920 ioctl c0306201 20000440 returned -22 [ 502.861926] binder: 24907:24920 BC_REQUEST_DEATH_NOTIFICATION invalid ref 1 [ 502.869580] binder: BINDER_SET_CONTEXT_MGR already set [ 502.874035] binder: 24907:24920 Release 1 refcount change on invalid ref 1 ret -22 [ 502.875053] binder: 24898:24902 ioctl 40046207 0 returned -16 [ 502.884904] binder: 24907:24920 got transaction to invalid handle [ 502.895697] binder: 24898:24912 ioctl c0306201 0 returned -14 [ 502.896263] binder: 24907:24920 transaction failed 29201/-22, size 80-32 line 3018 [ 502.902525] binder: release 24898:24902 transaction 1177 out, still active [ 502.910801] binder: 24907:24920 ioctl 801c581f 20000300 returned -22 [ 502.923906] binder: 24907:24913 unknown command 536871488 [ 502.929719] binder: 24907:24913 ioctl c0306201 20000440 returned -22 [ 502.929762] binder: undelivered TRANSACTION_COMPLETE [ 502.943533] binder: release 24898:24912 transaction 1174 out, still active [ 502.951953] binder: undelivered TRANSACTION_COMPLETE 03:37:00 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000005f0000000000000000000000000000180000000000000008000000000000", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB]], 0x0, 0x0, &(0x7f00000003c0)}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040), 0x4) sched_rr_get_interval(0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') 03:37:00 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x804) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$EVIOCGPHYS(r1, 0x80404507, &(0x7f0000000180)=""/131) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB="000075238684caa47716c15b91bfaa06574108fcf8edd2f52756cc9ee0e76653f03d20cca279cbefc84fe5a123f5eb0fafa0e8bf81b52afbc880fd801c1a32782ea2fe718fbd030000000000000093fe9fb44ff64b34b6424f51332d099e81c733f741649ed7e46dc4601b56f944dd374133ac6693f5b57141a720bf1607ee5bee5b147df32a8800a900000000000000000000000000"]], 0x0, 0x0, 0x0}) 03:37:00 executing program 5: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)={0x1, 0xb, 0x4, 0x8000000001}, 0x2c) bpf$MAP_LOOKUP_ELEM(0x3, &(0x7f0000000100)={r0, &(0x7f0000000180), 0x0}, 0x18) 03:37:00 executing program 4: r0 = socket(0x11, 0x800000003, 0x600081) bind(r0, &(0x7f00005a2000)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) r1 = dup2(r0, r0) write$tun(r1, &(0x7f00000000c0)={@void, @val, @ipx={0xffff, 0x1e, 0x0, 0x0, {@random, @broadcast}, {@random, @random="d7b52e2ab5df"}}}, 0x28) 03:37:00 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='rdma.current\x00', 0x0, 0x0) 03:37:00 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x1, 0x0, &(0x7f0000000000)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 503.379522] binder: release 24891:24893 transaction 1170 out, still active [ 503.386963] binder: 24890:24894 ioctl c0306201 20000140 returned -14 [ 503.400267] binder: undelivered TRANSACTION_ERROR: 29201 03:37:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="6425bb9cf35f7dd207edd426a76c73ba80560e1edc30a00032883fdb2b18e71e92f16d4b4e1d112c5210e3acaab3c76b653e7b5c564767b8393f280ab959e5b03663a95e5107ac7e6ebbb9d922cfb59470418d3e0586c3b52873b33429b60ae3adf98f7ca0fb74050e666a63b145dac307f3fad2bbe0ce5fee41efd725ba26b4344269b53d3a"]], 0x0, 0x0, 0x0}) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x1, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000100)='net/ip6_flowlabel\x00') setsockopt$EBT_SO_SET_COUNTERS(r2, 0x0, 0x81, &(0x7f00000014c0)={'filter\x00', 0x0, 0x0, 0x0, [], 0x8, &(0x7f0000000140)=[{}, {}, {}], 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, 0xf8) set_robust_list(&(0x7f0000000580), 0x18) r3 = socket$inet6(0xa, 0x2, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000380)='/dev/zero\x00', 0x1c0, 0x0) close(r3) syz_genetlink_get_family_id$SEG6(&(0x7f0000000340)='SEG6\x00') r4 = socket$netlink(0x10, 0x3, 0xa) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000280)={0x0, r2, 0x7, 0x1}, 0x14) r5 = open(&(0x7f00000000c0)='./bus\x00', 0x141042, 0x100) ftruncate(r1, 0x6) sendfile(r3, r5, 0x0, 0x8000fffffffe) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0)='nbd\x00') sendmsg$NBD_CMD_DISCONNECT(r4, 0x0, 0x10) fgetxattr(r0, &(0x7f0000000000)=@known='trusted.overlay.metacopy\x00', &(0x7f00000004c0)=""/4096, 0x1000) [ 503.433109] binder: 24930:24938 ioctl c018620b 0 returned -14 [ 503.434203] binder: 24934:24936 ioctl c018620b 0 returned -14 [ 503.442304] binder: 24929:24939 unknown command 536871488 [ 503.450722] binder: 24932:24937 unknown command 536871488 [ 503.450735] binder: 24932:24937 ioctl c0306201 20000440 returned -22 [ 503.456491] binder: 24932:24942 unknown command 536871488 [ 503.458721] binder: 24929:24939 ioctl c0306201 20000440 returned -22 [ 503.472982] binder: 24932:24942 ioctl c0306201 20000440 returned -22 03:37:00 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00f7"]], 0x0, 0x0, 0x0}) r1 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0x0, 0x800) r2 = openat(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x200, 0x8) sendmsg$nl_route(r2, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=@getneigh={0x14, 0x1e, 0x1, 0x70bd2d, 0x25dfdbfe, {}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0x4800}, 0x48800) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000000)={0x0, 0x0}, &(0x7f00000001c0)=0xc) r4 = gettid() poll(&(0x7f0000000340)=[{r1, 0x4100}], 0x1, 0x1) sendmsg$netlink(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f00000004c0)={0x38c, 0x1e, 0x204, 0x70bd25, 0x25dfdbff, "", [@typed={0x8, 0x2e, @u32=0x100000001}, @typed={0x4, 0x66}, @generic="280aa02de2104304bd2633bafb0c206be5497a17f53daaea24a841990747ee0035ef227c125e0c5d8f261699da422c6abf8280660f35b0f44bdc6fed12a40698a8e6c30d1d9556eaa14b6eb9e0078f4e5858a78a7562151905b937c86629a1327c3a49a9bab8d6d059262c2397c1c5d7", @typed={0x8, 0x36, @ipv4=@multicast1}, @typed={0x8, 0x1, @uid=r3}, @generic="e8fa20ed3f75132f819322a87a57f8fcddc78014b314f701bace29e0a1346f4eecfda11350a40f00fc79f8e0040e4efe30b08d8b36c00edc80202f5f7b8b1dddd45afc25110980f7aba1c4f51271f1c73afc4b850a50ee4812720c850e851917c27cceb6c877cbe96f0913aad9e52c9b8b2f22752df59833e56b0fc7b0", @generic="2fc6224f7d652443f0257d3c3ba857fa7b80623da4a0f5e773dee8702f5c7ad202fae0e2be65c90748f688d436bb0a8a17b15c0589e7935c3eb3f6e3c62f1aa0fe7145d9f3ace4c2824ab65477d30329f2ba41dc4e595163c4253af563920651409813ce5fb648b2bb563c0be307c4ca6358121296d9d0eebbcc73606a502587849dfee78154579bd07d9f9b41dcb3470a58e2d17151358446d74cee94e43fb2ffaacf9c3f251ae5046b77a2ab5e2eba537612cc84ef77442b8156f57b6d6f8b3ab36c356051fae29063e5e173ac258b71d72c38ad06cc4d72c9", @nested={0x198, 0x2a, [@generic="ef09cf8dbb29b9fa00f77a3b85f3d44cee15b22d3a9184259f074ac369b71bad697ea4c2a4fab198e878a68e964108534d145b283e8d1a23d290d58feaabef334cd9c5743ee848ad67e27473c52bd5616a1a5fd1ce4c98b04481d59c024c888b99", @typed={0x8, 0x3d, @pid=r4}, @typed={0x14, 0x7, @str='/dev/binder#\x00'}, @generic="8c033c886c67d3fcab8107872fbb90e0bdc3a642e16dd5e625332f8ae6d97822cc8ac43a973c61720f56bd2f6b610c0417aa423c1cec587c486c029f63ff6c47d3674e8aff0e1555be86722f39f47956f8fceb3f2b989b396c2306063215fde252b5e051f8f6f1a8c04be5fa0cdad658127da32145bd6f8524290d8691c56caec0354ee09571bf125a06437654f0a36873da1bbd32af2eef9908e6fe998d8b2a03d449680d933248e083565094d6fa29c6f82d8aad033d30178e6c4275cba0a0c200ffeed8503bb07fe25dcedb5b9a3a99", @typed={0x8, 0x1a, @ipv4=@local}, @generic="3df7bed0732d09aab379343c74a34acaf7e5bc7104dcf6306aef1a7351ec5990d8e048e00ffde4b91aa77e6eee7178d9fac773761a70dd9730777d"]}]}, 0x38c}, {&(0x7f0000000200)={0x6c, 0x38, 0x300, 0x70bd26, 0x25dfdbfe, "", [@generic="2f754454b8e9da2d8cf371642b80725ebde03f4dc699372b74c4f572a75b0fc60b430853309eabb7417b367ba2fe37875f1844acd7b24070adc5596142cd47cf82f8f35c2ab0ae4e21c0e1fe4c396b3465686336", @typed={0x8, 0x6a, @u32=0x11}]}, 0x6c}, {&(0x7f0000000880)={0x22a0, 0x2e, 0x200, 0x70bd2a, 0x25dfdbfd, "", [@nested={0xbc, 0x70, [@generic="ff446fad79a76d0f73c83294b245162fb539be30d7729b8940154ca2743cbe0257e920361e0f8ae5d483a1679b2ed9193c86370c02e6a54f3a15c781f0e103d79319df839a992b2d5c3b373c72d43d7a0f447e5b23c92d134d3c8eafc5dfdddf60f8752e3e4f5614df6a6d99033b413531207ee837ebec4ef6f7f8aa8143d3177a5e42e80059a8d25ad60b64c1e81fee819af13a11dacad5bf97dc97f11e286397f6c7", @typed={0x14, 0x6b, @ipv6=@local}]}, @nested={0x21d4, 0x88, [@generic="26cb71988b773be304f874d4f3ea6a0e195d47b83b0b9765d4aa0a2432cf7c3442d9c32ac53c3fe1c04628c46f990a1fd10fc7b0245a8d730e486330829af8c1b0abcfeb9d65cae4922349c8c8cace4ede149b1464299109dc5b3adcbcf00839f1a70c4c59a50a2a62994b4cb74773c47b920d44a400f076ab6121e4d34ee216d3b07bb22f69d05c3136c9ded2d9e81805b10870701a08e580235d992a1b358c73edf1b79b48eb9f1895bd0072d233871173c63e4dc41123b06b350d27880c74174c7c6f7daad56b49df1ca85d53d2ed2915715e466866b7d2c0e0a188e158bbc47f69678ddcf212cb", @generic="40f02f7473c8699bad65000841c992d6ffe1b85052e10e50210fa7589bf21ca22aefab83ecb65821edbbed7f38bce14e0280dedb7245deba17f8ecd7b29b43414fa79371a7e935d3f0d0804735", @generic="7cb114409a730dff388473d21fe5faa4a02f5f5122f27917bb1f5ebd41bdd3f716ea8baf4d2b4e0749c991f4409a3f7f59e21d8c3e95f91a5247ecfa5a2a1ca52b3e7c481f08b061a00111578827026ae59e0de5247268e67039259b937d5b72686348778ff008ab6fb48ab55e27916d0cf24ec93eb803206dd4071b778a304741881fd5fc4d31c89637e44741c0f61be2aa29740f462695ab04e1e26e2f846ce2721a53dd0a1848f16048e9526bec0efec419942d99bde377d25b4e369461ec9a7d7edf3a52a548fca5da2e479020a7b66a4f51538d224482428e909086de6a9821e75605308a709b4bfdd6809165b4a9d88b439d5b64cc3bb1ea26e98d651800e7842b63c512986be697543047e42ac11660655e3b4a3bc1a6bc04399847711ea819861d948b058ff60363b6b592c6e281f8a40d95e38a12e02e669e4abe714ed5175f6501bfbf569229ad4083ef8c3f355d4e57e7b8d5bc2d74209fec578504de60bd91f45e054c3a1eb8bedd45243c36b2278c2b056cd400be661199044d5d142b40714a055cc677fe69b4c3d7e78eb44d9a670992d6c986ae8fa863a5c96ac4c1fc248bf955ff7c611319370e5745cb8b2005e57a8863fa45c80db005172a33508c811f51582c627273e3f495d4bece0490520191f30c0dc98b9a7d9e482fc2de669ecffd9fee57add770ad2f3bbd6a0e106b768ed1d80203d0966133ed96019350c207c2f2a92ec4b65ac1daa608305cf7f3cc61bffd6befd91dc31ee40b7a66b2466c8c6c4b69ff57f7553b7160ca2b053d76b578c17c763c2098039447c05d6aeaeb4ffa82feb8e101e18b0e19e247be499bd4af90d7da5e9d25566c3d5376f8c265e7f1592f0094069990f8b5633083b00a0b1925abf85f7692d45c0ec8e60053db324e3566f5ff0050185d307ba16ad56a6458a4b3715994d16902260afd6da2186b32d7dbde36b7abcd8a6877a9e66f8d72698f2418f49074a976bb8e431b100d90ea3dedb0a4f09e1d110a79fd8e458540be2c347ee9fe143bd65cdea300de84c9272af1540a4c909980f25837eeadc465a9a4d03a1c07f51912aed8bdec1b84bf803121eb563c836f31b2b096c1e97feb39c5047dfa4bbbae7523870f964a99155d65d89a37693e6bd44e5bccb94069b10eaedaf98fded5c0d39348203136c7e651c4bf52f6cd854cad6dd203fbc64fb88bac6d25a16f67fa8cf69d0eaa845c343f96272b0ba6824f18829db9d4330ca1a89716343a2d4e0bafa0ceea4d173b109a0f280eae150859b7de066cf4953665442f64cc9349bfc2673347db076b952abbeacd60b2dc845da838845955545bee28604cfc7d230e30d168c8353adacd92bfa4adddd7d1d698e6ad6eb6cf46157965ebfc53c13ef4eb7b2636b96ed94be206352b9e32add5fbc98ba9780b0a705a93aed981fd6ef15a0344b4545c7aa61a642605e45354154c5fdd39f8c2d1960d227a77eaf806419a9a65023c18e03ad7189c377760efe0906d4328176297db8c226a2f6334b408869a972dc16a883d089f665cb1693c0e117e3da1588ca7c498bf53c78fe9570072e3ae0022c502884261ba70247f63490d03bc52950177e51c32ab860149cec4665b92e84f0041bf78ed12966e2b9068c06b79ccd427c4ccb3d21685642e47199ca0773b7157dfe531e843e746ce75d5cedb4a7a0525a24045ba93c42cfed733f19bfcae7c1bbb3c4c485760e10217b306e535984be545e5e6b76a9c0d5369a633a7ae936e09ab7863afcbe0fb541157511cf7c7a08fd93ea386baa685330416d822d489161b2376a2326f8c1038a83b7cc37aed9ac3e9ed0fa9893ff974c7fd8c07ed205508d062804a0f2a1cda972353a5136391829d20f9044c1a2176752bb7ec4be729f5e66103b714bf3aafc54d8879f3ce1c6f2feee7ac70a078b85e5620bf57fb8e74116644cae03f1dcc6dc732259345c10c45eec20766386a6f3b11bf318bcbe9e09b8d43820a45bd6a873a99b5b65ea28f69f2ce27c70c264d00503b53b39afd0aeeaa1e7891697c32b394c609727b3638a69771dd556889b5357062c47958258a81d77fdbe2bfcfd381274b7338b583b0275de5e35e8b9b0f512262a7b41fe662215580f5e0794b225cc35d11ae1b88044010bd921498744413d3be8563d2ce0c2404fa8d541b5861b762be11a62ddf6b76119e027e6b093346d90de58caf2875907bacb3576716cb4b60e43a76a4f09b1e49c86b4663eb5ace839f79dbcdd26bcd80272e30eb4dcf4b71f44296c4f2346540f5b19095bca8a12050cd2d472a961549520eb254f4ccceabb5fdf94fbe600a1f88bf41ca38240d08619727d05ea2471d065e3fdd985a4fcb7e0359a22e80bc28b0aeb16d7a72730ed530e278c92bcd729235837975635b12cf79f50c27a5ce876a72402152d3332677750a954139c0e8f92c4d79e8ecff43741e170f5a9c709e092b62e3089e98e783dd5c88b6c570a04af77acdb62b77118edb738847aa2fd528977b44a7923bf863d54c207367ea71f8007a5a66ea1ae1af090069f7714c69be8d5280193094a9fdbac023489aa8c35af6635f6e21e64dbf437ed7956d5b7632175064bb80727e0893cee4ad9b1381f8934c42b7fcb1209f96407b5caba97006e2d5b51e52e52493c9cbaddf16ab0872643ea1cd65e41de4cbbbc80b148325f3dc4dabc9bcca5bb3a31d4e588ec28b6998ea5ea4cf4860ad75fab952fcc34021537961540e8506b8c9eb839814e2bfe0c46deb1d40bffb87c8fffee7f819b41f02d5fc32d4b97bd226758380380b13514ab15eedbf9b654b0abbcca1862783f05f64b8e923fdbf74ffea00f0f529b3201370204e90d9319d3a3cfe171fb83fc71203a01ab77cb3644176719235554d4db900f7775b260202d650835819ff5c4f4e6903109c5a7ca6286225f37948cc45a04c22539b58e01c367043d370f78da6b881fe6ebf4348f47462643ab6c3db6c13909b871743cf8fb6ae56e9edabd0140d2bc086cbd070a502690f8880b0a4fe5afd2e16d6b4a43539f7ab1956284a0af1cf47d4143ff202707ae33d9c8f30d94b436377141caf9529470eea76d88bf7b0fcd5b97352e7da8842cc241f7cea6e513fc6309f7f7a494f8ddeb8fe54d77170592a94be6110c8b5102a95fd426cc2d156c9c900806f78cb7633e38b5794d39315ea82fbc7fdfd73da196fe8a32ee22f3dfd1338ef7bc3cea11881ac1eda61d281eb92c19eae627fb30529e5924b744b8b790375c94b2d594e9d1661bdc0c08dda53cbab829d770d6c91bc1802f9889dc851ef10e0cf9bbd38bcc1631751f7a88455c0eb83dbbd79be2609441142852185382ae6d0d12468fcaa0f6a8beb72e757382ec20fa7a4dcd621bed35fa4d18e6792aaa1ad7f79a56b6080d4ea6e3150db175eab7fb25ef55c4045c11982406e513d69ba61ff3581480f509913c24729affee3e9922442630ef4a9fef8d11e43f2b3d26a94f17e1a049f78ce9083cd43075d1815c4124315fc6df46306c73baf12279078db45db837d1b3e19223648107d2085945c3312961acec2a616c12dbdf1bab9ca5c7573f72c2c153229c5825b90910b983fa845ae523a2c636cfe9ecfbd9e2b52bc2676617e9afd439ab24d4947bd4ebcf19b71a2ddced622750e0a72ebc8136611cda832da0d18e49cf358ed56b175edcf55ce85bd28b2eb16386568c8d2e59a1d2016fa77d646c183d85488c1a0f0a69a35139bd98fdf65b8d9a473dfcf9454c4127df45f2e3bbd2faff23a91782f041d53a8dccb5fd9c9a12f0f7e732fb2b68b9ce8cf3930b03d4ec03bc26dc0fdac03567398e682c614747fd5d8c5361526b922dbf1b9f7e255ce0cde4a03797fa2db3af4e72a8c1f28728eddca711e34cdb9fa4c3bc015c31dad11b90bf7e63bd06adeb55667bbb8cd49fb818b73f534a243f25d59a504459a310e722992aa2e0cb236fdb5c4514c911d9717c122c1318a1388f7d38c0a38813bdd6ff7f9525d8c6285db868b139840af5d83a41311bece2b6a67e8d6c15a2eb648a2205c6dc4db630e41834c49f6bb137e2296ea69e965689223709e3ed5d0c5780ae7535b9384487fa0c9ffa1bbd90cf724df02c416b9f1c78f6138f0f19d2578667fc6aa7a16f23c20e9861c473eb7b84cba8b81880fd3b811e1988dc2f11b98d793d3341b35924915a6f54375c17fd4e1c1fb97a7cd7e28be7042f6ec51ffe7672d11f3f925cd5dffb11378ca42f9a09b46dcad1a2c2255df6048ab600a97a4dfb9e1d0c9b47f18f0a97b06d6dd9fee7f0a4960a09dcfa05ffd65b854cb909125318a56dec7c786556b4e4f033e6b505165dd6515c2fe305102553c1fdc14eadb1e1f3bd6f69d579ef440816d3e49778c811e8aca38d13e0958a2ca2dba76f76d01c499a51a023e0082b7986871f0e40594db16382050d6066eb0617b208195dab327f601290dae4176aacba241ce6447c8867ead50aabee01e64fde4558b5a416b9c50810755636a6c300f1266ab30ea5248da108be39b6ffaf79e01e3310fa5a26b016e5864a23ece0a4b79d9298000a065b9ce3856a8438d7c3c04f89ad35ca261eb3d410392c398ff225ba42aa45a46fda548be384b525edf4f35faf1ebda2dbe0cb23880ca31abbf22740239a62252e89486555068e729da2c43259ddbb0ecca460da4f3433845802bccc94a656aea689f7d97eaa2780f6231a4d14b499a54df5c08f0fcf2177c8e7465916af2b44d3c530890f0e9925e09049e1b4f02828467595a3517879470145a9776b6f883e0f6f93ce90c5f98a687fc329a7f630d983f0922ea574e8ccabffcf399b79857fd74598115b20581ce80e24ddd1f3d5b411ae30b10d685456c32fc3e94b20eff557d5b1fad71bd4b402e8a3ec9af4d5146c00cb5749a251fbb43ee5a146254a6900b5566d7eb8812dd0ddf1b3f52336754fbf93e16b7f671432f381511f0beb25f6777a52f0992f3fb89f1bf811d912421f077bb3bfa5835d97b278decb33da666ae471c86f191abc93882138f9a1139f68604c9199e660edd6c4fedc2f97e9cab8472148bccb2b37a3b6d7dccb0b2937bde62c44bf5e9548b872c739e72e68f7702fa892a46dc525f27ef7ffc354aac961d050888a8e0920d64e0e13e09cf0dcbe408f72ad57685f92868252808db2a0d37d5c0047062cae6f58a3b9eead0c9ebfd54cb201ba950e106ded9088393b677384b4f1e6c50f9c24fee209754abbf7acce51bdc4ee0dee7365fb7b58b200fc4ef227521eb723f02d896fc2eaeb4e12c5cf82d064ba093cf1cbf0edbaa3c08ce870d7e74852cffbca8b021eaa39afbeed2a84ae9d49814d540148da06c312a4fafe87ffa9373ff240b9b576bb107e36cfb01039fd76a522c777c0bbffc59df11671d9f81283060b515b15b3d109bb19fb0543c20c1e2f48b19714788965621fe97c1b3171d8f4ab39c9712a8710bf890202720fc97484834dabd27648a4c144e84b53209f5778711819cf1b8a2589c952aa45b58f0900a6c39a7067f1ab9bbd812f1acea6d0ebc0525f531708e72c592adb56daba6e8722c179a5c86e88525a8480545c8133225de566b7044fb38e1f3cb41db4007feae03c6ee09709ad73026d4271a3364e251f242ced66dad0f0006bd2b0c82808318c6ff0b307b92bb4d21367fe38454d86a52cc1058c67302397c270822307a07fa7f9ff68e4028fedc15d1deb8216e190547d27ea840af6b87a7aace95f0b8dfb32daf496506b8034ea378b1769ec4f62595", @generic="6d13a2e9eb66cef48b093b0d6e9531f0ae7078efad99ee6af416332523c32e83384748b588763cf1bdaa118bd4a45c182f39952ce908dc621b55cc21c35b68aadaa230b3c295a03b249ba041bf94952c8ccadc4f2399f4bef9bfff6d76bc276a00fdb6653f4a277d789c2188f872a2c1e22321eda4f471006394fa73fa598b39ce6d78fc28a2d2308ba465924dced568a6", @generic="fff9d3c984209a0c13e4a82d123fa7a3142ecb51f0aae9db7a5b68f7de48d71d38db7e2f7ce54a6a0e503ba91b4c5ba74b7502a0fe2ea4ba7131a518db592a7972c777278e8074c94a6ec08de3ece779a8fbecba06014d013ca789333460bf2f76ca20ef8162f7e28cc4ab7813bb9a30ab9ca6b7c13e57c5425529ad3caa1b7071f9e5427ab808f8b61eb61b93486c66c255e4d73f8d2b08663851cfef6a72986571f5378530a935966ffcc7ca361d0228ea0c7b3a85a7f999406627a73382421be035216454fb565670efd23c287b7cff77d6147fdcb38a87e804af00571fb5fc01fe3e9a07e7d4258f844b32ed1bb10ecb146e98abdd2f4eb880efc31b81c680ddd5db25032b7714e9bf8e0bff2a3df9a4542cba152a0745bbeb2747ccfb80b606dab5befe66ee016f8cd985500e69caed4829d664587682a8acc191a07203ef51bbcab331538311dda2e914143b1d44b3a3b72f8d2f789038773028ba1c0e4dcf15201ee8523f430b7df6e14461c5eda2d6a370057bbee297f5270acf09bb662a7f2a0c9aa9aa9252adef213ee49898791b15bc82b38897adacf64492248237a00e0546599272dbe5e0927e5bf11a433406e6ef64e4d6e5e0d5037fcd85c07bda60aa4030aa3d146cd2d43b491d6da9e9d4c12b9f6269ec87609e43b4172816eee2ca2bb201d74eb56b3cf7490da82c38f3bbe8ab92bb7981a8b484c81a04baea2d30c464cda08ab6625b92f4ce445c2118fa77c644eb0ba9154c58e74e4dd7ee624debba82a1c36d25ec25fe313bcadd835352e0875f61a4316efca63db25e3ceeabbed1d752cf0de17b2f099d9ba6c181476f19c3a152e6454878bce33a16177d28d7c999435c39668a70cf5e313c182106ca08c4cc9aac025b3fb96199a16bd25389ba6f890e1d4110746576543168ca7d58b1541adb376b89494cb756600fa1aa96304cfdf6573b90e32c0bcd7d245b1507945acf19641915f23d8a68e464248849e646709b9058e9be1afd305d219222e898f6ec923d190e7e57ba8f668e2c4f7933971988a2a3f4e6af1bda7efac6225856bb680f9f855ba669e27319227078eb92e1292b754873eba2ca43efc66667b66b5d67e1f1dd098f1436ea2491427d4f721c9a5cfb7b5274d4644ec5ad03e2299f45098ac71d264344b32e3dc91b1e5b39b4acefe6ef635c18584c7d73ab86579b00250a50fda596b0d01e787c9da74a9a91d78a11755047a2f9dcde6a43383d02d1dffe4860ad576c50143717cedf0530f6c63c278587ac4e222b87ea95a8b7e131f232bbded3b1e66966a5ed337eaeac3465f77d217f9d8469fc0a04c7d037c6a8dc366e88634aff3a589d93447afe5ad39eda975bfa595403770abb08948dc4a5280890b763b8c8d6645bdc4c9ebc9142883f402c3b4d62ef530982a4e8d12cbc2fc63599e7860b32527b8d000d7beac9974df03103b6988325a820085fddd069c60a0178c8417063451d4f70a69860a971d3b3c51953ac82e0d3f8536d1cb1dc0822bd9abf078cfd7b3ca8782e952b7793bff604146f51ecdf67318404caedf52e2e979a742b761c1236aba36fea253c8bdc6dac8f9965f42c3f9176146d8e869d81a05ece3895f0d1ca41b82ff2c0a3954c243585ab89a81bf1ba6b20bf8d90586a6d96812eea0081677595537a8f34010013360ddc4e810f282734a298724e864c3dc6993c80be8013872c9f99d00905159cf9f933a9307771be9a0e82c3276e4adcf39bb3baeea4e3dd0e914ffd4eb34549a02bc82f1c08cd265aa44f11ab1ec0abc9758705b94f63aa2c3b191d2ab38602c57c1491d9b077d7a207a1d6b9e3fb660524414100688acca852462341045762ea37e33fa1c066af71583f8e4d3cafedc243700e3be96eff48cca1b4cb64abc5b1806e22667c7503cad084509386334451aa7e51c40502d7a97097ab1720a3760b8616f6ba0cd99c1359da488c1e7cba773ba4d04f18be820ec5878929e299fdf2d2a29de4b67ecd23e2cf37ca2d5d6a4a79c95eb7e5e40dd8c65a74397f3e5ad1f29987367ef412fcedef7ab43e51fdb8cdbead6dfa8bc5ce7e3d294ad898c18d0e3c365d9deb57c06aa16bb0074e7649506683bd678f3f9ea03f79896396cf649fe9d6e5758e7986c67280f0806f241c52123196c2f500a409518476a39ce12b67faf101c3542a7a6401c2fa61210f65107b4eea7643bc52a0627575947a57615e7944b90b2492613617eb4c49940fc5a3ffb9a3fc9db24e2eea81178d7cdb290fa66062446b13e819f85de3929a44ad388ca175e209761046bb4ee8e1766548084202776c260a368640007221211c3f4cf6793cd85b4943abba84ba5fd241d3cae726b0231111ef2b7764924b9f33bcf95ea018205ef6fcb80e46cb8a24617fbacab63e1e176812a2b44fa26816d9cffd69b69a6d2a9881e7122c0690acfd8d5233b2d9ad8b02da3b0cc3c6cb79f690c6a42d0728dea387b22b4500fc2b83fbf5d90e9eae22fa605e2dcfd1f4d02c51938aea584ceb24cd0055a681f094a632f9a19441beea29a33c7c9f0ac3e0627b67e8b972154b80c913340ac810fd1b0998b9acc55b35decad46389e4bf716df2151867e89ce83223b033659f9293353b8ed21cc27022f7579d3f96a0d7384651b01560b0c5ee984e023723116a945fc1c1c96651ecbaab7eb11c7431e3487c8a8949436a0139ce5c7caa8105c9840c53228b9739a387cda2823a08c0694d948544d9230f1f2359dd90df42c93e1150b42b1cc51d8e2329c78109a1cdffcf750bfd0b8fbc40f5c1d8a94ecb7046de215fe5f323c2730a3df25c309e4a824a2338322382cb972f9ac762c535a660c96cc9336388e385f6028656eaf6735d6776fdc55491f482bcfbc1bad2674e0f4fa21feb1ac0684c5ee811bc7b09e5d3ee4d74f0a60e8ecd83b8a8e066c678a3856e70b89d45575d6d0beb6b7fe4121786476b6f1c7614559bd37e0a4decec7a8fd50ddcecfddd77156ef8963124e60fb6b0884dc069deb771c601a921b6393cb963ad4ca2162404f068fc4fc53284327af96f3d0fb4dc94a90c4be0279209ab3baada03cd024e8e939b047368f6cb9ad84aaf53dc2e94d756d6fb8c0451963c4576a42ca43b687b320b73d6eec3d46383be8941cc91a82604346f82cff1834464187d4eff83fce24b2c4718aac0ed92621e6e565f2ffc1ebc4de9ade0eafe1cc41eed2058d4a5dca91fc53ec658814593856527d37ba8427cf2ba949db58197bee630c77c92b00bebce9e750a75cf65e91e9f89a2b52d92e5e0cf24e8819a91d17ba0a7a380bc1acf5ef4b5a42d92f29a153414e5a56e3601f4be16b07fe13e9b823d457dbb25374ffb31abd91fe1bda7e16997c6444ac89be36f4d3cb3147ab5e9aa29e20227c8e114037d492c7a1a9e35cb9605142b7084b97c315a8e43824e839228e9d510127273e0af690b527a192ebff26bb69f36c1b64b38d907895fd013d9826f9e9fb6cead733b22a429ce839727b98d54005613810eabf9ff2e69c2447f53a71d7e62d283e68cf600d5cbc0efa1c791698435b1a8a8f29aaf8a719eb640f9ee99d384eb5ed024b5a0544cb14962c74468f3c93686b0a5818f96929648b181edf109cc6c4373c4366ab4500dcae33c5638d3a5ccc377ec417bbbae87480492ad652837d0d73cffc33303e5b40aadc3296f17ebb496c0baea4a8d5b5e6348989cc92b6438874ba80d23dc48b4984891d7713ee13210b60412282e305fc6cd84582e91a9b1ad9fea57228602c829da503770cfab8189f56a43c2d0ff890fed68dc5c72997c7024fb166da6c9cabaf2af9ffe2aabe5f07e2e9c5685e250260aacf0482db5a5ba4c7d5cc0164010586199eb4e56117dd05795f25ce0e33230e3c9d0b158f0bf0fd0d4de7e32a86332818f0784b2276e1d630d1f00ab10769af36fc9dff818d0b61c11e9664963bc4e091c288270295ae7ebd4764cdd9ac255760602ace326d4aa5d9e6956f31a501f897d1395170e00dcc542b5b9af19688a19e2bf521b1fd114dc21ad2e0e1eccf59e63c2a983e585b9851deac24fc803a22a0698cf4bc00a7ad587126c8f21e1c38b1c13450ca757f31ce85e8eba9b2ee55fc423877d29afd086c079e18e174efe506f3986c0778980d1886bf2b4577e68d17ed1f38a9e09763e9997d6b46a15be23d20e4a92738d3a87d47bf7ac414c0700706ac5357aa7179c584d7d132dc3b9bed0f13a11c99814088930713bcc29ba81439b12173826804ea0c16c777f18fdc7e9defb21ddaa3c402b622100812bf65a6b651796259b4fcdcd18717ac43f368d5e266816bacf1ceef51872c5197695d178bbc8383fd7cd220d799f1a6031e90f035b0303f6a7e356579e97c0b55ed072309b91f8e991e669bc428b856f080a52ab4c4488ccc77a0676d137a0add40cee8cfc952d6f4456dd3bbe3e0e0012666a6e6e8c988247ba1f5717a9fe26699245780d1d1178ebcab7525312dfc7661221b6fcf72d49ec27bdc73c358f15605291fdd462be904fc57f95bb6fd869612c2cfbede9df3f35ca3029e4253112ce5e56c09c39aecbfbd8e394f8574060d99498d7e1a8a6678b5d1bae807cad72f4903d16fe82e3c27738fe60acb67303f6040bb9b46bbe98c21bea9163916b008e0566a34550949e4ecf37569808eaca3b1ea5fa6990c37c16197d69239e53caeb49e27da6541dbb751b9a4bb62fb2d571d82ebcc611d9b50f2e63146a59824c9115b3dfb5b3f4c20678b734d5d14023e7df607ab54db96607f4f388bdee9bfc0afc7a1b8a455c5982e38cf0dd1a9b5cfbdd29170e6dbe87562f2b53879bd8d156886c6c1a51b26d2da55989ae0ac34f45f20f590e252b1254b10d6d0c022c47527ff4e1091816ff5ec9496bf54a535c0afeb654a65848434ad4e36a570b37dc0b8c32c4cb39aaeab90b524396744612d6597b6a05a8e006be17c14123b2f36f463958bb5f5fd15638111e958f0e94fc714400779cbff96c4248c16a52600ef16cc782dcad3f09c70e01b5826817fc81beb2d874edd8c422d8d5a4b24e444a37d13b8e0fbf9e0b6a93b271cbe636cb1783a919d3b8b81db6d07da5cabdf1fcdc90f21ccacfdd4aff365dcf2481e1d99b4a58fe92dbd7919efe47a41a55d6526c19424bc6924b7254b5d4c20cf937b3db32985aa084a1ff2b7571d9a562a33311f1cc56e4df46ac9655793da4f3a1fc0abb658cc86f1e485a5184fcf8206ec02220b823aaeb060fbdf9bd6e50f892723552a42a412592e4de7a65401aa395f72869f98bb3e9d3c78c9a280fa1a8660c494275fba15064bcf1a5d96269ed959aafa41cd289871721ccd0756a1454027a5a8167f055b38ca9be7ef6d85acb1f24f54f0241d5d95a504832c2de7dda2ac9701e98c270c58c7e3f923f2b99a79929cadf147374ad9ca3bffbbc6a9c0a8fa524cb691270b8660596c8af60f24894a9c0a8c1bf18569b7a94eecfde518130f4f2e09babd0358d760c1b21ef32b6ece267a0b0fc44e37075df6e369e3c2340a08d8abf3db45655c7886e333de5ab4c019e24141501f4a25d74470fbd8fd41579a5ea1f891df6b8fcbcc4b88ea7fe76ee8d206f44427b63e04ed209b8d2ca6091a7028132d8f8a46d16b2ec462b3e948f7c31ccc0b58682eb66c206551d343ef2f30692109a20a85b1ebcc57c963c813762d2afe216f303d1e996ff621073b1e5e0a2b475e1aeb329767edee27716804accd97649fa6dc98c0787c761cea51f7c2ff40556e82d219e9b", @typed={0x8, 0x55, @ipv4=@local}]}]}, 0x22a0}, {&(0x7f0000002b40)={0x188, 0x2a, 0x200, 0x70bd2c, 0x25dfdbfd, "", [@generic="3ea8e644f001dd911a04a8385cd85008bdddaf3a30b18f2260ba637858103f55850ed1a35749b26ea11a7924ea1da7924eb412e9ec816d7772c919cffc5262c05b3be0ff241c776485483ee8cdb912582ef2edda7a81d0f1099706ea59fb41b8331994dd0f89d71139e61f011f190d02df9576240da81cccabea4d47c4246af923eb74f93f62f16fc1148b6d455786ae61d89babb7c06850e3bf5c77efe1cc3eb098f9696f38398bf2c75f7752343b5d236d93f7837f33d30598c65f60", @typed={0xc, 0x4c, @u64=0x100000000}, @generic="066cc7e204649c47e5287fb840bcf5ae38c32cb7d59b945c494bf7f2adf265611c12ad4d7057a89d511bf6e406903e5b73d842d0528fc9587f544e79d8fe79493b3481410f1025d2e01d467d12b729993a80bc2c145b7aff40f87dd33de58f7ee7c5396a4bf1737d4db58dedd286c1678d0a1eaff47b279143dbdb8a876358f9880a9bd248b9c5370c4708573f6933a747fdd03f5baa75c3d2a543d71fe6714dd45409c794fc6b3f", @typed={0x4, 0x95}]}, 0x188}], 0x4}, 0x14) [ 503.491474] binder: 24944:24945 unknown command 536871360 [ 503.497096] binder: 24944:24945 ioctl c0306201 20000440 returned -22 [ 503.507805] binder: 24934:24946 BC_ACQUIRE_DONE node 1179 has no pending acquire request [ 503.513090] binder_alloc: 3591: binder_alloc_buf size 8192 failed, no address space [ 503.529167] binder: 24951:24952 unknown command 536872064 03:37:00 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB="1df7aa36862692aa"]], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='pids.events\x00', 0x0, 0x0) ioctl$KDGKBMETA(r1, 0x4b62, &(0x7f0000000080)) ustat(0xb05, &(0x7f0000000000)) ioctl$TIOCLINUX4(r1, 0x541c, &(0x7f00000000c0)) [ 503.543159] binder_alloc: allocated: 7344 (num: 240 largest: 32), free: 4944 (num: 1 largest: 4944) [ 503.556418] binder: 24951:24952 ioctl c0306201 20000440 returned -22 [ 503.573948] binder: 24951:24952 unknown command 536872064 03:37:00 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="6425bb9cf35f7dd207edd426a76c73ba80560e1edc30a00032883fdb2b18e71e92f16d4b4e1d112c5210e3acaab3c76b653e7b5c564767b8393f280ab959e5b03663a95e5107ac7e6ebbb9d922cfb59470418d3e0586c3b52873b33429b60ae3adf98f7ca0fb74050e666a63b145dac307f3fad2bbe0ce5fee41efd725ba26b4344269b53d3a"]], 0x0, 0x0, 0x0}) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x1, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000100)='net/ip6_flowlabel\x00') setsockopt$EBT_SO_SET_COUNTERS(r2, 0x0, 0x81, &(0x7f00000014c0)={'filter\x00', 0x0, 0x0, 0x0, [], 0x8, &(0x7f0000000140)=[{}, {}, {}], 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, 0xf8) set_robust_list(&(0x7f0000000580), 0x18) r3 = socket$inet6(0xa, 0x2, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000380)='/dev/zero\x00', 0x1c0, 0x0) close(r3) syz_genetlink_get_family_id$SEG6(&(0x7f0000000340)='SEG6\x00') r4 = socket$netlink(0x10, 0x3, 0xa) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000280)={0x0, r2, 0x7, 0x1}, 0x14) r5 = open(&(0x7f00000000c0)='./bus\x00', 0x141042, 0x100) ftruncate(r1, 0x6) sendfile(r3, r5, 0x0, 0x8000fffffffe) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0)='nbd\x00') sendmsg$NBD_CMD_DISCONNECT(r4, 0x0, 0x10) fgetxattr(r0, &(0x7f0000000000)=@known='trusted.overlay.metacopy\x00', &(0x7f00000004c0)=""/4096, 0x1000) 03:37:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="6425bb9cf35f7dd207edd426a76c73ba80560e1edc30a00032883fdb2b18e71e92f16d4b4e1d112c5210e3acaab3c76b653e7b5c564767b8393f280ab959e5b03663a95e5107ac7e6ebbb9d922cfb59470418d3e0586c3b52873b33429b60ae3adf98f7ca0fb74050e666a63b145dac307f3fad2bbe0ce5fee41efd725ba26b4344269b53d3a"]], 0x0, 0x0, 0x0}) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x1, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000100)='net/ip6_flowlabel\x00') setsockopt$EBT_SO_SET_COUNTERS(r2, 0x0, 0x81, &(0x7f00000014c0)={'filter\x00', 0x0, 0x0, 0x0, [], 0x8, &(0x7f0000000140)=[{}, {}, {}], 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, 0xf8) set_robust_list(&(0x7f0000000580), 0x18) r3 = socket$inet6(0xa, 0x2, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000380)='/dev/zero\x00', 0x1c0, 0x0) close(r3) syz_genetlink_get_family_id$SEG6(&(0x7f0000000340)='SEG6\x00') r4 = socket$netlink(0x10, 0x3, 0xa) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000280)={0x0, r2, 0x7, 0x1}, 0x14) r5 = open(&(0x7f00000000c0)='./bus\x00', 0x141042, 0x100) ftruncate(r1, 0x6) sendfile(r3, r5, 0x0, 0x8000fffffffe) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0)='nbd\x00') sendmsg$NBD_CMD_DISCONNECT(r4, 0x0, 0x10) fgetxattr(r0, &(0x7f0000000000)=@known='trusted.overlay.metacopy\x00', &(0x7f00000004c0)=""/4096, 0x1000) [ 503.589855] binder: 24930:24949 transaction failed 29201/-28, size 6144-2048 line 3155 [ 503.604221] binder: 24951:24952 ioctl c0306201 20000440 returned -22 [ 503.618852] binder: 24956:24960 unknown command 536871488 [ 503.631435] binder: 24930:24949 ioctl c0306201 20000440 returned -14 [ 503.637736] binder: 24963:24966 unknown command 536871360 03:37:00 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x14, 0x0, &(0x7f0000000080)=ANY=[@ANYRESDEC=r0], 0xffffffffffffff47, 0x0, 0x0}) [ 503.639847] binder: 24956:24960 ioctl c0306201 20000440 returned -22 [ 503.644158] binder: 24962:24965 unknown command 536871360 [ 503.666254] binder: 24962:24965 ioctl c0306201 20000440 returned -22 [ 503.672967] binder: 24956:24969 unknown command 536871488 [ 503.673275] binder: 24963:24966 ioctl c0306201 20000440 returned -22 [ 503.681556] binder: 24956:24969 ioctl c0306201 20000440 returned -22 [ 503.701820] binder: 24968:24970 unknown command 808464432 [ 503.718658] binder: 24968:24970 ioctl c0306201 200000c0 returned -22 03:37:01 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000005f0000000000000000000000000000180000000000000008000000000000", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040), 0x4) sched_rr_get_interval(0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') 03:37:01 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) ioperm(0x8001, 0x10001, 0x3) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='rdma.current\x00', 0x0, 0x0) 03:37:01 executing program 0: r0 = openat$cgroup_int(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.2MB.limit_in_bytes\x00', 0x2, 0x0) fgetxattr(r0, &(0x7f0000000380)=@random={'btrfs.', 'keyring(cgroup\x00'}, &(0x7f0000000500)=""/224, 0xe0) r1 = openat$selinux_validatetrans(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/validatetrans\x00', 0x1, 0x0) ioctl$EXT4_IOC_MIGRATE(r1, 0x6609) r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f00000000c0)={{{@in=@empty, @in6=@empty}}, {{@in6=@remote}}}, &(0x7f00000001c0)=0xe8) r3 = gettid() getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f00000016c0)={{{@in6=@empty, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}, 0x0, @in6=@local}}, &(0x7f0000000240)=0xe8) getresgid(&(0x7f0000000280), &(0x7f00000002c0)=0x0, &(0x7f0000000340)) sendmsg$netlink(0xffffffffffffff9c, &(0x7f00000017c0)={&(0x7f0000001800)=@proc={0x10, 0x0, 0x25dfdbfd}, 0xc, &(0x7f0000000200)=[{&(0x7f0000000080)={0x8, 0x1e, 0x10, 0x70bd28, 0x25dfdbff}, 0xffffffffffffff30}, {&(0x7f00000004c0)={0x102c, 0x14, 0x2, 0x70bd2a, 0x25dfdbfc}, 0x102c}, {&(0x7f0000001d00)={0x194, 0x37, 0x200, 0x70bd2a, 0x25dfdbfe, "", [@generic="284b7126dcb00325b704cb7af7ff18ad3926660aef39d40a755012b26f6166b11468667ce7b3b0725c8a9a3c1177818c6a9f6695e3b312c7141059df86ef29051ddd71541c4d92dee7cddc1754115dae125126", @nested={0x0, 0x5f, [@generic="c463abf65bbdd3937e3dac94c8a960b903d5e791ffd65df0105247410b07723637252a7e46ac490518e61f036c45a6b4c19f40e93526d3080331f2c42ab2f80fcd3bbc033a7155b648b9f8cff2000a3e77bd3024bea99698539bd8521df11441767eacb7ce524b69aa0703656d557ffbefd7dc555c192b0bf0acfe693468051fb539affe93900017a176cfe097eba1eb59582a625db092", @typed={0x0, 0x3b, @binary="6c03fdfec3039945d87918c0e1c81b7ae51a2619f2fbf8d8999db89dfeb88777c70704344c785dfb732198632be9506fb6cae7d867bbd890182d5859ab6ab261f95cefc38146c8"}, @generic="893ccd49aa1b17e1725cbdbf412ab42faaec080b618758cb90949172b13ce3da6bca8fed2c7de2f5065af872a5ed320f78e695763c93cb7fd0c8cac21b8792fc988e83e5d3b4adb51e7e767e68edbdd76891dcc03051d5785dce7950cc6f72de7e09ec2a60fe950220e8632d8c3d60624355c63e6b517aebd39399edc3e8651a70938340f8f3011605eb60528ce99193aa2d1f20eb2dc247887936c315f63dd85c7bfc1212", @typed={0x0, 0x3d}, @typed={0x0, 0x49, @uid=r4}, @typed={0x0, 0x17, @str='vboxnet0ppp1md5sum!:):)\'system&cpusetsystem:Nlo]\x00'}, @generic="d000bc8a7d91e6c157d564e2b303b0fb12f33b8ff20f961eedfb4e4f8551ee97717b52becb75ad5f46880575101ab81c32ce56b8fdc1b913d682ff03837278dbf067f15a5b911889136ef6dd2b685e82432e38a6813579c0c37cdb783720cf4fb6c95c84efc4a98c5eddbcf7abcaeaf42bedb57f4240390cebaaf189fe152fa6257706b9771e1d805cb135656b73099400efd3d3e28b6dab7daf4c3ec647e801030f730ce04df2c90b34d973", @generic="2720744420e19fc6a87889bea40485f6015f731ad312f953f3269d9d1b8b49c727fd2d", @generic="85539e1d4d47b7d579c991bd691e76221095a113b070ea17cecb9cca7629444e3a6bbff3af", @generic="cb6695638c518f95e2b3d43b23df6659ae75e56cb2c9d80563ac0ddb49d15dba4ca0689810abc307ba169a533a74ac4bf97287fb9c64a22d813f9437ad43dd0528471176dd390919f61da8d757c9c83355180218beb09c7672728ae6d02e3707df98096f4c3a992ed900095454ee8cb41bfa3b1a45b78901d1b9b0e7564f62e5deda62dbc064f1130dc009d5b56c0c119012c834a9"]}, @generic="514c78de607e758ff4ff30d21ee8a5f0488d707b8a9d13d91de44329f8676fad8c45c17768eec8c763e528bb368718a84a85d33e6113032ea36eda432d50127e9741664ee3b18b98593391ff4080e78ca6c8b1ca6c32d270ab24d9a9eaeb4c2b5d12c8aa0c16119713852adb4c13b6b7a5594b7e40aa2961b5c5ae0057e0fa308e3e2c149e73f3ea4753b31e3f2a7cb75d0ef453e55acedc19f592f1d1d14ff06360ba6e1e5e2bb8186b"]}, 0x194}], 0x3, &(0x7f0000001840)=[@rights={0x18, 0x1, 0x1, [r1]}, @rights={0x20, 0x1, 0x1, [r2, r2, r2, r1]}, @cred={0x20, 0x1, 0x2, r3, r4, r5}, @rights={0x28, 0x1, 0x1, [r1, r2, r2, r2, r1]}], 0x80, 0x20000000}, 0x7fd) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) 03:37:01 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="6425bb9cf35f7dd207edd426a76c73ba80560e1edc30a00032883fdb2b18e71e92f16d4b4e1d112c5210e3acaab3c76b653e7b5c564767b8393f280ab959e5b03663a95e5107ac7e6ebbb9d922cfb59470418d3e0586c3b52873b33429b60ae3adf98f7ca0fb74050e666a63b145dac307f3fad2bbe0ce5fee41efd725ba26b4344269b53d3a"]], 0x0, 0x0, 0x0}) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x1, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000100)='net/ip6_flowlabel\x00') setsockopt$EBT_SO_SET_COUNTERS(r2, 0x0, 0x81, &(0x7f00000014c0)={'filter\x00', 0x0, 0x0, 0x0, [], 0x8, &(0x7f0000000140)=[{}, {}, {}], 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, 0xf8) set_robust_list(&(0x7f0000000580), 0x18) r3 = socket$inet6(0xa, 0x2, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000380)='/dev/zero\x00', 0x1c0, 0x0) close(r3) syz_genetlink_get_family_id$SEG6(&(0x7f0000000340)='SEG6\x00') r4 = socket$netlink(0x10, 0x3, 0xa) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000280)={0x0, r2, 0x7, 0x1}, 0x14) r5 = open(&(0x7f00000000c0)='./bus\x00', 0x141042, 0x100) ftruncate(r1, 0x6) sendfile(r3, r5, 0x0, 0x8000fffffffe) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0)='nbd\x00') sendmsg$NBD_CMD_DISCONNECT(r4, 0x0, 0x10) fgetxattr(r0, &(0x7f0000000000)=@known='trusted.overlay.metacopy\x00', &(0x7f00000004c0)=""/4096, 0x1000) 03:37:01 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 03:37:01 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 504.225758] binder: 24930:24938 ioctl c0306201 20000140 returned -14 [ 504.233037] binder: release 24934:24936 transaction 1178 out, still active [ 504.240582] binder: undelivered TRANSACTION_ERROR: 29201 [ 504.275876] binder: 24981:24988 ioctl c018620b 0 returned -14 [ 504.277374] binder: 24983:24987 ioctl c018620b 0 returned -14 [ 504.286201] binder: 24980:24990 unknown command 536872064 [ 504.289250] binder: 24979:24985 unknown command 536871360 [ 504.296835] binder: 24986:24991 ioctl c018620b 0 returned -14 [ 504.307614] binder: 24981:24988 unknown command 536871488 [ 504.316202] binder: 24989:24992 ioctl c018620b 0 returned -14 [ 504.322519] binder: 24986:24991 ioctl c0306201 0 returned -14 [ 504.329195] binder: 24981:24988 ioctl c0306201 20000440 returned -22 [ 504.335626] binder: 24979:24985 ioctl c0306201 20000440 returned -22 [ 504.336375] binder: 24980:24990 ioctl c0306201 20000440 returned -22 [ 504.351889] binder: 24981:24988 ioctl c018620b 0 returned -14 [ 504.358320] binder: 24981:24994 unknown command 536871488 [ 504.367090] binder: 24981:24994 ioctl c0306201 20000440 returned -22 03:37:01 executing program 5: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ion\x00', 0x115000, 0x0) lstat(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0}) fstat(0xffffffffffffff9c, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = accept$inet6(0xffffffffffffffff, &(0x7f0000000200), &(0x7f0000000240)=0x1c) getpeername(r3, &(0x7f0000000340)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000002c0)=0x80) setsockopt$inet6_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000280)='bbr\x00', 0x4) fchown(r0, r1, r2) r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="33cf3a38deb701096039b52138f76bd517ead7da5cd54ea1fc26c6d61100960b54b54daf52c4bcdd01000000414232e7c428b8f3888fb7a4e5bc8a5ddf241aadfc6a2bf2d335ad5b190d572a190c0000000000000000000000000000f98163de6b2d2199a0ab36855dc91c652c989c5b40cb"]], 0x0, 0x0, 0x0}) 03:37:01 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="0000e60000000000bac2abd59a1842c15d909f2743d2d2300ad03eabd980fa09804cee79035a42d5ea762e786eaec3c70da08501520a3ebddc134b75ad8e0c88f7865461848564be09d3dab1487502817a472764a32f5bdafdc101c99781fc07fd6ba76b4d"]], 0x0, 0x0, 0x0}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='rdma.current\x00', 0x0, 0x0) [ 504.380793] binder: 24980:24996 unknown command 536872064 [ 504.387506] binder: 24980:24996 ioctl c0306201 20000440 returned -22 [ 504.391805] binder: 24983:24997 BC_ACQUIRE_DONE node 1183 has no pending acquire request [ 504.400295] binder_alloc: 3591: binder_alloc_buf size 8192 failed, no address space [ 504.412744] binder: 24999:25002 unknown command 536870912 [ 504.420691] binder: 24986:25003 BC_ACQUIRE_DONE node 1186 has no pending acquire request [ 504.423138] binder: 24999:25002 ioctl c0306201 20000440 returned -22 [ 504.447603] binder: 25004:25006 unknown command 536871040 [ 504.453964] binder: 25004:25006 ioctl c0306201 20000440 returned -22 [ 504.463053] binder: 25004:25008 unknown command 536871040 [ 504.464649] binder_alloc: allocated: 7408 (num: 242 largest: 32), free: 4880 (num: 1 largest: 4880) 03:37:01 executing program 0: r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x1) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000040)=@req={0x3, 0x100000001, 0x4, 0xa6}, 0x10) r1 = open(&(0x7f0000000080)='./file0\x00', 0x800, 0x4a) r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) getsockopt$SO_COOKIE(r1, 0x1, 0x39, &(0x7f00000001c0), &(0x7f0000000200)=0x8) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB='\x00\f']], 0x0, 0x0, 0x0}) setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f00000000c0)={@in6={{0xa, 0x4e20, 0x4, @rand_addr="38eccb5f7c9dfb0c31317961b2cd2196", 0x7}}, 0x0, 0x3, 0x0, "b86b86afe6abf4b05b06b1ab8ea05e8331399e77c847557037397d89dc3067732898b401aeef6f670d309c0993533266f5f1ab6876442d9b7597bc11c4de9b9d2b30e5956d0a14eb5a9d0eb1dd6128f0"}, 0xd8) socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) [ 504.469170] binder: 25004:25008 ioctl c0306201 20000440 returned -22 [ 504.484525] binder: 24989:25001 transaction failed 29201/-28, size 6144-2048 line 3155 [ 504.498418] binder: 24989:25001 ioctl c0306201 20000440 returned -14 [ 504.511290] binder: 25011:25012 unknown command 536872064 [ 504.520475] binder: 25011:25012 ioctl c0306201 20000440 returned -22 03:37:01 executing program 5: statfs(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/122) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@', @ANYPTR], 0x0, 0x0, 0x0}) 03:37:01 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000000080)=[@acquire_done={0x40106309, r1, 0x2}], 0xd7, 0x0, &(0x7f00000000c0)="eba16d4c5e57f5be6e0a2899aad3e615102586e4db4accad2174c5bfbd44784b7e605c42d8c13378b4b3ad0e29b31692ee59a7050e6184bdaca666f82f4fcd52eea70f41ddea84333563e30d32ef7085f175c29313288b81476c2e893d242df7a21e7f31036cd455cad9f19d31467044cf02426bb9c38efbe7240cc6bb9ece452660bf13e5f3dd952162979c3e13c22472b8dd94f6421cd76bfa7716920686706746b31299b4cf8d4015d957878a3e9acf6fc1d087f7d1ed9d22217cf526bda9e61014c4382f825c9134fe1cbe7596c964cb11bf1fa770"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='rdma.current\x00', 0x0, 0x0) [ 504.528348] binder: BINDER_SET_CONTEXT_MGR already set [ 504.548984] binder: 25011:25012 ioctl 40046207 0 returned -16 [ 504.563208] binder: release 25013:25017 transaction 1189 out, still active [ 504.566229] binder: 25011:25012 unknown command 536872064 [ 504.573325] binder: undelivered TRANSACTION_COMPLETE 03:37:01 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0x0, 0x1a6b851edb1208a7) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) getsockopt$packet_buf(r1, 0x107, 0x0, &(0x7f00000000c0)=""/78, &(0x7f0000000140)=0x4e) r2 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/checkreqprot\x00', 0x40, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x51, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="dfa912a2b62f28ca3dec5fce58d2f4938a2fd7f227884be9492e8bada61fd41f7e1adc436913cbbeefb13199a8cdc75bd8ac15708155817afe150bcbf565310f6da5be109f598428c5dbba4d843b9ff3122444d3ab60ceb7878ef3b205adc09a40888d2e55f40c549e8734283c88dd3c0c968446ca29df0150", @ANYPTR], 0x0, 0x0, 0x0}) ioctl$int_out(r2, 0x5462, &(0x7f0000000280)) pipe(&(0x7f00000001c0)) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) [ 504.576624] binder: 25011:25012 ioctl c0306201 20000440 returned -22 [ 504.588474] binder: BINDER_SET_CONTEXT_MGR already set [ 504.590978] binder: release 25013:25018 transaction 1190 out, still active [ 504.594566] binder: 25011:25021 ioctl 40046207 0 returned -16 [ 504.608385] binder: 25016:25019 BC_ACQUIRE_DONE u0000000000000000 no match [ 504.618549] binder: undelivered TRANSACTION_COMPLETE [ 504.624998] binder: 25022:25024 unknown command -1575835169 [ 504.631528] binder: 25022:25024 ioctl c0306201 20000440 returned -22 [ 504.643545] binder: 25022:25025 unknown command -1575835169 [ 504.649366] binder: 25022:25025 ioctl c0306201 20000440 returned -22 [ 504.659724] binder: 25016:25027 unknown command 536871488 [ 504.670856] binder: 25016:25027 ioctl c0306201 20000440 returned -22 [ 505.071473] binder: release 24983:24987 transaction 1182 out, still active [ 505.092306] binder: release 24986:24991 transaction 1185 out, still active [ 505.105101] binder: unexpected work type, 4, not freed [ 505.110818] binder: 24989:24992 ioctl c0306201 20000140 returned -14 03:37:01 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000005f0000000000000000000000000000180000000000000008000000000000", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040), 0x4) sched_rr_get_interval(0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') 03:37:01 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0x0, 0x4) r1 = syz_open_pts(0xffffffffffffff9c, 0x800) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000000c0)={{{@in6=@local, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in6}}, &(0x7f0000000200)=0xe8) setuid(r2) ioctl$PIO_UNIMAPCLR(r1, 0x4b68, &(0x7f0000000000)={0x800, 0x0, 0xa36}) ioctl$TIOCGLCKTRMIOS(r1, 0x5456, &(0x7f0000000080)={0x9, 0x7f, 0x8, 0xc4d3, 0x0, 0xb2, 0x6, 0x1, 0x9, 0x1, 0x1000, 0x5}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000040)=ANY=[@ANYBLOB="b4ee916cc46ea2650ac44e3be66d9b050000000000000031a86d2edb"]], 0x0, 0x0, 0x0}) 03:37:01 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = add_key$keyring(&(0x7f00000000c0)='keyring\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffb) request_key(&(0x7f0000000000)='cifs.spnego\x00', &(0x7f0000000040)={'syz', 0x2}, &(0x7f0000000080)='/dev/binder#\x00', r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@', @ANYPTR], 0x0, 0x0, 0x0}) 03:37:01 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 03:37:01 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 505.111267] binder: undelivered TRANSACTION_COMPLETE [ 505.122910] binder: undelivered TRANSACTION_ERROR: 29201 [ 505.156589] binder: release 25032:25035 transaction 1191 out, still active [ 505.162297] binder: 25036:25042 ioctl c018620b 0 returned -14 03:37:02 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x4000000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x6, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@', @ANYRES16=r0], 0x0, 0x0, 0x0}) [ 505.164473] binder: 25034:25038 ioctl c018620b 0 returned -14 [ 505.170373] binder: 25033:25040 unknown command 536870976 [ 505.178841] binder: undelivered TRANSACTION_COMPLETE [ 505.182892] binder: 25036:25042 ioctl c0306201 0 returned -14 [ 505.191649] binder: 25037:25041 ioctl c018620b 0 returned -14 [ 505.193369] binder: 25033:25040 ioctl c0306201 20000440 returned -22 03:37:02 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)={r1}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) [ 505.219595] binder: 25033:25046 unknown command 536870976 [ 505.225789] binder: 25033:25046 ioctl c0306201 20000440 returned -22 [ 505.226062] binder: 25044:25045 got transaction to invalid handle [ 505.239356] binder: 25044:25045 transaction failed 29201/-22, size 0-0 line 3018 [ 505.253374] binder_alloc: 3591: binder_alloc_buf size 8192 failed, no address space [ 505.263466] binder: 25044:25045 got transaction to invalid handle [ 505.263781] binder: undelivered TRANSACTION_ERROR: 29201 [ 505.273942] binder: 25049:25050 unknown command 536872064 [ 505.277163] binder: 25034:25051 BC_ACQUIRE_DONE node 1195 has no pending acquire request [ 505.281132] binder: 25044:25045 transaction failed 29201/-22, size 0-0 line 3018 [ 505.289517] binder_alloc: allocated: 7496 (num: 247 largest: 32), free: 4792 (num: 1 largest: 4792) [ 505.298293] binder: 25036:25052 BC_ACQUIRE_DONE node 1194 has no pending acquire request 03:37:02 executing program 0: r0 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10a0800}, 0xc, &(0x7f00000000c0)={&(0x7f00000004c0)=@getae={0x26c, 0x1f, 0x10, 0x70bd26, 0x25dfdbff, {{@in6=@dev={0xfe, 0x80, [], 0x1b}, 0x4d2, 0xa, 0x6f}, @in=@rand_addr=0x28, 0x3c, 0x3504}, [@offload={0xc, 0x1c, {0x0, 0x2}}, @etimer_thresh={0x8, 0xc, 0x100000001}, @mark={0xc, 0x15, {0x350759, 0x7ff}}, @algo_aead={0x148, 0x12, {{'morus640-generic\x00'}, 0x7d8, 0x80, "87150b69281671842abd4b0215e44cb13b61256e64d6fa60ceb469937017ef132be471d8aeb39c30ae42f8b8483c6a23562a04ac6737f22522c702a6609040a18af9e803d745e6bfc4988942c9dabc57d870dde484a1e16c9891c1749978e44307266938606140cf0f38e80ba4d7ab6247f9f160a91e439ed5b41b5b095aa1cb3f6fbca288d6e9439189055f3599ee5fd64f5227bfb0180ff3b3a88c1e576d2c6992001a9ea227139959019a526070a7bd1f3698b1d2e750c3f86f9530eb1fc0a294a1a7b4a8d256ab4952fa2df04da05c2b079443d715eb773dc814762d9040eabd80e0a610ea9f91d314ab6be5616da1c6d7311dc7c769712892"}}, @migrate={0xb4, 0x11, [{@in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in6=@ipv4={[], [], @remote}, 0x2b, 0x6, 0x0, 0x3503, 0x2, 0x2}, {@in=@dev={0xac, 0x14, 0x14, 0x11}, @in6=@mcast2, 0xff, 0x3, 0x0, 0x3503, 0x2, 0x2}, {@in6=@rand_addr="8f9027d1c45b4ed646e71111dd6330ef", @in=@empty, 0x6c, 0x4, 0x0, 0x0, 0xa, 0x87964cdf42555f97}, {@in6=@remote, @in=@multicast2, 0xff, 0x0, 0x0, 0x3501, 0xa, 0xa}]}, @proto={0x8, 0x19, 0x3c}, @ipv6_hthresh={0x8, 0x4, {0x8, 0x14}}]}, 0x26c}, 0x1, 0x0, 0x0, 0x4000000}, 0x20004000) sendmsg$nl_route(r0, &(0x7f00000002c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10020000}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)=@ipv4_getaddr={0x44, 0x16, 0x320, 0x70bd2b, 0x25dfdbfd, {0x2, 0x98, 0x100, 0xff}, [@IFA_ADDRESS={0x8, 0x1, @loopback}, @IFA_LABEL={0x14, 0x3, 'ip6tnl0\x00'}, @IFA_BROADCAST={0x8, 0x4, @broadcast}, @IFA_LOCAL={0x8, 0x2, @broadcast}]}, 0x44}, 0x1, 0x0, 0x0, 0x4051}, 0x20000000) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x801) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) [ 505.307832] binder: 25037:25047 transaction failed 29201/-28, size 6144-2048 line 3155 [ 505.324245] binder: 25037:25047 ioctl c0306201 20000440 returned -14 [ 505.326651] binder: 25049:25050 ioctl c0306201 20000440 returned -22 [ 505.339410] binder: undelivered TRANSACTION_ERROR: 29201 03:37:02 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) getsockname$packet(0xffffffffffffff9c, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000080)=0x14) recvfrom$packet(r1, &(0x7f0000000000)=""/62, 0x3e, 0x0, &(0x7f00000000c0)={0x11, 0x0, r2, 0x1, 0x9922, 0x6, @remote}, 0x14) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@', @ANYPTR], 0x0, 0x0, 0x0}) [ 505.369941] binder: 25016:25027 BC_ACQUIRE_DONE u0000000000000000 no match [ 505.381144] binder: 25016:25058 unknown command 536871488 [ 505.388053] binder: 25056:25059 unknown command 536872064 [ 505.389419] binder: 25016:25058 ioctl c0306201 20000440 returned -22 [ 505.401801] binder: 25056:25059 ioctl c0306201 20000440 returned -22 [ 505.413075] binder: 25056:25063 unknown command 536872064 03:37:02 executing program 2: r0 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000040)='8selinux(&self\\,\x00'}, 0x10) fsetxattr$security_ima(r0, &(0x7f00000001c0)='security.ima\x00', &(0x7f0000000200)=@md5={0x1, "d941515fa097f682ad97c0075db7bf30"}, 0x11, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rtc0\x00', 0x0, 0x0) ioctl$UI_DEV_DESTROY(r1, 0x5502) r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$UI_DEV_CREATE(r1, 0x5501) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB="000009080000005b705600800000000000007a073393121717dcdaa46ef14c552ddd694ef272add9f547e6a5968ad0a97567590d1a506429587d443d8e33006a2f7c1faa925351c8220d096aa49e5545545b"]], 0x0, 0x0, 0x0}) r3 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) openat$cgroup_ro(r3, &(0x7f0000000180)='memory.current\x00', 0x0, 0x0) 03:37:02 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) fcntl$setsig(r0, 0xa, 0x4) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000140)={{{@in6=@mcast2, @in=@multicast2}}, {{@in6=@dev}, 0x0, @in6=@loopback}}, &(0x7f0000000240)=0xe8) r2 = dup(r0) r3 = syz_genetlink_get_family_id$net_dm(&(0x7f0000000040)='NET_DM\x00') sendmsg$NET_DM_CMD_START(r2, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80100000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r3, 0xb00, 0x70bd2b, 0x25dfdbfd, {}, ["", "", "", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4000000}, 0x800) [ 505.420981] binder: 25056:25063 ioctl c0306201 20000440 returned -22 [ 505.451944] binder: 25065:25068 unknown command 536871488 [ 505.456048] binder: 25067:25070 unknown command 536872064 [ 505.458544] binder: 25065:25068 ioctl c0306201 20000440 returned -22 03:37:02 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) r1 = openat(0xffffffffffffffff, &(0x7f00000036c0)='./file0\x00', 0x400, 0x108) getsockname(r1, &(0x7f0000003700)=@nfc_llcp, &(0x7f0000003780)=0x80) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='rdma.current\x00', 0x0, 0x0) [ 505.470250] binder: 25067:25070 ioctl c0306201 20000440 returned -22 [ 505.473856] binder: 25065:25068 unknown command 536871488 [ 505.484133] binder: 25065:25068 ioctl c0306201 20000440 returned -22 [ 505.491890] binder: 25067:25070 unknown command 536872064 [ 505.497838] binder: 25067:25070 ioctl c0306201 20000440 returned -22 [ 505.528336] binder: 25077:25078 unknown command 536871488 [ 505.537564] binder: 25077:25078 ioctl c0306201 20000440 returned -22 [ 505.548447] binder: 25077:25080 unknown command 536871488 [ 505.554494] binder: 25077:25080 ioctl c0306201 20000440 returned -22 [ 505.956217] binder: release 25034:25038 transaction 1193 out, still active [ 505.963694] binder: 25037:25041 ioctl c0306201 20000140 returned -14 [ 505.984236] binder: unexpected work type, 4, not freed [ 505.990694] binder: undelivered TRANSACTION_COMPLETE [ 505.998738] binder: release 25036:25042 transaction 1192 out, still active 03:37:02 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000005f0000000000000000000000000000180000000000000008000000000000", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040), 0x4) sched_rr_get_interval(0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') 03:37:02 executing program 0: r0 = openat$selinux_create(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/create\x00', 0x2, 0x0) write$binfmt_elf64(r0, &(0x7f00000004c0)={{0x7f, 0x45, 0x4c, 0x46, 0x8, 0x1, 0x7, 0x401, 0x8, 0x3, 0x6, 0x2, 0x233, 0x40, 0xd1, 0x5490, 0x8000, 0x38, 0x1, 0x2, 0xff, 0x5e}, [{0x6474e553, 0x100000001, 0xef99, 0x1, 0x8, 0xe8, 0x4, 0xdda9}, {0x5, 0x3f, 0xf4, 0x7, 0x80, 0x400, 0x6, 0x9}], "c244a2f02d3ca01d315b78581193ce33736b45eb92bb4c94a231f4a708932cb75c3c4334e9eaa5ed7b8b8fba27c13286bbc5efa98d2f1d860db51c9377addf3cb89a0e66f26e6b760639e16f899dfeaac446e7e286574817e51b92fc087e7ffa9f940891863e86a600e34647283b8db29beb7dc972e8ea09201af3db96327c412265c4a2d21ea076c2e022657fcacf0ddda1e4ad79f23f4f2a8b4e743d0d8be55c015666", [[], []]}, 0x354) fcntl$setsig(r0, 0xa, 0xe) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_stats\x00', 0x0, 0x0) write$P9_RLOCK(r2, &(0x7f0000000080)={0x8, 0x35, 0x1, 0x3}, 0x8) 03:37:02 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cpuset.memory_pressure\x00', 0x0, 0x0) accept$unix(r1, &(0x7f0000000080)=@abs, &(0x7f0000000100)=0x6e) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='rdma.current\x00', 0x0, 0x0) ioctl$VT_RESIZEX(r2, 0x560a, &(0x7f0000000140)={0x41, 0x100, 0x800, 0x200, 0x10000, 0x1}) 03:37:02 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 03:37:02 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 506.006703] binder: unexpected work type, 4, not freed [ 506.012148] binder: undelivered TRANSACTION_COMPLETE [ 506.023535] binder: undelivered TRANSACTION_ERROR: 29201 [ 506.044966] binder: 25084:25089 unknown command 536871488 [ 506.047652] binder: 25088:25093 ioctl c018620b 0 returned -14 [ 506.054187] binder: 25087:25092 ioctl c018620b 0 returned -14 [ 506.056915] binder: 25086:25091 ioctl c018620b 0 returned -14 [ 506.067307] binder: 25084:25089 ioctl c0306201 20000440 returned -22 [ 506.069812] binder: 25085:25094 unknown command 536872064 [ 506.083926] binder: 25088:25093 ioctl c0306201 0 returned -14 [ 506.090759] binder: 25085:25094 ioctl c0306201 20000440 returned -22 [ 506.098896] binder: 25084:25095 unknown command 536871488 03:37:02 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='rdma.c\xa5\xfdrent\x00', 0x0, 0x0) [ 506.104987] binder: 25084:25095 ioctl c0306201 20000440 returned -22 [ 506.112006] binder: 25085:25096 unknown command 536872064 [ 506.123184] binder: 25085:25096 ioctl c0306201 20000440 returned -22 [ 506.129454] binder_alloc: 3591: binder_alloc_buf size 8192 failed, no address space [ 506.141294] binder: 25087:25100 BC_ACQUIRE_DONE node 1203 has no pending acquire request 03:37:03 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) fsetxattr$security_smack_entry(r0, &(0x7f0000000000)='security.SMACK64\x00', &(0x7f0000000040)='keyringmime_type[security\x00', 0x1a, 0x1) [ 506.141530] binder: 25088:25098 BC_ACQUIRE_DONE node 1206 has no pending acquire request [ 506.156928] binder: 25099:25102 unknown command 536871488 [ 506.165565] binder_alloc: allocated: 7568 (num: 250 largest: 32), free: 4720 (num: 1 largest: 4720) [ 506.173543] binder: 25099:25102 ioctl c0306201 20000440 returned -22 [ 506.179647] binder: 25086:25097 transaction failed 29201/-28, size 6144-2048 line 3155 [ 506.190721] binder: 25086:25097 ioctl c0306201 20000440 returned -14 [ 506.194138] binder: release 25061:25105 transaction 1209 out, still active 03:37:03 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0xc, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB='\x00c@@', @ANYPTR], 0x0, 0x0, 0x0}) [ 506.208861] binder: undelivered TRANSACTION_COMPLETE [ 506.214921] binder: 25107:25109 unknown command 536872064 [ 506.222787] binder: 25099:25108 unknown command 536871488 [ 506.222816] binder: release 25061:25066 transaction 1201 out, still active [ 506.228752] binder: 25099:25108 ioctl c0306201 20000440 returned -22 [ 506.235948] binder: 25107:25109 ioctl c0306201 20000440 returned -22 [ 506.237094] binder: 25107:25109 unknown command 536872064 03:37:03 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="96c88de345a12156ac2cb086a1334abadda25cfce8fdaa49dad6c15f1d6c14f34544dd6c40596d826f7b6e1aab0ea55a8dd46464ca069703a166b9071c51278776af703c65f5bef3a48def41e1f78d27ce3c361995ba2d8af0524f987cbaa1f0"]], 0x0, 0x0, 0x0}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='rdma.current\x00', 0x0, 0x0) [ 506.264386] binder: undelivered TRANSACTION_COMPLETE [ 506.278648] binder: 25107:25109 ioctl c0306201 20000440 returned -22 [ 506.285498] binder: BINDER_SET_CONTEXT_MGR already set [ 506.291796] binder: 25111:25115 ioctl 40046207 0 returned -16 [ 506.303068] binder: 25114:25116 unknown command 536871040 03:37:03 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="008f92c800837d62499f131e0c6ec28374627e59753bbb42d135e93c7e2b61c9ce1083262fe0a2637d099f50e7f713850160e7b128f64393916fd1357b1610ef45b96775b8bc78073f463c854b9842ac3a9c19e0db6965118dcebe3f6add64d635183c216063d3ba44823f6122b625b90a51584eec7ee13bf57280f0e9603bb7d6e1419096801b7f4927617a9ec72ee751390ff6b4d1"]], 0x0, 0x0, 0x0}) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x0, 0x0) syncfs(r0) ioctl$EVIOCGSND(r1, 0x8040451a, &(0x7f0000000040)=""/247) [ 506.310129] binder: 25114:25116 ioctl c0306201 20000440 returned -22 [ 506.323662] binder: BINDER_SET_CONTEXT_MGR already set [ 506.329821] binder: 25111:25115 ioctl 40046207 0 returned -16 [ 506.338384] binder: 25118:25120 unknown command 536871232 [ 506.338941] binder: release 25111:25119 transaction 1211 out, still active [ 506.344443] binder: 25118:25120 ioctl c0306201 20000440 returned -22 [ 506.357716] binder: 25114:25121 unknown command 536871040 03:37:03 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00g@@', @ANYPTR], 0x0, 0x0, 0x0}) 03:37:03 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="00efcf5e016eabc22924df5f6c94d39bc9fa75d7531cb5a7c0c107f60a9bd4ebec25b2107b6c51e6231a07abfe03ce58fe4ff5cff31e65067937d68569c034017fe23f5a36c71ba0df19764739094fda47cd3702cdc9bc2b0e4ef1e2abd567806ef4c2695317fc9038c680b6a1a717ef375d508d65d12e35d375244df399710870948e383a0bbd702d5124c7bbc92cd952e6cae3c1e3d7a7d5b3181bf99172bb30dfeebbd233e7aa94b258daaa62b89e4e155848f8b7dd2e3ef6e8"]], 0x0, 0x0, 0x0}) [ 506.360983] binder: 25118:25120 unknown command 536871232 [ 506.369066] binder: 25118:25120 ioctl c0306201 20000440 returned -22 [ 506.371842] binder: undelivered TRANSACTION_COMPLETE [ 506.383158] binder: 25114:25121 ioctl c0306201 20000440 returned -22 [ 506.396368] binder: release 25111:25115 transaction 1210 out, still active [ 506.408648] binder: 25124:25127 unknown command 1077962496 [ 506.424515] binder: undelivered TRANSACTION_COMPLETE [ 506.428305] binder: 25124:25127 ioctl c0306201 20000440 returned -22 [ 506.435359] binder: 25126:25129 unknown command 536870912 [ 506.446915] binder: 25126:25129 ioctl c0306201 20000440 returned -22 03:37:03 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000005f0000000000000000000000000000180000000000000008000000000000", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040), 0x4) sched_rr_get_interval(0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') 03:37:03 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0}, &(0x7f0000000100)=0xc) mount$bpf(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='bpf\x00', 0x40000, &(0x7f0000000140)={[{@mode={'mode'}}], [{@fsname={'fsname', 0x3d, '!selinuxtrusted['}}, {@euid_gt={'euid>', r1}}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="a3084976220000ffff5683557b"]], 0x0, 0x0, 0x0}) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='rdma.current\x00', 0x0, 0x0) ioctl$sock_SIOCGIFBR(r2, 0x8940, &(0x7f00000001c0)=@generic={0x0, 0x9, 0xfff}) 03:37:03 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@', @ANYPTR], 0x0, 0x0, 0x0}) pipe2(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80800) accept4$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1}, &(0x7f0000000040)=0x1c, 0x80000) getsockname$packet(r2, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x14) 03:37:03 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 03:37:03 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 03:37:03 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = accept4(0xffffffffffffff9c, &(0x7f0000000000)=@nl=@unspec, &(0x7f0000000080)=0x80, 0x80800) getsockopt$inet_udp_int(r1, 0x11, 0x67, &(0x7f00000000c0), &(0x7f0000000100)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) [ 506.842120] binder: 25086:25091 ioctl c0306201 20000140 returned -14 [ 506.849329] binder: release 25087:25092 transaction 1202 out, still active [ 506.879571] binder: undelivered TRANSACTION_ERROR: 29201 [ 506.897858] binder: BINDER_SET_CONTEXT_MGR already set [ 506.905996] binder: 25137:25140 unknown command 536872064 [ 506.915946] binder: release 25088:25093 transaction 1205 out, still active [ 506.923948] binder: 25133:25138 ioctl 40046207 0 returned -16 [ 506.924013] binder: 25141:25145 ioctl c018620b 0 returned -14 [ 506.931881] binder: 25144:25146 ioctl c018620b 0 returned -14 03:37:03 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) fcntl$getownex(r0, 0x10, &(0x7f0000000000)) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="dc30bc67", @ANYPTR], 0x0, 0x0, 0x0}) fsetxattr$trusted_overlay_opaque(r1, &(0x7f0000000040)='trusted.overlay.opaque\x00', &(0x7f0000000080)='y\x00', 0x2, 0x3) 03:37:03 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 506.943029] binder: 25143:25147 ioctl c018620b 0 returned -14 [ 506.944046] binder: 25137:25140 ioctl c0306201 20000440 returned -22 [ 506.953212] binder: release 25134:25142 transaction 1213 out, still active [ 506.958227] binder: 25141:25145 BC_ACQUIRE_DONE u0000000000000000 no match [ 506.965695] binder: 25133:25138 unknown command 536871424 [ 506.989109] binder: undelivered TRANSACTION_COMPLETE 03:37:03 executing program 0: r0 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000000)=0xffffffffffffffff, 0x4) fchmod(r0, 0x404bdaaf6fa3557c) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = openat$full(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/full\x00', 0x40000, 0x0) ioctl$TIOCMSET(r2, 0x5418, &(0x7f0000000100)=0x9c7) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000040)=ANY=[@ANYBLOB="3800a231ac443ede60d3785367d5f9c3e181faedeca87f120fe8808688af32fc76b7fab9e15879de627eb8ebbd3a6acef948b7f5c0ed1c51ff5ffa5857d6895243960cdadb2cf575cbd4e76d12937b7d23afd7e4"]], 0x0, 0x0, 0x0}) [ 506.996752] binder: 25133:25138 ioctl c0306201 20000440 returned -22 [ 507.009972] binder: release 25134:25142 transaction 1212 out, still active [ 507.021466] binder: 25152:25155 unknown command 1740386524 [ 507.034118] binder: 25144:25146 BC_ACQUIRE_DONE node 1215 has no pending acquire request [ 507.035573] binder: 25153:25159 ioctl c018620b 0 returned -14 [ 507.042903] binder: BINDER_SET_CONTEXT_MGR already set [ 507.057579] binder: 25152:25155 ioctl c0306201 20000440 returned -22 [ 507.061109] binder: 25158:25161 unknown command 536870976 [ 507.065074] binder: undelivered TRANSACTION_COMPLETE [ 507.072244] binder: 25153:25159 BC_ACQUIRE_DONE u0000000000000000 no match [ 507.082399] binder: 25133:25156 ioctl 40046207 0 returned -16 [ 507.082617] binder_alloc: 3591: binder_alloc_buf size 8192 failed, no address space 03:37:04 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 507.089885] binder: 25133:25138 unknown command 536871424 [ 507.096655] binder: 25158:25161 ioctl c0306201 20000440 returned -22 [ 507.108334] binder: 25133:25138 ioctl c0306201 20000440 returned -22 [ 507.113645] binder_alloc: allocated: 7640 (num: 256 largest: 32), free: 4648 (num: 1 largest: 4648) [ 507.117394] binder: 25152:25155 unknown command 1740386524 [ 507.134177] binder: 25152:25155 ioctl c0306201 20000440 returned -22 [ 507.135206] binder: 25143:25160 transaction failed 29201/-28, size 6144-2048 line 3155 03:37:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) r1 = dup2(r0, r0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.net/syz1\x00', 0x200002, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffff9c, 0x0, 0xb, &(0x7f0000000180)='proccpuset\x00'}, 0x30) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000200)={0x0, 0x0}, &(0x7f0000000280)=0xc) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000002c0)={0x0}, &(0x7f0000000340)=0xc) getresuid(&(0x7f0000000380), &(0x7f00000003c0), &(0x7f0000000b00)=0x0) mknod$loop(&(0x7f0000000080)='./file0\x00', 0x8, 0x1) rt_sigpending(&(0x7f0000000000), 0x8) r7 = getpgrp(0x0) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000001e80)=0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000006540)={{{@in=@initdev, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in=@initdev}}, &(0x7f0000006640)=0xe8) r10 = getpid() getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000007b80)={0x0, 0x0}, &(0x7f0000007bc0)=0xc) lstat(&(0x7f0000007c00)='./file0\x00', &(0x7f0000007c40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r13 = gettid() lstat(&(0x7f0000007cc0)='./file0\x00', &(0x7f0000007d00)={0x0, 0x0, 0x0, 0x0, 0x0}) getgroups(0x7, &(0x7f0000007d80)=[0xee01, 0x0, 0xee01, 0x0, 0xee01, 0xffffffffffffffff, 0x0]) sendmsg$netlink(r1, &(0x7f0000007e80)={&(0x7f0000000100)=@kern={0x10, 0x0, 0x0, 0x50000}, 0xc, &(0x7f0000007ac0)=[{&(0x7f0000000480)={0x660, 0x21, 0x100, 0x70bd29, 0x25dfdbfe, "", [@typed={0x8, 0x60, @fd=r2}, @typed={0xc, 0xe, @str='GPLuser\x00'}, @nested={0x518, 0x92, [@typed={0xf8, 0x4a, @binary="c428606c4d912ab75a2d3f26a0cc3dfa7852a7c2c8163a270a6e12637b4bbcbe3a3be7664509fd1fc7eaf69bd333c837f0c5799cdc3e0a7c0e4029c900fef1dc668d14e1dedcf6a64a2799256b052f845d7343e50f3777e6f194dc5c78a022b214b462bbb46c3d44cb0ab2f964d60e5d89ff60947517954dbf8135e748a282e4d80572b1ccbc63537f3e2b5bed7c5880b52abcd44238a40f55278d40e1233bd16065cba11140683d50ec50c97862aed94fdaec54b8812b11e150ce7a276ed96de81dd5f133658e0996948b64a2930e8ba75afd24cb1a8c47ccb8fe6738338f56eaa0508887185a15d47f0bcc302f480eecee1e"}, @typed={0x8, 0xe, @pid=r3}, @typed={0xa0, 0x6f, @binary="793091e761ef52068c76a3ebcd056bd6f1dd2d3d44545b2f4e7ecd3f199b228fddca431f1c143f9b13b99605913887937c7f269b8ecc715bb34565d711778567236d6cb99d61f9c1801a8ec30ad6633e8a1997ff38da2206c85f4d341f36d81cf0990686d5e80667321c226444ecd68d569f50973ce5473cd0409abdc382214d64e367a4df4e69270daea49cc6010ec0b2ef6d116b5b21e5833e"}, @generic="06ef776d6abdc697a4c596c3b4ea99459d33eb1ac7cd5705e3115c8555249099668a3866e0582f3b29f570945d47f8cf1862e362a6469335dbf0f244b94f5a9a0ed9b1cf457248235bdd71e83d5a1f466e486f0a3a599ec01dc6f1933487f8b49382e12f3ce01d9736455d6815da8a88e867563ee1ba6eb6e22e65267ad6bf27cfce7a58cf8b28f5ffffbfc8d9a5737bc4f02331de70ac8c4ed144d7deb8c38c270d7a58a5e093e920f729b6e1848b78ddb57fdf76142f81b39c21ccee2cf23f55922278c501fe4541d742ceb355e80852fe0f0db513a26214f382767346ec65", @generic="f3e4b4327619dced86f7dabf28c9b2a5aad8274db316c64f19a28a01146624c0d5665128c6d79865b18df06869b7144c016dca513baf39135644ead1e1e71f18c31f397f24c24764dbc3807f7d16be0bee909d2d7274cd05c5bbeb87d9f3543443c771e8a475432e43300a19d3fdbdb300a931c600a586ee52380bd546b448b657280f4bd126abcf8728bfeb9b48a10e88893a05e9b1c38c29211342c2bc78be40de3243f6ce3d433aa586a2ef5617dc6647", @typed={0x14, 0x7a, @str='rdma.current\x00'}, @generic="198a37aa1dabfd21f4031bc50818993392de593336bd2a56afcf52f0ba3f40782eb0715e761ed3b928976fd9f9f7aa2c83ffa6034653a07026c19bf26f842ae2dcda50d52fb7a1af073c0c79d824ecd65a321a7f42ffe8748f33ebcfeb36ae30d6131691c4afadd84669a76695d778a4aeda6d668902e9de61c4fec2109e42d404e607f3a03a41176c2f79a92ebeb87576b714b676646bfe17a5758044029f6323ee56347c7cdb9bdbb36a58b189e8b30623b1d9dc44c65bc66cb235eb1fc2752b1dbe6fc96bc63b4aa33dd250727aa0627d257f152fe3823124abb85951268107efe1b9752edf2158e9701ae25b259fda658772671ee7c181fd89ff", @generic="07e622d99010ef6da11163ec9c564a07820654e4d66a3a72efb5288a137a9b9b7b62cfbf77ca6d0287bfc4aadc79a3a796b60f6be014584d39dfa36d2e00c9c52585538acef845525f3800660f6e33754e13ba4afd627e88e687e5f4cf050032672e0012ad6963f6112b71b77747c9eb2d104c274612784bcea4359599a5ea6a9a1d74db6babcada2cac141ae7ca629d51e1baf9aa56b52ec48de076650e719c6a685a6b462d8f4059850f7f35a90db4440efb16a4e793422ab47d3e6b6d18ada8886d74d9a0b4dc", @typed={0x4, 0x49}, @typed={0x4, 0x45}]}, @generic="a4a4d876475ef5a52a366f103170988d0f2be9fbe4e713d5f8f3d5af59e3a2d67016dd621504b108a3d31e6d7c089053a090b5755cf44a6ec1e30b92bdda2e642fa790e64176dde876afc23da903ec09c4607c308fb0e0d8ed9f351b65d69442aed6e39591748529101d57e0a28ccd411e5f286f78f1b51042cd812f8ed94a6567a9609f7ce9a2abfde89f33c5468734496a93b9a6e17d6172b687411ade81aa9d65e6317466130e8f904f17ee99c47721be4b3a00ed48", @typed={0x8, 0x38, @ipv4=@remote}, @typed={0x8, 0x1f, @uid=r4}, @nested={0xc, 0x6e, [@typed={0x8, 0x60, @ipv4=@multicast2}]}, @generic="e5bd5b83f5d3fedc89923ef00b166db8e07639f67e8c884bec9011080a38bccd6cad074978392d080fd78decd476e92dd5d33420c6cd098b0685d798526c8681dc89", @typed={0x8, 0x7d, @pid=r5}, @nested={0x4, 0x7}]}, 0x660}, {&(0x7f0000000b40)={0xf4, 0x11, 0x100, 0x70bd27, 0x25dfdbfd, "", [@nested={0xe4, 0x24, [@generic, @generic="168efe854ac0e65ec7c4655d520dcdca81dcde51678dd40336e3bd20cfa21b4f55a574b62599841a969405fefeb66d1a786b8b59db155d1ef82a4962bff5b2201117d4410f5856759c4124936f6711aa7301545774bce1445833762ff2a7e9ddec1cf5695f4fbc6276f7af2f43113c262f4143e8263457854ed87f6b9f539e630fbe28f588bead80dacf5e617ec8b7b63e520af2e1cf563258f4f028e23e7ab11df27f70", @typed={0x8, 0x21, @uid=r6}, @typed={0x34, 0x47, @binary="3a54d6bdd99e2f851223f16f1b679108457ddfd18496f7a50a3181d7ab97b030834e8e40d1f8c5ef1077f1a35252d5d2"}]}]}, 0xf4}, {&(0x7f0000000c40)={0x1160, 0x3b, 0x429, 0x70bd2a, 0x25dfdbfd, "", [@generic="66581805ee088329becc4a9f34721f92dd6448edc85f885cc5338dea65e7d62d1e839eca5f7be6fccb594379f91131c3f48c6cf739a28b43949640e45f6639f901698243f298d68a9c28119725f5eb701da299ded8524765c78fc7f352fe8381a8fd", @generic="d6cbe308ada3b59eae767263d0831cd0858512c923cdb786d8d59b1a9f478020ca02b8a38659935ed614cf5e8a841989daa3b0b2b74bcffa42766173983c63057bc11af5cd7bd77577356d7206bc12be4a0957c39638aa00bf5b8b0808f6ef4ba5facff951934c8a650c319c88be0a229827c2398e874b0d3da5cd3989b01fac622963bf4583f57aa2840b277aab307fd8efc6bcd708d49bca1a", @generic="145583fabf575560ae8a64eefcc7fb2d58361145f94329f0e90ad4921f14ccdd13c24c5372a0c3e7c9cfb23b2b1cc703291ebd9e196f75ec54ffc2bde6278e539315c3f747a2d2931c8ba545c501be67c6d550bf6258667a7a7924faf92153dac36880f3a19c0b3b45ed8cd6191a15aefc2aaf07f1444e94067ecbfccc6e9cac32421283a696299d65dc10dd4e71dd3f32b6e8317576b9f8decd503f1a6c03d5ba76c172b790cca720ab1eb6a4ec5823c8807542a2f15b39b6a10bcdfc8345f1715b655cad1915ec8cc168ad3f365b676975b7035b38220343741ce09765268cb0a1489c4945b4b8fece797714bb30ee4916dcf6cb86002b4ea2ed5cbc653b5ee560cd4d08291b9295e273ca4f2dd18cbd2fbd140305d4343133205b9406f97d0403cdc1757d92b730ba029a812f8bbe8066152125e3adcf3496808a42dffaedf6fb88acc29e0cc3054291badb9fc03022b09cf2caf16a683474f3d3a82b59d76db4ddd4e92124b11aafec438cd6869bc78bc8095067d09926abd46304389db4785ba59603bd9d920d008ffcbfc1fb08a46ce59dc63a2d6a82c44349d64fdb6082244fbebb119ecb8f03c33cb0370f9cb492c908d87f1f949b73aaa2374cea841c62574025aa9effee5450823f6053c80e42e1ea6f773ce3a4129a3d485ad5a2e7893fbabcffbf7b97a24b30aff6efaaa6397beb4cfbfc0087f810f0d887546d524f929d10c1547b02c41922c92e6bf870a3abd7a4ccc0533d95a1ce555835c87b09d5b7e4fc576880bc982d8d308eb787269bf583ae0b19023df7a867bab93bdd2dc93e84e52931c5ae3805956959a51d76d377737f761498a10dab6876edd485a5ab5c49205118f39862f09ba358b20d7efad61713110dbbee410b5759b49a5e14df3aaa134e9a68d8e6007fcb3bc7d236fabe0579a9f191cfbe76244e148e1e67632d3f98cd49f5270a084a94b7a135d3e4b117228b1844b3fdbc5d0412d20434866aa5e3bb65812749c4bd4cfbe6afcb694984743ea57eb9501cf1dc0c860b20c587819915a2bfb4efe8af26990859cfbbb43075f89e49e7e2659db2cba92167ac337b19a31daba6aeb4dc31aa1cedc792348e6cfa0a1d0e9116a50e20dd53d60058f0bab94c15a542e105b0bf9e3d330c31f006009add9d9c3092b3bd3e58cfc3e53b386709e87cb50b6498a90251b92494c5841078d4b20af46ad1c83f06ebc3dca18e120bf60b6b5dd93a02aa0442baae621e54834c13f4f6f694205db6db406f54aaca41c7be88c23be31834007336041e58e38330e96228e079b832c25be3bd5d113caf34228a9915e47e363fba5a2e1ea90102bee9fbb234a36c245612a7ced33bd3a6c730f78a93e4a0da5ecc3ed7d1767ce110568b4dfc5a01734155616d0622064ca50eb610ddece5b1f2f1bd8cc2ae04976603fdc5388a861c2ca88e77c5cf4187a10d24929dac4f7f3ceb7084b29bad3e915649e601c6b6c67f4507b8df2d6ce95e6d91d176f9d72e1f34c06fd02d9d5d5eafe38b3bdb52a6287deec830b082973d28cd4c26815e6378d4bb10e03838ee02f86c8d93b805fb51e45734551900123cedd4d323d6c939e2b1c268a861e24fa198dac0b50e027eb3d9fa9eabb986d53fe4408127844ba88451d1c41e5fc4cd7fbf66f07df41ef662c9b2bbea4889a83169eef892391fd6a895d2563cd426d55041cef21003b904dcea17a34e70c2f49b20d996568d567aa350e9bfe1e4498e94093b4fe3477efeee3d07e8eb2010e5baf6560a183722d4aa3b1467e7b014981b6384da5ff27b0318561efd2490f8fabf700c475aef2cbbef115aa59951e8853b9fca8296b07e53b4c25516686d002e66da1a0633fcac6592e88e8c2c1dd2eaa2af8a82ae837fe24ee5bc4109e5cf5d124d9893b1d5e3ab76e3311f3e284ecc7f1f8e6afff12b80cb250736298356e495b1ad49be3ed5f3c2e418e6a150231d21ce047ae243b41d0fe30ab32361adf7f4e379df7175ac40b2c00aeaa5ab546472dc15d235e4c3a47747370cfc8569ac4934cacb8826f770af865e7740fac05d5a3c5e59ca5a7925c16c7274e44ee01de0bc9fa72d13aebd47969979c1a3f40e078f17d02a77ea0c56e3c03d69ac25104c1dcc7632fc7c7f7124422641cea340cf1c1e3684d169e42f8df87279245f48bba5fd9abede29babe72843da72692b6e3ba2340ebc71483ce96e02de16cf7b0b632295e66378adc20f39a278ce54f1084f12716613470eebbf35695af326977f859c0676f933471d30c717ef00d7d36610f13d01d38f21053055bf7ef80b0efd9a3b22c164e71676b3baab9d2d7c1e73ade97af0f75055438ca9cf8130d39818bb2a07a73ba72d452cf53dae1c0bf0ca7d86eb5bbc31cd5bea0893b9a2742918d40283b5493473c783258174435746ca5b6c15e838e21495407bbb490400dfd4b2f10813093935bd684d41ad6c79d81b6ba7c55b63091629742354432487934f348113e54751f6e5e27a7de9d2d7aa4cfb30e496b51f2df4824df2c6fca76d5aabe15b170a3a7127a02e33546a0f9b08a8a980e9e77e205a5d516d3ae691a2dd7bd507acd4141b7d3b755c2112afb8cb9f2810da6e535791a28dc85479ccb0907dbfb404e83081a2ad05b3e45c3cb85db7d331f5aeb964dc7f209960ee9073ca76d576ebf4af4e122aeaaf449d706eb8fa32648dc95a1262ac0521227d20527c154e4caacbcdb973dc757c815e5f8dc3115344efdf39dc0b90e115cc0b01ed15a3f6b208b9e6f92b8f0c0c864e8f4c2b01bab272d801312617f69819a9a19091d53ff809c5981e42d6ded5d04b35e2ecc4faaf3c5e4b1a33fe038f77c84be92652f9aedca63714422a12cdaef87adec10081b4722181a97b59534a46306dac4d99a7e977062c1a265a69b1f262f28d0110817df0ce9c8697eec76c88327bdda6c2932c5214c352a9c3e4ed877a27822bcef8d7af1b74d979b94f5bf6e373b48aa8569b3092264a79e5c4f1d53ebdd9a2626127f11b76838a82342d462a40b862ad818f2fd83a555bf4c2fb0bca0a0ebf7caad4335d4cdc27802db8c604187bc1db9018c7f6772c219c4e8dff876e38a18e86b45ff1cab968b945c06fb7f5df135f27da4e2316471cd2a8d016a3ee67fe16e0f89587daec29714e7af4814d8cd666247c2759fe77f4e0b393b595c8154e7b5020ff5a1adbaafc965016a3d35eae06dca1ead37b8037292bb19b83c90666ad3e555b1e6382fe4acddc70232183a2c394470da6a5492c90dac78d9d7727f7a9bf8022592ab16a9215b2c60332d7300228a4773a0459eed53074c8f21a87495e97ee8f6b3aecc6cd1828121f1d66c6bce2de2f01025abbe437292ece8dc0bfbb8cfd404fb02accb7e88bee8c9c087593cd78222b8cae33a8c5889755b559510c3e6b66ae0894b2ad620dd1ad7ce78a947447a85778ca17acec4edb75bce41af9ec7a771b5e08cebf549307bc480ea651428b9c80837d566e6d2a1c9c605396e6811d88f787e2c63d6c09beb727b8dec39ddcfd44d5ed071420831864e0068718cab235717c51140a11e610e5f8343a9cc80aecbd139eb8106917be66319670015bcc7114af8721184ee7bc9d70eeba6d6f470f42078f11fa57441aff6f5c955d86171f0ee7db512338f4613f3e190d3791b955ba777d884977e5fdfbe62fac3aa154f2c2443847f254b84d04eb30ea32fd6484b67f7d16e99ab7208cedde774861550fa0aa8db40f3e7d699c7adb5a57a504037c69d6853679eafee109ad28f701ce36ceb2148cfb054dcb03335c1bf428908029f0b258979ae988093fa8b6737c23632d30e2835708d3324f2a378c71852d0cad65d7ee93a139d1b595fa710779439713140dff9a9bb3446d54d3011875a0f5b35cd3e7993877d3c8b5e72589a7d13a4a10fd7d34ccf69720e0b1d2173192b8acadaded6288016d8f1e99c2c14117fcb7767c47fdd0d8cfb44544f597db99ef976bbc59d9e8659bab056f059b5604deda3e310050754bc5688c45b2c9d9ad710d76dccc14c6fe9a39548c945d6881137096126a1e998e99d15a942678dc8c387e428b5173a3f03c061b51ee18885872f8397dc7e4b60aea421080a21b8f7f0ba4f9d71e9ed6bc1ae0b4727509e7d75d2e2dd4789ae93fee31b849af41ab88f83b28a0e9bd7fde4fd59a7caaa3d2b7fbbb16c78f60cfacf8957ff65599419b247587fcd6ba8027a1c00fd9f3197ed56cccd8228fd71f8fb67dce0b8e3e7fab7f23b147a6b513230909b6a5df3f83dc5f0e480f8159a71a2540a0307ba9d15028a30438aa5973a86c4414fbabce81b8be16b57c5d42058fcdb58dc4fb054ceda87024cceab517fd653007dc3b76b55481778a21f9c5e3a71cb353e43293685349a4c7354530d38db0b56f035e8d8c1f2eed5e9ad6ddfad7d4826d8f195c68554e270f4e22c33657f4cb77ca9572355da0d80573a3a06b609dbce4c5bf5d6f97aa8a774b681f28d10a499ea5de2822ae7df3804afa579347fb58f9c1aa16c34d91d4abb61de080e72bd451648450a6ae4b4c6360934e65bce33b1674afa818676e7b283da11a17e039e673f74ec6fe414bdef34c0c0537f9c41c9b6a31a82d7241d6a35d6909b21e60c02ae7028ffcb66a21384e42bc02ee363c65d29a07c014064fc090a71c432f2354e956a3e7cd347d6995878fa33cb5e7868ba17d20eb9e6613eea4000e7bd74553a00ecc7458e3f0cc7e246776786c5aba0318f4a127bb17ee5b71cb224db76fc2aa796dda74929d5aa2347a02276abe9167412a801044cbcc9b4bfd6eef6856f32c30406a74650cb4a3574c03abf60c3a106d52711c24f50c945f4d9c05f70b932bea5115523e61d8bb879bdd6afe49868f517fa7c593abe4c04c5fc1462d714fd58e2f02a7d6be27e705c4b76f1ab8866877dd50ecdf1c9dc7c4e4474ea1c30e9cf49d38009b5fa7e8f0125714f2325a671602ce35f9f635a611dad2c152da888f0074197f8aa07fab1bf85239a0402909da38ae08f4e192c2220bb28a52b3c0a910867cbfcbcf2d074ff166c94bc4934b4efff582f1a9f5566c421fdade75f7508ecaec06586b3e466e7b2f9e3255036f2e3d4c2fc817b20424d97aa97166016fe248888d76b95feddccb624c6308100316134f2aad45a1934c9dfdba83bec39d030fac38ce5b7148e89df2fead1de4b817459d482cd531818e0c63f1013614165be417d59d9c7f3e8e15213312ba6f875e8dc9789be3390df0b87f6b1bb3a899eddefbc6f4810a8fa71a5a992abfeedefeda8757e60dcd7609d8fb1f63e620410dfa12be8db712016b654fb7dc6eb7c44c420ccfab15d6e3510f4b382f4bc0f0454e257cb3ed7680a0697e1abcbbd44a39273757015f4c25c90c79396584918d8e2aef4c544155036570717f7d9dda4558b89ee42e36f75ab85a19570322388a8a15ee46dec09d4162718a099efb01618226e85e482f0e8baf783d4e0ef27ffa61ae39f299e9400046d0ec68dfbddbd409ea189c83c679f084f91e916fb7f176b70de073a806db3912ffcaa3921a4a650a33fb4aaee23a2548f719da43f0bde3749b9e8148e95355e90474c04bcb392d1afd0bc2ed7be7f0f9b062e8a2e554d8e538f26c05f6857d8802efea19bd1af9b46dff3082b11c568d1609b2f02ddc1f1f595eec64aaa114c20d74f11b9e069da37f0637a38a4b715ef76b36c36f8aa22551a44b3173d15e8f3e6a4971b5db227ffd13c92898bdb2e061bfab9c0c8152693bcf1e15393641ea8", @generic="1ebed196aef07ce68e20919e7acbf23427c2acee290c93a33c62fe77d1f7f1b895d894e8d584be83d0476af1c3542dce4177a11d5ab96630eb7da2a73f1a1d", @typed={0x14, 0x7d, @ipv6=@ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}]}, 0x1160}, {&(0x7f0000001dc0)={0x9c, 0x20, 0x312, 0x70bd2b, 0x25dfdbfd, "", [@generic="078854c2f475fdc20b0bb56990aed783f63adf6365d2b1b75937a827c4d69c4bc6bfcc5e0b2e87afc34539fa1b789d20b75bd7398ed4a2e0960a6cd8bf3fa04e47004a6d0d4d5f354bc917bc1962c3f2125fe86273fb45271bb44a3d412b8d996803a8df122e6d92feeca402e6a81c2170e9985fd2a4fb9016bb4084a232864dd3b0ada5b7aeb703cf"]}, 0x9c}, {&(0x7f0000001ec0)={0x24a4, 0x35, 0x304, 0x70bd26, 0x25dfdbff, "", [@nested={0x1194, 0x8d, [@generic="2c4ffd5a39527189a500f88b861a3390d02a7b24aeda326fd3b07522fb59a75126c0b60292010e28d88d8dcf6f5cf94f95ac82b530b96140b52b57c8e8d8d4654e36fa2baeecfb9054c79943afafcf018548272b468c810ddb6844eaf41c18a5ab3454fe90b34491bcc8db4023124f58e200e58f63dfebdcafd5c8dd239af88dca7fba67cf0acd1d6295f8dd3525461f4ab45afc61942fc0e5a48978eb85a8ef33dea5514ec1543a5e64a41506ccf5f7d7e322fcc03b289f968dd63460bdc12225ad046b3d809d506e8b33", @typed={0x4, 0x4b}, @typed={0x8, 0x7d, @pid=r7}, @generic="d70bfd06a19b5411fd0fc427bfa5e17fb0c9c65c8c52a91e8216938af6111b944327ccdbba08bfd9893667598c835fc0c1a1adaef082b17d0f89cc823a2813ce34f4910897ce0c4ed794307bd91a0cb54f7b5d8506e339e8e4b4a88a59326dc12f5dd1ae5924d2074295a0b050be220811e4cd0a8967b534a5cdeecc9b2bb34bc4ae974e1318987620b5b073da45ae92e1aee9babaf728bbf36b03ffa7015435f8112a04c19bec5a903b47befac7f42e8f8ac825aac485", @generic="eb9bb814a799ff76ad91b4a59d6e5329d1b78f1ac2c976c7bd252da0ffa7f9980c01e86bf49905bc0f80065c1fc97d095e38f827a71a07d361d64cdce383ac36b7e259f8dcedfde2afeb76af7ae8e8c0c18974c160deb21d3218baecd9963c8aa92c2a6785f4ad1e5cc549305590c69f3803748e70ed393eb7e397fa8c610c10843b0a3a29166e79a47cb72bd36fa7038c7bdc3720b5f104a5cae2702664fe0fdd22f122d22c5956ed6c7b0c283a937cc3150ed318e3660c469cdaa9222c409407295650b7ae8f2c185edab3e3dae280005da04ca1d6461d55e974d4cf9b0921c3d94b68d37e013da839506679deebaccd43b4d2591d1dd0e59053f79517087d37d812c16137de3f5acaaaf3ebb058b908f9772059918d1c8e533ce9fa9bfe066e637457f502ec881716082d858f0bd883e9b0be33d2bd9fb49d4b8617869987d67b9a8e1f85502d1980210137dfe5406677c7fe8155d8838b9e1e5554cc36a914fbe7d96676e47f122af09d0ed55777b348c3b83db9546bdf7feaf734c1ce473c8972ffc1a16f798027ed5a6722caa66832aae9eaac900e263d3a87b0d03e1e18667947eff7c1ef0a476536812374c2369cc8d3a183f520b379bf252bab512707ba262a685b0b32e800a49983ab63a7ee93adb511784f3cda08e08c30f264af033a85b31bd6cad826edb78023a62f399d9df3581d23f95fc3ae1c894f5d92943627762294887aee7e3fb425fed7ada82e879635ca721cab49e3315f28917d4686a4242b6b1d40256aa26bd5601a50af7a49a923e9d7b1d543d10d31e878fb0ed72aeb05f32ce3e7a3753837e0a8c2e146d1438ebcae101852c444a6136366d0dc1e8b6f9781cc86153f43bbc3a8f50861a316aaa2dc3da2a53fcbf045076d63789bb4b852437564ece6dc09c1b1ca2c7f35b01a1ac975d050cd04d0dd13598189c12a87d6e88f3ff99decb56f989000a78d28da26a214f308c5333fccbdad1def61034dc74fa252e5fdaa14b5f14a892b7b489618a299c2167ffb31fb8fbce8e2f8ced7cc7ff1f4b89233b4fcd8f6f02adf72a5680dda6fa2085ddde521b60c5b8fc0c684777ae7cb3ebb45c3e2da56a945fb8e06fa95c08b59e9d7523f6cb4d184d74de4599f35092496153a0a117ea326f0c501b13b960ede773b70693b1488c5b17ca1eb15590f9338860fd424c8528cfd442311fcc977f66dcd4ee925fab95893a5c69aed6ae2fcb730566b1d6ec9533ee501259d5ada51283d56c1ae646bd6fa0bac8f6554b8ae6d517f50e0f14d2959e88a0fe22a01376df3905a39a1a81ac3cfa06af68e5172ce3bb0c254c0f851bfacddaf6c1add18f24182a642a4fb8f668e500a21271ef863421423356166b21a41071cbb81d2d0f5ded6843987139d7b0938871b1aea03d96254c636241a8de2b9835c8e1831f319e4843af70e56a426619d2afce4b6083fdf005ae4eca92462614a79972d618a64e6f1140ae110cf6f63e9112d7dc130f36c83b5e65a477f3ae9c63395793de9b0c7089eba14b829d90c9bcb8a6184c55f9ae2a0a2d9b27b1dcf9f9b4ad8072b1c87e4a1685bf0c8af92cd9dff7b082c1b6ca5fb915382508e5d17e246374d145cdfc2d4b2a312ee7eaa02424b07fd46278858a77128ad14fae4e25e65a826c5df55ca7b5fb81c392f4d146df7869f3a6f4e9b533c7f72eba9807eb08349539618e29f169330de84c0572da936815a21d4b5e978aea3481139086a8eadc666e9e9a84a8287aefc1b6a6c847d80a768aedab790a0b0b9bdc3b795d3ad586ce7eed4b775ae47c0e64415b9a1139b88b51ea9887c143a9f9b7e7e4c03b21e04aae9470b9dae78d34eac712ab1eccc7d2b0b9f1ad83b9e355c5866880583d443fdbd62effc3f9dc95216560669b8284e0c719daca0fe8fe5f32bcf4219763b2c6ae2a245bc98adfe687242a1471a831517c371e06abef711a0eb56b58c635e8bd5f2036eab11af62d85a9e72b7b7174f5be42a97ead35255c903b4805c3ed859e6758197f194bbf9ee5e919bcff8b7743b5e4cee29ef44b1451a7e525e11376e7d0d08bd37c14df5d805906f1a6c1b65460ac76f4dbc855d841d69c27dcb0410d3825f2b7798dc197a431de698d0e36575d33b69f92a74d5d85603f47c66a782dfd6a16a12c94259d380935700ca3caadeb529857aca6e3f11a5f1f2680d2d79a1a75f2b2fbfb9362f010ccf5725d93cfd0d2c5c2fd20fde8568ee78466c6e9e4d21ea759e11c3b1d2d7629e10219dbe47d61fb6b53363b85635cfda63f7d05942265622e7970ce68a1a8d6d6c155af135a9c1a39fa0855622cad48c1bde47e4a07ba962f5749f07e1104f40c6bae01fbbc95f8623926cf7e1124364a54d3055390cac3236a5e80b7fa30f504ce6a05d1f450f6338946d6d750c2e31371ad0bfa058e5308f924a347af4ac4bf05e8d3f9b987aadb9c814cf456663a85261a3697aa3ea89430060984b03c76c04c8d30257fa0bb7d2e8c1892e74270044fd78092b542905e459e2910e08a3186274ec47bd4e243cbd4e48b4457c00110883148f41f798c99c0dfa4cc3d2fd1e9b9f8f879a755c49a3dd630248680a775d04ec4026e7b676deb7810bfaf0d472f5c714d64c28d87a154fcb80758a6d364c698e85ad1c8e9564fcf34afc6bee70edff808577ebafd2362136a8640867901f8a1a04db7cb55e511773d30394f58578e85c73f03f95819e94a9fb60479854c49afddedd1db85bc5c15bbf0d3819ac1ccd9b3dc7d7b94c31c58adc364ee628c687130a3fc28acbfbe692d5e0b7ae754bba30e88211394fef87a4ea1fd1aa39af4ee962329e0726be682bed29e4d81a5f6ab0fe4da43ad45d96552a9b008323aadd22b977d892fd4b8de1b0e7bf0ff7f8fc72b467784253f4280a28ab8c5a012999e26954c50c5cfd0b4320bad6ec1b7d23e85a990866e685216b7f6a2d947aea9fb0620afaa0d3e27ff6dd45654fa247416a61136150afa0538c5961fde551d99c4af3adee92ea4457a89e0108e26d0088136c3bd7a2085fd33c05f0ed5e577e1a78212cd716de92f05866aa71d7beb5f9c7181208d9e43161f6f93bf20c3bf2e687a994dbb4349361467cd3c3e6a876615945b4fcd46e8f2979b2f4dc127da3ed27de631df9a0e43dab14f6c3bb523e207948b30065296b803db5a0b444c954939fd0632c732ec48e8f85fa6f1170f3906ea52b91252ab82b600dff6c487e6890c0ea0afad7707946a1d5cdaa50cf0a4a3a41ff863bcb92b8fb57bc16f04711c9bc120d4da9d2e53e5c851c58d84a5fb6d97e02cf73c52512da89871e7e3e7c208c63fe8492aae6e6bab68231999943bda1075d15b172bca40824516c6694a0c04a96b53d67340883e49b61051547c5c6e40742d22b50388d0ced1b011aebf014175463d3a03e165a1f00d7ed0cf9f60ea213968921babbf5f2a0ceb4e935c3a139eeffc87eb89cb26df0e91065020307bdd4d16d56ca835ee2bb0741f9321104e707624392396b8374761ee24dff7c24729fc912f030c21be6101d5e54dbdd592554c5685fb741df534149963abcb2b006900ff9ae12c26d8af0cd93c4d50bf16e4bc3e4edebec13ea6d451918654c03ce87c1c44708360422d823b4d316571d557a03895237b1248edc0f6a8b3b0142b13e23469d985a89297c56c691879949190b1d09f5322e51ff046d5f39dea92d1fda073858f0403c1055b706554377657719e0f013fc009e54f0e461645f911274b20ef8905b5c13ab9027bc063fe1a83039cd4e2e295b7caec7c3081d970ed96fb15cc9b9266081d98a2d6b68f799a771ac0e375d043ab2d237061e5731762e024d504f781e0b290cceeece613e9f4efa6bc264579a222bfde3c3e9aefabb257122de044cf20ca78864647c39cc19f5459f77e0f082201b819082f51c0ad5a571375c9e4d901838d88f3356d22da3395a9b6bc32d417308e95eb4b43c3a376537234898537c1565c6de4a5796bc5273e131a5ba642b46e119199cdf071237d066087a69b3beb8efda2f915334e0cea112156b97746126ea0f24eb6837841708ef459c4234ad5d8e5eff71b6dda16f69172ad4dfa9d236e111de0007d6608eb1a6769f1bbba5b5fcf51107d4a876284d2482ffb7cb759ab999c8e8ff0766f6bb2633084013543b360635e6424699b89b3c6d36ef749f0c1a385cbcc705abb53bafcec2bfa919a842d623a46db3f8f1c1c4b88ab78481a2efc46ed30416270583563d3dedb590282f1919e4ddd49f0fd279d4f57f42624c2ca86052717530dabb09dc29999bab7713bb50446b2be0ab0f937100db57ea438529c19f9858d534610d2c08c18db1a056c3f09faee64e3f1f6c9966dad1be0089dce4c0985612e0c513ab4495ea27462cf23677f1bbe46b5d252c71d920f59d0c3023c5cc10e690d531220e19a937ceb1dadcb8b03e43768553b32a892e20c147fca4188a1c2aa53ef0d9ee1ce7e0d759ba3592d41d2d7ee32baa00f2536dca44d8047c9210aab8da8c48c89d4f25ffc336ef8f7987a0b00fc6443dfd7241a53b3b74951f21efc7d87544a68edfb4db1d6fef62120b7c112c548fbed5bcaab8fd33bb8508cc440a6674d2b01b12e1944e7feb2ada43f8d036bc238b6c17110dd6f6dc210275e3787e84d69eaea6a2e326b6d5cbba680fd84b681713869dd55e4a4bc26f9c9ca20eae5de4c178fa62134f54179001d7f8242fcccf91605cb0dc9d3987da4ea8a173b0414b9db2ccdd6689ee4060fa64700826648a8c35180b42c8bc742b94fb908add9482cbbf6a392d759b647998f9b420eb709ce63c5a1d40b80f8e90f4ea76a9ada99b4b7d064486882547fbaf466e9d866f959353472dc1f072571499e654fde4eca613b3b00c5ca4746a58b173df4bcbeff7e03dfe76100ee82258c7fe9fa89f55638772abcfd0043bac2a72c19058df034a234f611596ecfb70f63972992eb8a3f4ab7a7b71a6ad0f3a8f2d7ef4922fe874897c90ac9b2e1768eb314039b3f769c5649fc05348130cdd1f689b2e7eb5ebbac6124eb2bd1c82729dd0661d4a871a2ad6bda04617346eef2f22948d63d367e89b46f99c52d7bd281ca628dd7c7a6c0abd46f084dff6b61e65afedb774ed8537cbe01519090ee940b1d62b3e2c11038d2427e1901efe1801df5775a7a01e4f945d22a9aebf57373bfdd26d2e162d17795d74edfb7304a9ae3c77422a9515460f761c3c07ce626ce6df52c12734b132b42b7e7b8e59b326ea48d07e52b122105e8033a94d198dc73936699703b47cedfe108a75cc27eaeaa0d2960a7424fc5280edb5926d16cca85436469d66ce49b8f1660a2f386f50218e441466f07d5a62a3e6fee745b67fb28bcda0d837cf1e78b111d9a28f70d11ea6e173d2f149793ba7c3d6e0658e8387a1fd40576306f3f99149a5c729cf2c0be584a84c784a9f16d9ff936758444bf0f3f8fb679ff4d8a51803ae278eebd2c3e8035f9ef813399ef876d457fd5ad5d3d820db926535f9c423e67183f83fbfe4b4fb19e5048a94281614c2fc3fda69c0879d7cf98455fd02100d5785bcfd136fc73cd4ca925de2fda8d9b924ca98ad8b84fde519b6dad661e4c243f9a390bca2cde143c2c94e983cbee94489bd561627527f4360083046a5dc1deb6cd6c3b4f141d2301db8ee2519d43a6ba8b58537797b94bd0cb322cd989dfdf4fa19f53c13a3037db53aed3edf4b45ae38f129e1a836272b6964d56a007557960b44e92ae90b3c407f2302be1658ee0f4fb29d58f476"]}, @generic="7b909fddc2196ea6b069ca30b114bed1b042", @nested={0x1e4, 0x2d, [@generic="30ed93c1537a040e0653857f2177f0f9cedc4c2f94935bc2bc023aaf1a449952f07cfe02973627a01166b3f240bc09101b21b48a3634234014c23282856237308ba4beffd4b50913744959f0aa32095d57bde59e5606f4d794bb3c8b6e65b1470ccaedbaefca3e03c04fcbf133ea9c8ea35f0d2cc5d75c03b279", @generic="0c82eedb512660e5cad4a7bc6f1707a9f5ea01267fdb02fec6992b2efaf0ee143f5e33e5069e774827661cb92fe6b6f3d7e8a2c969dd0fba3afbc87b6122f2f6c5a5e9ec1ff30acac03c92a54fccf006a67e1b87e6c881a800e424d1b1642074d44433a0f0bc26e363dc779c88f8c60c79553677e31fca78acdbbd7d121e67f8b124a0fafbfba42811e42aae3759e21685e7bfd5929179c03ac0bb8eb9de531ff9aebf", @typed={0x8, 0x70, @pid=r8}, @typed={0x8, 0x3d, @u32=0x392}, @generic="fe2ffd5df36d20a7b62ad2da81cfa27dbe923c0e4d5f643c52ec11d1fe35fcd5e84c7e94e0aa57a43fea0d5ec580abc2638f46c898d99328ebccc550d2886883f49d48d09cc3972ef86d89100d8303683b22e10aaf117df7b583a27940fe298fe85a8383973f9dc12cc3dfd2bc16e3ae78316df2ffc945b3e39b0c8dc2782b4da052b4dd8b841e2e0336b88ef48228dedd4f537e93a8cda24c3367aeae622cc2e66c15d7a7d9c2f23650928c3258b9c4f7928b"]}, @typed={0x8, 0x30, @ipv4=@loopback}, @generic="811dbe72c5d0f990b521e5aeec11dfd947415260020d0c566e810d80e9bc29d507e910cb7ea9e578c41b939f1db07e2da07c6c58e8c124895017fd3467c683a9ee3d3080280680544a1c6e0548621a423294a9ea5a74bf0a22c6ad6b4d0a6f6264d139974b15a1e4e45ec9dd0aa0da812c697ca84150e2e406be84845f4e427eae5a9ab7e6d9ff8c8668a8d6d56bf43cf2b928c189e55ef519b45aa5b99cb241033df12bf57ef96b6da1e88dffd0fde3c7e6ee4e5b17527c282f927426df87039d9d426f70b24f9537e6cd389b312286571378afb78f058172d210b9a76946a888c3a824fa3a02bfd44c411e68d52d3d2ec0ac054105a1c9b00676aec57238f7300d1ff9a8d29095ccf7646cbbf6e0e21f3b57ba3b41321b83abe68b98d830d3e411028ff2a75dd94675278b9b70a2f257b0e9f4f0505b499838efd7d2bda13b5483e048cf854a1d4f5d90526bdfaaa27467ea0c3da5189fbb43cd92a5435d16e65aa58d1508ac18ed394b942b229d01dc240cf952d9ce7f380457779d22e768de34a0a074d62b8c0129aab9682a7a664088d2376e0a71073db900c7e7d980a73a21b786b5f60505ac43863426893e30009679ff7954e235bd59b3b98b35cdd3cc1465832e056ff6bc133cf039a68a4a672de40a084a46778104ab1e0b2399a67af55c484b7a263479e05b21c62a6dafe4aba5b2d30cb7f97558efba5f67febd268844309d81a363f673e5486bdc55e76f617a11f9721844786804f22f34212e8371f03546bf60611fba64757f1a000fb0336480229a75ff257addd639fd9c65d8c3c6c19bc9124d80e8ca7b0a2b766632e70ff9aa7e9c4faad477bdca70ef2bbf33dab0dd3736cec1a0f1b9a4851ca55739bba89a215f1a99fab9355155f8a4eaecf08ba33852939acba374281b5087e54b8c8962995f7ca3fe5d1280ebd468a47008fa3def5ebb24abbf492a011cb33ce40c11fa740128cc59afd43e96eba201392dc4151a39c6938637bd5a66b6f93d49bca6d411e976b540979b3f7b2538a401e5cbe307d6cce029da818a005f8b60a3b6e52ea97040e8d38515be796c71ecd5d79a30cc77259b5de5ef8b5d4ac6a415d79f47effdcb9388e80c27f2dff385b2d0ebc348074f2a46a19f2352bb7942fb20a7c54b41d2342f730cdfc6c389d258575fbb245a494c669945ab673bcb2685c908c73d92c354f69790ee4323a77351e0b7cc3b1468460f4132b4ab520f6717ed15f10f53ba7aa72b8992d55800b659c8ad50f7faa68fc18654a6f4474f55d4e0e0dbfe82eacc8aa37532ca56a50bc5935c0facb7afd93350c8f22a8d48cf8e7c46a0568e1afef23e648c8718020de172221aa68cee6118eedaf7db97c8c70d33809ee39a71caebfed4e041cf942edde9307cff9deb9f5ff9ffc6b9e266c0763853d6540f1486e1f0c15b0aa79aad17296bdc33af1c836f07ac9efca96d0765d551ef1302357f4e177124583017da099906a5b7e6b9ded07922b2b13c46206abcd8360ac08853d665acc3bdf8356e9e436c22ec7fbab390513a374d75a735770a2b6b731ed0a23b21f8adaa2462536ab566896aa089373a3e036c432b9309ee62d92ae57f8cd14b017067d5d9d580574d33d552717274de1daba493e409341adaea48c5f71f216c97c052425920121c967caaed4c02d39706ada1a930898c1abf3edbabfb618351f11a38e1554d7baa3e5a7dd7254fbaf0ace2eaa92d703cc8890c4379c026e91b4d3f2fef8082b4b898d6b9f076353d6e6027f031c9b4dfbb674ccadc7b41e9fd7279eb9b2286d6c9707642351034bf452a1bc377bde37fba2823e0de5c7b75324446428a9faaa6352aea6b29da96bbb60c71d8da526d6196af6d178f2d9cf9766bb89ed8eae0480635a0e00dd6a1b12e58efac234958d825847115922c688e38a50fb3a4be617d0d123bf8e399ba2e882bad56f870c8772b0afd56863533111f4666f64c36b045d9da26223135a9d372eb25c2224f1cd0a1ff127e1624a5a2e8ebfc71671db6618b7a960fa30f4386bab243288d0d7fa5dc245db93cb1a0f86b27f4f0c450a4da6dd28c79ef144271c484a5c68bf0bd6568bf3069d0919ff7e6793eb743aae3c90476da043e2050e87070f333773ed657959874d43bdb43bfe0e392f147d6d57a731776f8818b557439c564a478e3f214531011cdd04f0f26fdaab7a3db7acbc5f1dd43ca6ccdbe93630d3b22da5267b8d9b6c8ce069ba582ba8aecb3a76f804b4bc72c6cb57acdfbf3763271803eab5780590cf5f0215d82a2f0b3fa54bdf66f029161a5c4aeafd796e4440c5d11c6c7525e024ffa18180845f94f06870f4bd11031afb53d3f14038a42f9183293571a02b21030e3ba8980381faee3bb58beba140d21fefed1d735f323224ae60f522e6cb7e60a2e74b17fa8b35fee4cf061e95b42adc75ac6e8db376e94371b5759933d47fc71f87ce58d7335eb7ba0617115b29c9582db43057e14911ed19b4cdefea4efbf9ffb5e41bd7f31c2368d9751f2ed114261203dafdac58d853c21d063ef3ab1f321f4e30fa66554fe46fac65e9c53ad8ee8f22009ffd2df9560d04bb6944ffe20bd8b93b7d9e1a33d2aa35d071f51b06fb9453bd813e2e17a1e7d5c4f3bb2979209e8f663ca6e6d61cd93061575c8f79b410524e0a3adbdb32bb7383db19826713f024023e21bdd27cfac07b8fcf13cca2b2991d4ce14b6d22a58f570e1817d493ee2d9398b6f42e0d10213dc5d50a2931d07856cb7d827ccd12c1331e33e8523b32a666010db02d7c609478c6041a8afc9a3e8a239aa5509575e15678df4589933fd8dd707229d64e16ecc9d336d646a2ea7a250587999f70dcabc321314c51aaca780e5ee69110285ef52ad6a783bff63ae3fe5fc70c35950440c3d2d164bcb7f12c1361a02ba7e4a8cc6abd1c2c62be3353654d32a0b1a8a37b72bc75b83175e799217f0791196d80ab315bb0b29025fdddb7b2749d5d7b4697ab49cb8c584ab9588fbb8f775d3c1f452d6c253298f13943d6b9d90d211dab1851b6985d9c46c90144add4d64618fa583fd2e8edbf0de0dc0d387ef56ff012213c092b2ba0ad0c6ce138e59016a7999d840bba9aeeaffb8b0d52c02a2b4610fae6b5cb75c97833e65070fa78c22208f23833375a02be761da3ef6f4200f34d7cf0fdebf43f7aae2bbf1e733f95b9067a9e778bea30dd6731291624a1cb69775c5e79fe67e944ee830228877277cb3668976462136c3197d7eb6d8118c5be99542801a215e452ed760be8dafd0b1a540a6f69870c4132545fb9d6e8896f29aa2e659e918bf38235f1bc4c8081686baeba8cdde63f105f2a27f112b8197e33224e9b1baaacac8febd1e99fb590c0b644cba6ca2adfb27a5e94462c1467cb1f59258421074474a84f6a3e4d1f28e180ba00f216e1713c2b68c9a131dbde2c531db5c174c2caf987b71c49ab52b2c81a35f2933114222744f0c9fe2f670d41fe7d5e814f3523bb7d2f51c7b43996370476825233353539d9ca81f08b5cd5bb7d958ccd41b59e6df2d2885bd59d31bf0bb3c8fcc001a896f213bb68a069e0523b485d88b69f608e2f0b0ac9e01a42aeeb8ab51233741799c9cd355e7fbb043f9a8c6976cb5cc44e9ee7fde8f92dbe852653121a2c1c2d128e916799969e3b92810bba833eaf10af711b21d02bf0ced7860673f1ac64d82eddfc6af733d61002351771dbce1a37e9dac73876e7b3d841cd284d2542af6aa2d773da31a09bfb25c4f708ae883ed787b3a66205e647bc5c63ebb3d2904d79f2a80ba4b770edc0d184fc3ccd77df22e723c49a38a8c2e54bbd0e4f11722762f0f7657edece48a02e1ea1d13c6ecd7c7ce09d70857d96b43951439acab681de24f4c1061b90b15ab3d21cd838ea90d18bf2eb1f2fd55192eeb5d5d56fb63f749c5ededfc0dadb0d31d12cffc227ebb255a35f04f45e307087fbd8dc6943517e1079ba185d9a0a3598bfe6716aeda94d8fdda01db648f88d26488cb4acbe255f82b4bc9bdd483b3ea1c2a3540ff6105b97b0aa50860cd623f4a90baa220f28effe06b24447f4cdcc284ee264ede0045e2d1d60fe938ea65ddb38adaed64dd1767971b2b2a607f07996db21404ec75883cd804d7fc30cada70589df666225947009ec035038ee7fb6d5f6824142641c30fc38a9b7f14802563c804f890ab3b6ef82114bc5acf0b241186dfb996acc2ed3e2dcd95f0e945f095672ea48ab674e7fe6cb74d3ac99e561d39276c7bbd20af676646eff433ab9a2db7de31eff2a5bdcfcf4cc8c510ba38df5fc7ba74a328138fc537b188b139d931767c3c020e64a12f7567d4d245b6b727f054a5a1bae671cfb3fdb71cc8720413a0f4238b49022e3275a5fa099031eb40acbd55a06524c9352554d18617a89fa3a658ba01401aeb74dab7c12f0effd286f3d068450b17fb70f09017c2452477ca7b303f4a86207ae17ea42bf7e5e92e5e867a2147a33121015517f9babc3b685afe9ed3b7c6af47b125ef7e7065148402801345295114633f1250de38c39ad474cec6a83fdb73c4b1ee8a3a0ebd758048b43f21b4724eb90ca5959c2ad60c9040e30ab20dc0a26c1bb66b70affaa8f84de5d8b88d0da3ed6238d2d7ab9f45631c5bf465958094c0d9e72192660310b8b27d7aab086ce4d32f0b18f052523e0ff4af43b9d197195722061c249e6c3b3cbb1b949002efe52b6f384c6f2cabb1fa4d3c29015109d7c9c01bc45f7127de1e42346e77b134561aed602798f75faa5fd79d091350035c6e8e221350df33c77cbcb67555dc7ffb4045aaca070713160751438097fc7b23f8020c9116f062e87d03c8e246ee251af978bc80808f876dbc93e751c4ec29f8294d4d1fd5ce3e6f26858533ded318cc68c2bccaf7de3dc853ce923ab6661cdf1444aa36945d859f5c5962f415874020569588fe7473f9225334d38e2c86918ab65127d0bffcaadda5fdf3f80f9f8349df451f8d67a17ad51850eadc3fdbe755a48b236ed665939ab3c38580098cd744a3846482a1a6e6287381b7750a5643dbdcf544c773bf5e764f95d369da6594855785ef9b0c0ee35cd1a3e9c01e4677d6e39726858739ca01ce3375a8a5be71b93f30060bb9921dc10cd520655d6a56f126e93a28eca8b19889be9e577eb67916ec33c5d49b01180df9f339f2786340212ab5ad7f9d4dbdcb3df7a6e92252e3ecf2ac00c3aede6366fb1ef7eb6d90f0534c6f1db68a10c073ad69503cf12a11f22e4fa11fa5ed77de13cddd3f341fee0440437a7efa05dd104f469ffb80c17e175004d5c2f8d982fd69d789a23e9ba7bb02d53ab3f6595c2781d9aff4d5cfb7b38c0b69218b7c381238a39cc6afd64ecafb04349efecdb5fed79964300590f04a95b7db02a69900670e818a2dbfe4ff9cf6920e9e915e1c677127c0d9297da5fde8818ae0f249cceeb733a086779a0801a00df05f4b07b6dcaab77ca24e2cea64391c6afe31267e2e1e2a27da3e2652319226529872bca2d6748950cc6eca4f2a2131022a7b3ee6c08c3802572916cfd139f24fea72083d55c91487c9f567486c9063021cac48feb7187921a73a2b29acad0e716035d5bc81a8308c6f9ca2e70a40ac96b5ade9ba204a4b73648df58680805062f1fed9b4f39ac942331cb41b2e4aeb0e81850d1be56293c736f7fbe4771a5c96ebb25bc2ff0032bad09063b6a033be55ba437dc619bb682b74e1ffc8e000d92a3fefcaec5f97bdd77a9ac8a2b78db7cf2c7c3c9508cd6ad41a96226f", @generic="ed705f2b385cc171769fb5000556317e9182118a806f9c44b6ed5fbb075b4f10524adc9c2772ecaa2bb025fae4e746c09b5700c5dccf2d9493bb7d35818fef5d", @typed={0x8, 0x8d, @u32=0x9}, @typed={0x8, 0x85, @str='\x00'}, @generic="a62c1f66f976ead9b4365660a2dcbdbe9b2756288d5cf856640ef8b3d5a60f6c3e2c03b7e98956774acdea8e22c766ace568ddb3192af25297c857c996eadaf3940df47bd5825d5f8144dee8a3f21b060c73b44525fef317e6ade6d4bbbb965cd546e4f76aabce43d959dd097de989dae8d7231a2045c916c2be1df81d276180b6020f5074dfcb04f073820ca41d9ef3f1f62fa2f8d02c66a8ff2c75fc0b9a88cce3fa0735c9315a4ce54f6d6654dc1439bf"]}, 0x24a4}, {&(0x7f0000004380)={0x78, 0x18, 0x302, 0x70bd28, 0x25dfdbfb, "", [@generic="b831dec614ae5f168870da8673c5dfec7b5e9925b5c4b46991c5994b6e801746cb6031d9642ccfb37bd26a1566b26088c4953a515bc0563d170428d8c8af8eaeaa46ebbfb7c86b69f7e61977c5bf3c354688d864af320fc6755523d2fad078496db51bafd4a569"]}, 0x78}, {&(0x7f0000004400)={0x211c, 0x3d, 0x100, 0x70bd27, 0x25dfdbfd, "", [@generic="cc08ebd8456504309806306cafc26d9db122dfc965a9e61417f4cdfaf2d3ffb0b715b28795e6957a551b86986aefaa68baca498bf7afa60621c985243bbff570", @typed={0xc, 0x74, @u64=0x81}, @nested={0x10c0, 0x8f, [@generic="d74d40af7816a45d50c18c531ca04fb4410de129d4ee1ba418f1fdeec581267505a2876d6a74c01b8b85f86f6d92f721a9b274461ced030aa2292b5396bba7dbd6babe921f3dac5bbbbb720f57333cc05d12c0ed41291b876a1bbde3de1946a7c4d2ca5d9bf40463e3df24ff9e01f52388e629b51594a70c145bad06fcd19e889e407f60a45930d3585489c0d6d4ad19e07006970da243d07758ae936f39228be4cbab80375002b8b75b553d1b396d902a757a766e1ebcfd8aa413", @generic="6028ef6b3f65639713ad1d610ccc1d926f6a8e3e9ae580f6c61764fa1b644900bf6da8b24fef34859442ae5e568073842864804bc9022362e88c381f9828b76d91870f908e401784293f7594fb9b0d3ab458feb0a71db8f5ff2d383999af6e3ce519cb03cbff21f2167c25cff30d3e3960f179f6160a790e915f0f7d7c27116663238751b2a0bb19f89e936e0d255bcc84d935229f0dff85928970f47b7c73591986a285b4f53855de56e32523e85010a1221577d414a9d581c17a52738cb7d0dfbc383646403d866e2e80d93b99815a6ac33e62f4e8f169f27c41d86bd08b3605877e0c40ba12df0c593729b83757047473e7a522e9973b79db8167e904e862252c47f3e1e46d553834c34ae04875f6cbc4d7217a05dab8bbe6a8eed9553ad2ad1f3f33a892f7ea57b4d04272ab94968ca602d1bea197ca8b486bcb14967719d5e9a8a05946e3642ff0771064fe2ce80597b77c4051aeb5354c1e3efaa5812251a825f8a27b1c69ad15e0c0cf7f44e991009f636ebaa989ade0c5b0c7a3b3445b2a779e31d500ea41a48483efc3baa65e0c04e1957a0e6331b8534b84dc2ee4875b2775d21824a3e3e34afc48971cc20e5a9383af89e354f9f747e113e9697686a6c49de43e886af00d4772c2e01faff1896fac7c622d41911158ab2dd2542835407efdf414259ec4ad38b4e8c203c7f662993ffa82e42d667674f40d97519eab3946b102bedd9c9f5dbba6678805dd85ad1371a8f77815614c907150dc19147f690557811e5e0b8c143a31aeb029e8ec8d9046cab5343bbace0c7ed5e1e4b6227171ad51f6f29a8343a4c10930d0e5a9005f2317c865a062b9958a3fd3f18d10f403f6e2a3e9c26353ae2b0b1738f18cdfe7c0de2371e380110ffb25197f045639b3ee53a2403dcc5b3f1c313a28dba9db7541a05537e87679c31daca7314b2d6d9d9322adfe38a3a74c4fe69216e23d850cce938a0d24d01b1de4acb6d301dbd95d5f82d17cf9d11ec73bee5223ca68009ddaa85e4d1ac9ff8ac39ad44782d379da214c387b26df257f65d0889ed9016b631e0bf499b82835a2b4305b1c1d4e98e84d3433d7c2844a9b98dc5da8f2c0c1b01ac6ac935f5e1aaf2e331e59e59abde459b1e67ee744e226cb0ad13784d8bdccfa3f73875188cdeca6023ae62f6f6b9ad100dd954094f1f7c5b62de5592a09169497e9326b7505ab8dc6f192f611f1f34007851d9dd4250475d3b5c9bc52e8167efcbd5ca4a80b41888046eae611cc138f53d50dc898505481a7b9af0baa590a7190ea6ccb86382753b3a953fec5517ccf8883b966d9ed8a281bd88f36e3e4e9dde5d0623485c1e647f468b5688a627eaf4ab0f3ba39b1dbec63f19f65017b3ccb1a2c5a2ada96cf8fdea1977ef4df9ecfafa8488ebf4e837987557aa58ed85b709c5b9badde33700442ff6d263529e035362f977c9b7332eb4b4c1d2b77e21c97d71887d0bacb2baf8146d32e99845f95594e17836ca58d710f52ce4a6e096961bcde280ff89c8d539d5ffa6cc557bac10e65124cffc081d5690501dc9109aa9453e40bfbb709e5055c07cb919270bb19527485d2c830ab1216cbcf18a325629c37809a7fe964965452edc94826573f989d5ac8e8b8e33df038aa2fd774a112de458711c797a4cf29628c70d27c1c075b688284f00f2afa3184848efdfe24759398ed241b206e78cafb0c66a02be7dbcb81ce93c68733ecf15e2c59414771235cd2bb9474cc48ac0105e3f5f69eb569906e5a6a278619b300ca077d405a6a203f24e791bf08836c2f21b8a1a7132b6b7d1d9a943e552b82569759e1aaac41f774c044536898b857dfa21f4ef904d5419e68531258ef82071902a4103b2f375f07f3a669e183f668284557d4a1c3492ab6993805073578025edb3c38fcd72975c5b5a81d3a82a274b230852250757956dfc82aa78f4653a1c26204f98c53428a81c6e5d3e4ec785fde306fb169d6887f1482b567de61102fa1268972a206f2527e0c25ac50b6a5893f2a1ed99e420e7213bcdac8a5b98f69855748e59adb93b09e459aedfaf5bab8c023167aa0eef2657d19b58bf84124e44b7fc4c9b8884165d788dd723bd2c9bb6d3848136b0e5b017632e0842cc420ca54bab5eea04fa926fa7adb26f15fae6d67aa1d054292d73aa8c2de4d6bad93ab8708b0ef848cfd09514e80cf19003b7277bf4cc16c0d2af04224b3ff8d1974a5bad04184507441a15bcbc37eecefbe11e6ba9922041bcd060fb03c35292f0770ef7ebffc63791eb9c61135e5e33ba57d445d48626d25b85facf54d24b9aeb58dc0fe4eb09a3291112ef74ffb625b7102230836339310b2d7e3d0dd6940897ae96e31ffba1f733fe93bf3abc5607bef63cd0120f537f9c0b460e41e71ab10387af2452cfb6aa7eda3c6f8c7d680af9e94c68d23d9770b96ad0312ca6cb62aa0cccf8bf22f1ec5518e9dfdb435755dd8793639480def10c8da023251c52b1e10baf4176720870c203946fe43a71bd1944a2ce02a876bbc56058f7cffcb351c59dff1eb381b0367086ad296e7fa6ed9255da6946e501a6c68c88a1fe146574ded2dd0a4198e08de3087c3fdb927cbd6c675aa9ec6382305ded10fb636ea0405a3bfdbed38da7d6f3b0c2bf642fb3dac9c3692a81f670f8fe59cd661a5743a0ebdfc159d3ff20faf1d2c1ff049b6bd7205942fdf4c48b57074307a8209a7ebe4638b05c7187262ca70b9ca8a3abeed36f1a32fc505a07d699ef68273f8b3fad87d4d3e0a391ccd616e8669090159f44d85eaaa78687c71e4fecc6bf1a0571cd35161f6cb86af2db9951873e9e6ae592e897ffd3f3d5c05a644661152649296858c7a9fbfabeb13e26247e627dea27bd0a84fe513f00662967f34f521c7e961ab3b19a275c5c562ff6df44a296af9c0efd519020865d80af5cc85848821df3c92bd71dc6b5d26d95bd1405167921c1921095a6519b7849c64dfa7b9a382e5ececa01b2f608c6787cc2cd84ceadd274ab2730a6af9f27b6c54a9e4cf0944ada8d158233e4297a4f30c9836ea5731bf74768035bb615eabff39a05f51d2efd6d03117c06571649cbcf711d0fb3e00f596a9f549469eea1d8d30d07f6a07bf63eef4a7e122efc2681a9c226507b859dceea056c2ab876ca74285c01b7bb72eba07a9da45e9f92803af02f62dc3bbec02b38ed674692dfe1ac0df9179e851532638d418f8b0fcf95cd0458f8059bc18c50e85e85a7bbfb5e3e4d496c32b05998ab2b44a9a95110e5bae4f39462cbdf74798003f01a6c54f3dd0f9ac71071595202461bca4a5f537849e5b84698238bd973c140cf4aa25794c36a235d372a32dbd3b29dbfd72cd3a3e91bd9d26a5fd4b9eb68036cdfb5ae7f823ded1bb554bb51243a39164f6a214f6e274bf7c7ab604b286ce2effb7ac93b1105bd52356cb9e880d62a351d9d4f0678930c0635d0bfabbac97a6c25e2ca988a19bc82186312904fb3969d1367e78678dc93cfc76ac02fd108a2a398a4256d2f80038f9c7ad2c94eaac9c6b60ea7a7c575fb2df0cc56deb2d0d3d0a253541de73233270afcc62d8e71619db3b819f61e430995b04220f405d2a7748beb69d77c56e3b12f4526f139e8cd32764b5dc8244535b00cc2d5f8dd7389ef512fd8e8040ad1ca537cc15141ae96136cc2d747cf666111f5aeec4ef4faee0b9e4e2513c2ae3c295bce7cb531cc98eabb355108c2e99e91cfb5145a98de478c11063d39cd411f193476de6ac49f19ad942c11f4af790d31ce4bf45750219bc936c5c7b1febaffa43049c964045443f0b6a14d36d0de29b278be8e8b7a916bd096b90598dcc69d77a06dff0e6a74db2d622eb933154cd74150b635973b66e44d3ca28f9e5bb36ad0c06ba59abce68ae697c21e64ade90362350f86ca10a6be158cdbf9679b5f7bf04b2fb9b3d1d44cda27b89d2fed585f32eafafc2f981dd5f5f79269f2c92b5b00363c486fe35040c9a37801fb714e8d442cb4d2e5db3f44e7eaed15c1f08046ed7b7fae76737b27d87ef3b013d8236dadf6024cfc8a3f15eca63cb48345b87e0fa70ae15fcc367a691b5dd3e2281ba631b52d5acd9d905240a6b6938f561c55c152194dcf85dd87e0ed31fbf82ec0e571e513fb47fac88f3419e91feef43a401da317ae069d6bebe6289a3e01a7b70197c7bc133d3555138ea31e461090f43b60ecbb9a524e085142fd6a5ceea4a6a8f7d77527da767de1aae3009e4b6102688c961c1769d1648d33a76df1edc5a7bb328c20a6de079fd6766160fd2f7a5b4b48cefee817904aebdba2dbd2720aa765a1c0fadb748d5c3072ccf251174999ea67a60d8b3be33ebae95def28d2cf6ceb126b065c19689603e96dc8e5217b74ce19bf0f7e2190a5060ae69284db47fbae47a9c24e6147475bda2bd30197461b5a789abc3fcb6dfbccc994c022d2d64f5e3e41c80ee73263baf654752550490bdcd586dc2e84a65ac2c88bf48eb7d48bcc529428022b430fcce910c619fff2f08b48eeb6654cf690dbfc06f120ef55655c45cc9f5692f18b777a244dbe00afd3d06d66346154f9ce4fcec3f427090a3f95fb1601062330859472593aa41a3fc3cfdd6ea5efec79901b75c6f5053dc47e3426d89a63778b6d3db3f97f2fe0a8b54beb7c4594bb224b909d17be97de0da41dc3f75d8a62a90c1b7284a864af38982f061fc00945f95879a2917625666420db3b1ddb94b6a2c78bf79bed7d74963a3dbb7e1091090fe37c9bab7c3d831a8ee7032935c99ed84eba82d6effa203ab3ebf9776386203594218382c8f2eeff954e356396ebd7e933e1c46bfeb2fbfe215f946a8a37f247832d5e7e5670a69ec640098a59b209c3fb32bdb5a1c67f482b6937c242ae75a66ad83bdcc0d9f22360ae815b3ba2ff7c0c7d7228bb7466a7d364f350adff12d97be492d8083fd62c5615858ab1020ee55c1ee68557837d255ff0e80463c08c00b87671a45522c2eb1535b4f169fddaa4f8c4255ee6e40978049be73e76a100d37743565e2770c7a7aa4d03a78f72ca0045da33ab5dcf38d23904fa7f81afc86b0a4f18ecd1971955d18ff67b37aa7fb3db035cb33fb18668dcbd71472545762b2ffb33559dcb431c416cb9ec24eea8a8e659ddfca8abb7de65c7b5f2114d69d9b41a5d5eb95204c79065bcf452d8037c7606ee75e3d04c78da0cf442eed2cf16942d4fb394d18258e943ca9ac6a390884b6c9b275387ec1b6ce00f09088b42aec9f629503a7d0e6af673130a10a3f5ccf245041eee68200d7dd9394d9af710eb48d612425b9e4ab5f611a6cb6f952186847249180d5888e1f92b9c61b945a859b8149adb041f57f8e1b29500169f039bcd918737ce5525c3766e246b66a6e46b80e4cb168fc6396ed44a58768519a28c5af167940c3820ab7817a34818e47c984004ae37c266c96868241b0b75b4d05dff7ca84390fbd6dd25befeac5b24140fdf50da51b87d75f4ad03860bba9cc0d358e3f4a2858e73f8583cd90f70d010f44973718c9486a95bfc29bf037c73f665e5369f05c3588a9cf696857cfd98c16bf618a8649b5a446d54151acfe7a57596929bb92d210977bc9694c1db3bdfb37404e7180754d6a26af2601944d2975391595ccd095a6aa7c246efea768040e989ee75c7cd11cd57c55bb34cc02962d054dd1d421105578c7c158a8c30f351dca4b3e2e0af88a3e74f31f2b5f613b309939c65ca4c91735773622984d7be8c357e74097e5811c0788661f7b9501e5612f0e9031d868af66e0cc"]}, @generic="665a7e31e70edc97fd3d25476c0fda2644a17c9d8a7269a05cb4f8c296940288ecc01b598c47120fd7653d6ec02daa0689a35c90cd3f4bfb135c1e58a9084420cacbb704826bf322c134d262e456be468823ad056ce7d1edf5bcd58d250f69940a344df00b4fe2360acdcbe5c2ced01cd176d5cac6f52dbd82621b3111ac56c40155dc0a591c5e156f87425c9295070e6c9d48899ddd2e3b0b30cb50822a8622a923c6117bba6bb765b5f323827f3d44d5e93cd5f90ccfbbbad5e4631c24ff63ba2e87974721cc0d6e287b065bfd02542d483da28014f0a342764cf543f310bbe816651d389c5c604c99fee5de67523958ba44937b378185cb031ddf66fab3544473f416bd6fb457914d5bc642e7a930a9b872e7780ba05c6c85cb44da26d5f5ba9f27181ed41f19e1523487ddbfe504f1ddfad833a5ba8ef429c275d5a2746070f8e9159f19f1b3f876f20c9c4e90ac7165f47db399e433e5443f89e35f8a3fd4d0ed3206b6cb4e1462535b0f67bf21ef58392de8d5d41b46c73a9d40b2b996ce12b7d3bfd39a494559c166014a0d116ece6211999866876d56c6c8df6025ff1c6eac8c20d4f6f78376c58a121e1bbdeae88a2565e5abc7edee5ec28debd70d1e62fffb37849318705f1cb9a46ed1fedd1187f1c003b39f1e05a44470a81bb51228807df0f19565f0ad9dfb1b44875de55e507ab2056df106f6152253dd0fba3e6653e37bd8b453a2a17f729b9bc7b6eb727841e79290c4ac09141c1feaaab865c783bd25a71598e7abfabe6406863730eb3861df7b78e93117c96aa9760d60ecb534e118ca8a3caafcb2289550377546d228f8a5d1f25a625f57bf4816fef607f096db8c8f30e2710a8cab99be85cfe1516d77a46f5627030c24e9f012f0abe20bb1c674fae5ab818436fbcbebb843392ba384130bcfada564b26b6e456ad8dd26d2e47d8cba28bb3fb8aa1f9da6ad23ca741974f2c1ecb45803eb997cb226f137d99675481bb594b8d321905d07a884f32cc6f06441157a8c902d66fa32d353ba1ce00d1f182326616236d977b788535ab21d5b1f2da096bbfd1f26a1673081ac6fcb351dbcd3a6f91a98a29122e5a37a3b4cf04a936f2886049c979afe81e47209c062b39fffed27107019213fd701a26903d2164a580f33a03eb274c16e4e950971fe3bdbc4822ffda8d2fbb0651b3149b0199a50563fc7dc182349a57ce93ae8e6675a2883a8bd269aa6f146a8af7ad70fe72cec9d673c4e66d26fb3406e086a8b4bc4893879379402a9d616e288dce3e56b2f88dad543f90b9e3f4b293c2340429e04bec82497704eb9fef2dc3dd1a3857e61c09f6cfbc99c0aa9dd7b7d10fc7ad03f41d64e07b41353589da27e2b65c16c4a63617ccf5614d34af4d5bb3bc7ec9a8bad876f3cf29277730ca1a1b6ccb57974a6857aec2a4196ff77d3f600e6d3f25216b0175c45103e425f51190bd1d5b0e1e5aac105bba883799f4048a37672d0836303ce4440a90a6998dc936c64cac31653be05916c801935d6510082205af5677c3b05ac2fbc8239d1a7cc9f10bc776b2ce2bb98525086e2b5eecc6e15c488ceeef2f7bf3a77b4eaff90ee617bd078f81ed48dbcda458450aaac6f3237fdb6fdc4d34861fbb36c58a7e42ca76a4907c4adba5043a23d79b7360398bdbefcaff66b32d7876c8f5bd6b592fb641be614905f21277b56b865b8f5faccd3ad3015ae4431a9f8a7625a8f78becdeb87a1ea276744e373f1a426430480ad30f2d9bb51f5e4e6b2ca21ff8c8d2d005ec0daf8693852eb21a760d8e24beac8739b4942339d62c5329749df3dad9a9d6a195bc5b33eca091a48df8cf0685189f3a1471dcc96796395264c058b222334746967d71298dd8f5f72a6a43d3cec96af4d71e9dc39792067c746f8d0bd29abb29f7c79220812f603cc565dea6a52533c6a46da343ed2dbd631f4e2a8c8596907bb050f1c3d1778fb5cd112b26ce403f821dd8418f80cfc9e2df366c327ac4fd8360a140055d407e9a0ad272ec6f57a35186884e38830ea4dec7438291d5135e16dd897ff4cabfab3a090d801529ecce44a83403c1407df4d15fdaaac61a574a4e3945c014bab6ef85f79d20ed0e7c73777d3657460e17c77769b7a3c258c5d90155e08442cca28dfbd69614bb5c95041a15edeb7315cea5b70615fcbbe88bb6bf919aa02d3095d8fcfa1f3bdb82aaa99e5e99b07898dd2bd2e9b372a92e67ceeb40d91802e1249b9a9fa96fa60dd5efb6103f38499071a82f2ea1ab0dfdda26264c6e69062b3664aa95e456fa3b429928591ce8fd31f6f3c130a98bd3c845e25111b27bfde00d7977eb56e81e910fce07a8b8872200c5bb9a5663bab8fff5167c2e5f4d7d6fd9d691e46293c15272e6f332c72903c5b8036a622e7f9d592948af28fd4b1c543c93c9e7357ee17e9c04aa6f5a785f2436b342a547ad89140ff47b5c37c5f11a2c4ba929a4d5559d0d8aca29a9121d5940d69abccd179f2fc8e32807e97132fb0251eb4ef52b140bd4a1c8cc55474770352956f193f16ddb12e6b27b5ef3ed859d84114d51a55c68b5c699c0ec7ef347d0204f22a316b7b8616323ad010024c6c01c36254df3bab40176fc7705f876514c514dba9872427613b1ed5596d2bd78429c1e3cbcc669aa7513daba6f983f227e6fd93899bf209401f43ee4b450d5add3ab71ba0fb000ec577ff6d2fe7bd394195fee4844090a41d856548519e2150b06bce6049a4779725ae9ed9acc12e50f66565b01617e666c1dacdecac4f7ba3325e4c8d040d514b29ceffd1ccc31383a019fa31811c1f4781f17b4fb512e59c6a3fc7063d07e6bd9538212539db746b0e40f1aef85e7401a8a90fb6b69ae7f5dd7ead16d3fa976f6c32a69a0561204319fe1193ed186f03769fb7f423c5a12071b7f225481a91b5a99679ef67f10445b8a7ee3ebe827bfb3a3040fef810129aa275627ec438015243bd8d06a04570e4c8e4775edd9105c808d02dcdd0b48b528ef4837d3df43ced77a2dd7db4119f87c1e0992343968bef56134a5656a9cd8d50b7b69f8646541db4da052d8952cf9a2d9b685353ca8ee78bb32b0dfeb016d082fb3ff87a7ea16e0318e6693bd638296a325db97af9835539871364bf3c23e2b6410ec3f686ba9a90535f5fba3c229a126f715725c149d6aa4fe01af88ba2135b3898b0a003052f43626c06d82832f1f824e42e41e896e60efcfb061a10b17208775f38d735739c3018dc3b2946d642761424d0feccd02a04f724366eb626630c569d85eadc3059c3c045ad9ca9b7e58ba5e147a020acd2b4f14b3c6bc603a609723a888b14db4bd3e7d3da8f1ae6a7a80b212e4f3d2afee1753e0b9db3742109e69867b18ed2c212245df221452b8ea424639cbc54d2ee1ce3ca936cf2e9f96003f46f3d985d174bbfaf591d45dd4a9055a9e0d1f2c2da33e714d53e8c9f3c9bf1fdbd328f75cefffa7b9c6d86162a9696d7e87f9fa503aa22ed40d766adbd522b152886e0942aa67632ba5e432f4bc8b4d4985ee890fbbad441aba4c89700d5c98b115226cf0e4daabc0f02b6c4e3a9591c1cf131a822b4a9aabda5fa78e25cc6842ed3b87fbb94acd5a7c84860a8d76e27764fbd9c3477fd04888aa4ea09a0c3a128de5018faf903c8f0fa813ac77d07871ea10a24b24b3e10fabf8145222453ab1f4f87de410bd6178417df3211e7fb2032e6001684f5e39e89757710c3255622f429e7ad97318710446dbdf68e201b7a868021914862ca1981b7c2659d46974aabb74e097c8595d231857137a2a04e41b3f2b89497488cbda86930e07fbff2d36d18d2450698c0edb51baf706720134fda4e37577e9e2cc74c50f8d8a41e191314ddbc8d1da6879fa15176ee6e9deb4f58bf11cfeb3ef1cd88632bd07f027f535bdfb30645d5bf01cbfd7463c49b3e1cdfdce00e5ac278b8bbbf188646dfe852979a929fab3a9b13e694de23e214b97ffe27570eb943a81195e3eb2a17eae6311dfc0a582c88d65dbfc5ad3ffc79121ac7e92726c24ada1ec07c9d95950016b72722a63a6714b745e923f1723d460982ec07e56dec3e06dd3294c9513b894634f868599d469cd11fc7d04cb986d8492720c1f912b18e56be7ffb932103e4bda06562b07a5509a777b52a6fa7f14227dfeacc6420be6dd0d23ef888184115dad6cdc7cd04687f1b664dc250d8888be12023ab42d1267bd7cc8a688fd0794eb97a016920fa6aa3fc1ee9917c877cc982b6d068afaba901701a0c933b704f71915b8cf11c291baaed4aeacd417560d4ab5f244ea18d3a2cea953f579cb0ffb598fb4f6e52af0d543e152541d5431cddb6d1d236409649ce28dcea4d419b760e2ae205dfbc82b42f756270d81237f3cbbe7e90068c051200ca8202875cae14c605236cedb836736d06e9207640803eef1c32a858cac9ef11be75ebe39bd4ce04ca3755a586a1029914ada57af57228a9b0bc84b5048e1444a05aaa6bba565a4979720570d9f40cb55746b901355b9f0a6cdc426f8662c5931aa236366f91cc45ee462e72aaa62b948555e91d2a99ff3c360dbdcedd52f94b1da4dcc4d314fddeadd6490b58da03ae8c1b39485e1ef194c83ffb22fa685c34bd7dd6acf619cd14132d6d1e722b303fd4a29f7dcbde109db3444d4485b471a86895b41badc03552a81977f793a726fb199fb0eec704d11205734986c6d04e391c8a651d197a6136f1cbae8fc45d3cd16dca2e613bb038615d82a117afa7c0a6fdfec69ba89239721f1a5d430dd2dbd202957f76eb204952e3e4ff4dfc13f8ec25c2a939fd87602742b4cc3bf876048a25a409c9077de88884c95fadb33fe4ababa99191a50c5c0fdaceb98e0e3116eba1601f58aab7cf6c64415b2c969c3ee6d318c35696cb5bb5c194ffe8a9ee777dd903c528a9acd8d6c7db4e14df97e43272b7eab36f652246702e75176b23eecb6ae475287e59ec4706ce97431d0968596d0b16cd6a6102af352ea2ab9d507203ac72a74553e85cf5f3fef9d23f30990111129b28950cf4eb73810c1b49ed338d0eb65805f3364c1773cbc4bac9ba23fdc8a40740bf41538a8d06dc6a8131744a57051be2a59643e4ecc1345e3b6d5eadec795e6ad18a22cabdea73be41ca52adf0e8cc07110966e5d14369ffd048fec56741ec1c27ead5e24d325252fd096737014a037f7c1a6416f815eb0dd142442c670ff24a647d8c136b8aa81c2f686f5a0d1b82a4c899d71b8d6ad546942131e16da3e87c06be7dd48fd12e1463090945d0f48e03d7d5bb78e86aecc9b2980036f2c4e760fc77b1a30d1d81d4b5e231f9e01732df25980ed303f4e47aa57f678f26144f307ed8a366b90b3e713729bfc0a0260c4c280a6c6e8b779d290e63e38ca6e2a916d7202d4a3c2170a3786ac51f56fb30c5c295482bf8314fe96d42385032ea7b2b19f115f9edbcd71d94cc68af1901ed665eb0d61bca8829d7d3dd6631c72eb112fc72ab56115ae0a6896bad334f8cf72949e228d50f0a2ff972b372bb43a5037ac8475b0fff493bfca7f74417641730b421f8fddb5597b919224b4283c167681dfade5056e2a7a5af6a0d14b1f796712dfb9ddfe9950ca157c4ef0e6c58d4b72b36010bf635ebade3186ff33476ed1ad39c4f1160b98f1e2a275cf52e077a2d8c8b37fcfe2cb5a5e540b62325dbfc8deedee500356c6dca35149a8ddca372a8d8eb81a7e9a2bd83f2abbc6b09ef466cf9e74e4507a71538d50d761092d8637da21784bf2d028a60471886e0bc"]}, 0x211c}, {&(0x7f0000006680)={0x200, 0x3f, 0x200, 0x70bd25, 0x25dfdbfb, "", [@generic="f98505381bc88500f427fd26d6bb30ce57c860", @typed={0xc, 0x36, @u64=0x4}, @typed={0x8, 0x5a, @uid=r9}, @generic="145ecfdbc40405b7cbf40cbc6c58f0f574828ae232013a4a97959a89dc490db43ec23c171605e01dc9bb012b550142b81d679cd309cbe322179cff5524dcc8349de7dd3a9eeb7e2b16355a75630a41bd72315f930ce11b348e93f7780bfaa9a7f04ef51317c2762784e38b35cd47f16c6af86bbf1589f99d84f49bf825167071c39d355478031814dd9dd8add8c273b86422d5d8d6299bdf16bbe08767675578d3fca897ef5412e018bcd38177cc08ca", @typed={0xc, 0x5c, @u64=0x8}, @nested={0x10c, 0x87, [@generic="34b884d791d2286cf22606f6381ee6bdc6fdc77cf76234cfeb83e79643290bd187f54d854b2528a3a4c0c5aea58a9c41c3b975b077237f68c5cca60492ba1ff7736cedc6c4e8c60e4c8bb2e199d2207a0e0ea9d2b6a1cc904d130b09d417b0c85cc83aef45805f95d396f8bd8f4bcafc0a8d237f4a25e1f377a602033e9695d2e0a5599fa51090ace627769b9276702e9972a6172b39ba4e87f74c2504677612545ee029f487f746319db8c72c843c36da22a6fb428e4b538e78616d4ee9acf14d70af504d727cbad221025b1c87071114c5c7ab5ec2cac4dc64f70150f8d545c35bb4f3f28d74d1285d3d", @typed={0x14, 0x2b, @str='/dev/binder#\x00'}, @typed={0x8, 0xe, @str=',\x00'}]}]}, 0x200}, {&(0x7f00000000c0)={0x20, 0x21, 0x200, 0x70bd27, 0x25dfdbfb, "", [@nested={0x10, 0xd, [@typed={0xc, 0x23, @u64=0x6}]}]}, 0x20}, {&(0x7f00000068c0)={0x11e0, 0x10, 0x200, 0x70bd27, 0x25dfdbfc, "", [@typed={0x14, 0x27, @ipv6=@dev={0xfe, 0x80, [], 0x15}}, @generic="1af9c36ccb3c40ea9de8feeadec31794b2b88942f542b0b588f27d4a92cc7ae9e4d717447b50504fba6f5f88aa2b7b535d", @generic="06cb960da0bc4530b9f986709bfc119b31a7eedd324a345d48a398e4f63f3d622f23e9b45ff6e827984344906586ac46724c7885ea5a5af4710c818733bd628677d00868d1f42958e8461335df8bccbdce555e9ae2dc6ae5401fb3fd19ac8f736416ffd314e63669d5fcd77af87a5b411f066752cff31578d4a04a4570487e2bb33c98372302ed09ea30fabb1a691000fc91d0e26777c9f9c1cbf60fc785dc49d9be086abd4d212f718fe148565aa52222233c4d1614dfe7001b039c87d9fd7cb0f210ba74361408ddc7c4c6ef54bef4fdbad463cfe6ec5bc2518bfb3ceb80b8b950876612418dbfaf8d69", @typed={0x38, 0x13, @binary="f0b749f0975e3509db4a833242143915c8bbeb3b8cc44d73d8798a94d88137d93009593bc3ce9e216459d9d620ed6e3dc71dcb56"}, @typed={0x8, 0x6a, @fd=r0}, @generic="6e8f2a9b81db263866519f11f189159740816b0d9ef7f76157d52d8ffb42231f7b20a40d4b7aacf2e02a9ef749e692280d079d084c38394f86b11a5f588e1e6875aeca424ac026e9c7cbf17053dacf89c6367a", @typed={0x8, 0x11, @fd=r0}, @typed={0x1004, 0x24, @binary="f0835d5739a02637975fc013061cab574069f635670d940c4e0367089f549619032e922d3a707c1931aead4206b477a12fb1f0d2a54a1b67bacb72f569eae86f674f508531b9633ff1005504044d73b95a9982822f0bbdb6c4766cc9050c7eabcd8315d26db3eb5f52a94cfecc076502198edd5bf79f8c77e2955b466a0eb76896739838b10bc3a10df4e897e4d02416160b8b563cb1fc8f6d9be49c3835400e3564f500129d005ba58566b33d7de1a1ef60acf8751febade760fc62744c5da0c49d9cfe684f35192b7ee777bd8e11d28cd57c30c68655aa36ed427876b1b6d40313b88507900df20fd3af46d33039186af53e34297e3843fbb7f08faf08d414fcc76d4f2a40c6981421607e5d1dfbc0138b653ac11ee146eb94786ca37981c257137edd6bd1e290e3c8fbe163e1739c8156fe8542b3441d63771ff5c03167b43a66d4f2bfae344c6175e5dc0569e7793f4ab7c84f2a7b2e3600c7dbe14d2632c1c457d0a45f7c4c980ccdc76e272fa2e81a992ab254b30662ee3125fb49b85813d303146fff7d543ca985b0045e0b723cfa427f250dcd152d0830d3189d8a759d7c1dcce4fc6189f80eccd8177bece7c80999e6b85c8e98b9db8e41fdc0af24b5297674b3605a787235d4d4dbffe13622fb77cc08c18bf8e7ca9f4bd0976432c0fa13434e92dc5cdd1a9c35c24236654212a80bf396baa973eaf9e8ad24cf4b0af30bd575abe945e1f2af51e6853564103eea8dca4be4d4e38fce525e88bcf309f91d8e47c9bbe99223cdc8f35493e01ae631e652199b25daa4efe5a92fd2e3f05c25874c792d74da35c4a1520425c5509567bcd110af20ce54074509711ed8fd9da2f0697662128ef614cdf88da5669bb8fabfdd386bcb4fff146c1b044133d17a48d49b2f6ee5b50f3037da73eae80903a5a85e8b66371fae9fee9aedcd73c18d7f7338894cbe15820d34218b56e40f1fff4dd7a1b2260065d7d1e59627ba6adddb0799a3bbe04206d95b4963c3c8b293846d1440d83d0dcd7b3ee2926778aabb3428d8cc6398eccf62841cf4ad7b3d4b514ff54a2149f7c1b7d46a03506cca3813baa8f4f1602eda9d36658fc6bfacb6ec80f56059d0a6dd54239e4425f902ac3d52dcff651052ca078be1705b48c8852ae4159d74f2d7d49b447aaa2997f4d26b3977600caaf88aebc315e3473dd92f904f0584bc292ccbc574a92719218cbee492fd97a9c4422ed364630531326363d7630e4abc4da60763b747794ffc7a19966590c0c84f934be1784e8fa1c389cf008b87df4dd15dd505f0694128254fddf6645793d8c8ad058ba55882670dbd7855cf9eb4b882bfdd5eee8248bd18a966f0a4ac54ee4a33cd2c46f914380fd504088e5c4daa1dce732cd5a402bbd79cb5a7f46c919514e7927d809ded05a472ed3a5a36a5e190a01da37a21a66a4bf75b18364c56d31958c39ace5057ea1875641ecb16378dab3bbd1c9bf714b37ce8222aa0e150d9cb067bb12f23807a47f57979461467f84cdaf216d72345a31b43dcc97877f1f9510c730a5e86b1106ca99cdd5fcf310a8095f27298e7e42e5131e40406fbefc99e1bdb1cabf9df8c2960764bafdee16c8c54108131ed1ff83b2b81f11f2dca344f7074cf560cdb596ae2ab00e87f2be6a3f483308ba72172921faf564d05b5532807217658f58e0778bbb69ac77507b3a61db44a9516775a64aa5f68be4500c64678d3ab567c27af58d0a326cddc181f3e4a4839474b3b47098a1dd8a3bdca335f2dfeaa06498feac4db425e0680d3c8b5c38681186e6a60c631f26073e48264f613ad51c505778b796bf7a8f0d8fe7cd37e30957f65771154f6516cb86fd217cfb2151965febadd660f6d903fe1ba8ee69881b994c28af924022aa251127700e41c3c7632ccd0c1e067952cbfc2983bf013c3487562d71ddba4bd578654c191385a3328d727aea4da071d64fa6754c0707c70ffbbef1fd98ed59ec927af43f2be575b9b63a24868c1c1566606bda2bc0b230cb8490135724d3c4ee577498bd6df2edf46466fef5e4cc1b0ff5bd1c1de80f3cc961f800eb09337a049975f1ecbf6d5f018ad9a47a9bdc782c37709024d6c4ddc8af2cfcc2329726609b68ea568b3892cc088d6ecffd1d98ba860830a9c903433ef134871b539a2d1a7b599599c75ba4f2bd99ad5771e3f87c1ff279c0423d3719cd40dc28f34e05b9b5545c649afa0ab768f949e86e658fedfc80619efe642dfeabd68ba917a1bb762fdd076ce757916025681c72f6c113d85d8f6f308a001c0b697d8361cb93c80cc781596b294b4ad9299cd4cef933fc2886ebde16dcdf676ce20ecdb2a8cfd32bd464a4020c6eb2da0223c6a67cf084fe4de8fa88fccb16d33bfa84564ab9d8bceddf8b6f3c97f2e6b3ffa12a21cea1aaeb4a9530b6cd1a0782e2b9e409030c6b6fa4b9b60fa5b10778fff0d38110a82502779cbab2006572206cd9383d53fb8a2f1413e51bee01d3396cd293606d5734f88e274495c37bab768a9497f1f802fd8ae16d733a3b2ab8be5a14fea70f03d991cbc4dffb92905e44150f539227ea8460700eee27df67ec818fcbc1b5fd80628786d650493f7daf3c1cadca8100431a29d9339791ce5ece5334d537f6cbc7abee2d0982b92fbfb2f70c1e28e605e72b1695a5aea1b4e5385bc0e64b087b0e570a476926931c4492df810dea1e6e4ab7bf840d4b11fe20fdccddaca413afa8d719f00d926b847a5c162ad368e6af9aaa0f755908cac0927a0ff906a26cb41c94a917633a7078cc7a3cd1618ed46d941a002763b8c669ffa78a0dccf7948ad95c01e4f0b0bdc6b5bcb67afd89b0eafd4aaff6a6b8a037ca2bac44e3555442ba5bf5f93fe4975cb996634cc40777354baeb9914b853773c7e002657079640cf7f8ba96ff457266f48ca0cf452e321103ad5f83b8843d5aa42b37f89fab201a5421f4f094e5a3059807197e420e58dc6e1bcb61dd5188ebfb862caaecaad819bad9225a82fcaae50d5002ea5028d213e632f583b6c0ee6e127d5ca453801cde81f72d9055f7dbe8dea28937e9d9991e24c3ab66bbf420adc3bd9c19697c5f9e5c474811130bbf3fecdcd44886c445df15d8b4115cf4ea0cf49fb432adca2a0a77f8296eb5d308e6cc0be7936ac23624b0d415f2728c85cb41f60711906ab2d0962b05ee4e30982dd6e1a657b075c767b6bdb0b5e6fd1f70a0b7e08d116a8a35d94b239a7fa383b71af61630ab2e0f2cffa83b71687c7c8a336d861466e5d618e026e94ed20242417b5ac2bc49897c606867ad644d0efb236e7d8ca192c63eea361624ec4e7a8492ccc4980120ccff2ba4733618d5a0d3b4d8d173fc01b26bb01166a9f2b66324f4976200b132de92db0735ba8fcdbd27d59dbbaa17d8f737d5fd780eca53b2638ecc56825bf7f5b80752e2772c7e8dd743d5503244f9afd71970bc4a71b70533ae5cffca49d3ea8ca2b876207bb8a4da0e0e4001b9807d900d7b03f5bda41614a9bffbabd26b83d001359e8ddf1d5797fe2f27cccdde633d347bcb2b8f291598ca5e2177150bbec90d9845af0339503eb92b93cf52fbd415604ec0adce48528199ccc6e2c3e6080a24efd8b08c934a6416211aff1cd307e22bc1a8bf9ebbd8e54904704ef7933b437a32e05e5d07987c41f905589fb3de0455bc7a4cae14fac5a0e024f87a3b53b12c24d60ccba4eea25ebe79197b56751fa9779a6c75fd7cfd8d4b3c1e37f388e7b75ecb07f577ede6fcd499d7813aa6eb9ad3c1dcb9c540142c524e8aef461b084b834d0bc74e910d07b9f44f220728000c2957d30c1221837f5aeede8453528c45354c2e27d33fe12f24899ab6e4bc04478bdad0a3685399d75e013a61e2528186407087bc8e928427170c9fff6288625208532ee3d6f9407690b85fa6a7677161f82721d78349c36c77fa3ae0815b4d2544d056c20ee8902b85ffec461731a33b38f2e20ab3225f863980f9908e1012821d1947665fac31301218be59df093ca2ffe79b321b3194373f1b81ef52461bd9a548de9c8d9fc643239f5d19157b45bb137d2033ab247b6668c0a219e4b5899a6758708c7f38a5cd44d4a9b4a965a21f41a31bc4e27a0730fad150851dd9a1c7de4819da07ca3f6247a756210ab7074402812619b8c07372a9eee01db574f54e51a8394a31d333d9dc42057feef643a47f6f60b8bce5d65c40ceeae036bf029dabdf3ed48b08348891354add8577871b8d365aae6090392793082913591a388f0e4f3aeb7ef211407da96887e51a8fb5347f8fad61be3d15d6d2fd49568e80f21e4298d8dcb6f8205c42341ecb0e0e05ab755c1f76d8f69e6b97a96cb3b74f2e3f3eb09620c7dc1f71d55365146e114820aaf864bdf79a6057eee68ccd1c4db86e1b76c457b40bf258b6208d9e2b43a42f544c07fcbc58f1d6e2e248fd2aeb848bb14b68862cbe382d4b849811feda797317d513d6d35ed6d833e18ccc8b8173b80131d7add7b30bb139c8e3b06143e4b83c952172740c2867a04709ff1f0cc3ce4f2f4b148e6153a792591b6176912a146e73ee38e421f252e5cd5bf50eafbb4eebd56e25ba6321986ef6de692e666158a3d4b6b271f5192268c6857471126add59f02fee84cc8b661de76f2e6165bbcc0a06897c8bf9cb44cccb6faff526a90d178b91cef52d8804b55750abd2c3b64e3c6a7c18cdd61ca9f6f918cadf4589d07c28c47300a0449fa5f98bbf453d8faeb6fb3f28a4eee32c01c4b5ed76c0299b5f8ecf5e0e7e3b18a7858df44e7e45df9ff2fa1e2b1083ec8396b1e8eb40988486165ae08cd7def1c329098aa05614877dcbfe9ae5b2e7b926dc12b82480f792ca7e34c0181370ef868db085f92e815b53435d19420ef22743192b39dc4ae92d86c922b148b73fc7c4c95c8544da1040ee82da6f8ff4ca2459ac4dc0fb01088294fae316eea166c6fcaa66c1a71df16e6ab0c7e82cfb6e02e8e414b81ae644a9628ddc80f1d44cc07889c13c8bc514ec0363b8e05207666a462bacd423afb753f554385cb055c61d4a4cba65f3a9a6187dc03877a5517e56ef958e0fbe607f958d00f5745d466751f4c48e9051eac2c03b1a9954ac28335cc8b952a5e7c44bced9926a3149f56c8c8499b9d06d3c04a91afcf07d9b24550e15f0dc0c75408c887878dfa1064b7cc620a261bff6e0ec1dd0958d33d71b43669b3fecc0c9ce95533803ecc666f524cd1c9bf080c96ca1928b2f3c3c5a886b5fc6135accd3b19cacd2179b01254457a857d0b7568d706a3d798ec5df1a3a9e12aa0db67760c965d18c5709072dc81215b8f1ce3cab64742057a8d1c665b589aaa88966f2531ac5f2a0325eaf9b38ac97dbdca475fbffae714e83f0409d1a3bed078288e0494f83641b4e883751a5aef8c3618d13755dc425c7e39d2c8eb2b8bbdaa641b905aee881fddbf5e2ead6f9dd4dce0eac761fc9136a33c367797678d0187a490fa2ccb82cb05b091e21378e514427e7b40ba39045d5631ee62b053a3957f449bf0716491c24accbe5ab23290a6566acbed02b8eb8e2e491ad8722f563cf397d310570c1683695088dd42bbae96026ef220e496d4c5e773c91b55a113691d2797740f307f1114a8d4aaa959112d55407994b19813cafcc25c621a920eb3f09c992a715f4f053c47f42b6e92c513bb39856dd8540d3ad7af1eeba158148f1cba9e2bd92f73eae9c68f9d9d6951038690f6020d47619460d5ba0ae9d6fffb1070670b0e51d354a614538f7cce200b66407cdba698"}]}, 0x11e0}], 0xa, &(0x7f0000007dc0)=[@cred={0x20, 0x1, 0x2, r10, r11, r12}, @rights={0x30, 0x1, 0x1, [r0, r0, r0, r0, r0, r0, r0]}, @cred={0x20, 0x1, 0x2, r13, r14, r15}, @rights={0x18, 0x1, 0x1, [r0]}], 0x88, 0x40}, 0x8041) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='rdma.current\x00', 0x0, 0x0) 03:37:04 executing program 5: syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 507.153511] binder: 25158:25161 unknown command 536870976 [ 507.180895] binder: 25158:25161 ioctl c0306201 20000440 returned -22 [ 507.192784] binder: 25143:25160 ioctl c0306201 20000440 returned -14 [ 507.199611] binder: 25168:25170 ioctl c018620b 0 returned -14 [ 507.216401] binder: 25172:25175 ioctl c018620b 0 returned -14 [ 507.225798] binder: 25168:25170 ioctl 540f 20001e80 returned -22 [ 507.235532] binder: 25168:25170 unknown command 536871488 [ 507.245555] binder: 25172:25175 BC_ACQUIRE_DONE u0000000000000000 no match [ 507.248034] binder: 25168:25170 ioctl c0306201 20000440 returned -22 [ 507.262647] binder: 25168:25170 ioctl c018620b 0 returned -14 [ 507.280339] binder: 25168:25177 ioctl 540f 20001e80 returned -22 [ 507.284040] binder: 25168:25180 unknown command 536871488 [ 507.293057] binder: 25168:25180 ioctl c0306201 20000440 returned -22 03:37:04 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000005f0000000000000000000000000000180000000000000008000000000000", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040), 0x4) sched_rr_get_interval(0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') 03:37:04 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/policy\x00', 0x0, 0x0) setsockopt$IP_VS_SO_SET_DELDEST(r1, 0x0, 0x488, &(0x7f0000000040)={{0x0, @rand_addr=0x2, 0x4e24, 0x2, 'wrr\x00', 0x10, 0x5, 0x65}, {@remote, 0x4e20, 0x12005, 0x6, 0x7, 0x8}}, 0x44) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) 03:37:04 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000080)={{{@in6=@empty, @in6=@dev}}, {{}, 0x0, @in6=@remote}}, &(0x7f0000000180)=0xe8) ioctl$SIOCGSTAMP(r1, 0x8906, &(0x7f00000001c0)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="ec96e88539bf09e952f21f1f2d4b38bc11e63135c84da994af788368970b07874100c0c2da814b4857479f9b7d3deb1ee0033a8ba17e62f326aa08cfc1f618f7153ebe5ff847bfd9b209d747ae3696abd0a2e0e2cf69a4ed5960bd0e68b0eb840e2b59c267a9eb4204fb31e9dcf7be1c6c94e611a7", @ANYPTR], 0x0, 0x0, 0x0}) 03:37:04 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 03:37:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB="1c00000000000064"]], 0x0, 0x0, 0x0}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='rdma.current\x00', 0x0, 0x0) 03:37:04 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 507.714513] binder: release 25144:25150 transaction 1214 out, still active [ 507.721881] binder: 25143:25147 ioctl c0306201 20000140 returned -14 [ 507.730403] binder: undelivered TRANSACTION_ERROR: 29201 [ 507.773580] binder: 25185:25190 unknown command -2048354580 [ 507.780938] binder: 25188:25193 unknown command 536871488 [ 507.787389] binder: 25189:25192 ioctl c018620b 0 returned -14 [ 507.789416] binder: 25187:25194 ioctl c018620b 0 returned -14 [ 507.795298] binder: 25185:25190 ioctl c0306201 20000440 returned -22 [ 507.800575] binder: release 25186:25196 transaction 1218 out, still active [ 507.806567] binder: 25188:25193 ioctl c0306201 20000440 returned -22 03:37:04 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 507.826214] binder: 25188:25193 unknown command 536871488 [ 507.830345] binder: 25185:25199 unknown command -2048354580 [ 507.841781] binder: 25185:25199 ioctl c0306201 20000440 returned -22 [ 507.848637] binder_alloc: 3591: binder_alloc_buf size 8192 failed, no address space [ 507.850329] binder: 25184:25195 unknown command 536872064 [ 507.862891] binder: 25188:25193 ioctl c0306201 20000440 returned -22 03:37:04 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x7f) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@', @ANYPTR], 0x0, 0x0, 0x0}) 03:37:04 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 03:37:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={0x0, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000040)='\x00'}, 0x30) ptrace$pokeuser(0x6, r1, 0x100, 0x81) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="0080000000000000f419d90c9b0839333d585d0f8466e0a5fc7811874522562d888e78a3168e3ded29de4e24c735f5f25826ddac8c37245266b238335d311cd814830d11e70e4f635b7d0685d83e12b2286b400305f7385df8c0e7cdb6897104b1cd8efecdbd04e3182ea633dcdfc98ae3801f27160214790223ecd33cb039cf9bd8591555f6b8ae0b5bf65d87209413c07cf918751ef77a34e73f2c9f014481bd40a18a08d00c48065360a04816937e8cf79373a3e81f4acfd2ac7bb6fec413f1c92e2400f5830f6c7d6ae9"]], 0x0, 0x0, 0x0}) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/avc/cache_stats\x00', 0x0, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) r2 = dup(r0) openat$cgroup_ro(r2, &(0x7f0000000200)='cpua{\xb0\xec\r\xcb_pepu_sys\x00\x03\n\x86\x88\a', 0x0, 0x0) [ 507.865558] binder_alloc: allocated: 7672 (num: 257 largest: 32), free: 4616 (num: 1 largest: 4616) [ 507.880742] binder: 25184:25195 ioctl c0306201 20000440 returned -22 [ 507.887036] binder: 25187:25194 transaction failed 29201/-28, size 6144-2048 line 3155 [ 507.906296] binder: release 25202:25204 transaction 1223 out, still active [ 507.928943] binder: 25206:25208 ioctl 40046205 7f returned -22 [ 507.935586] binder: 25184:25197 unknown command 536872064 [ 507.942078] binder: 25184:25197 ioctl c0306201 20000440 returned -22 [ 507.949430] binder: 25206:25208 ioctl 40046205 7f returned -22 [ 507.956581] binder: 25212:25214 ioctl c018620b 0 returned -14 [ 507.963213] binder: 25187:25194 ioctl c0306201 20000440 returned -14 [ 507.966393] binder: release 25206:25208 transaction 1228 out, still active 03:37:04 executing program 4: ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 03:37:04 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r1 = accept4$unix(0xffffffffffffff9c, 0x0, &(0x7f0000000000), 0x80000) ioctl$sock_SIOCADDDLCI(r1, 0x8980, &(0x7f0000000040)={'hsr0\x00', 0x3}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="0080"]], 0x0, 0x0, 0x0}) ioctl$sock_SIOCBRDELBR(r1, 0x89a1, &(0x7f00000000c0)='team0\x00') r2 = accept$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f00000001c0)={'team0\x00', r3}) [ 507.986949] binder: undelivered TRANSACTION_COMPLETE [ 507.991764] binder: 25212:25214 unknown command 536871040 [ 508.015671] binder: release 25206:25213 transaction 1232 out, still active [ 508.016051] binder: 25212:25214 ioctl c0306201 20000440 returned -22 [ 508.040700] binder: undelivered TRANSACTION_COMPLETE [ 508.044620] binder: 25219:25223 unknown command 536872064 [ 508.054184] binder: 25212:25214 ioctl c018620b 0 returned -14 [ 508.058843] binder: 25212:25224 unknown command 536871040 [ 508.066407] binder: 25219:25223 ioctl c0306201 20000440 returned -22 [ 508.070011] binder: 25212:25224 ioctl c0306201 20000440 returned -22 [ 508.078588] binder: 25219:25223 unknown command 536872064 03:37:04 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000005f0000000000000000000000000000180000000000000008000000000000", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040), 0x4) sched_rr_get_interval(0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') 03:37:04 executing program 5: lsetxattr$trusted_overlay_redirect(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='trusted.overlay.redirect\x00', &(0x7f00000002c0)='./file0\x00', 0x8, 0x2) prctl$PR_GET_TSC(0x19, &(0x7f0000000300)) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f0000000200)=0x6, 0x4) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x20) ioctl$EVIOCGBITKEY(r2, 0x80404521, &(0x7f0000000140)=""/105) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="81000000d73cfa920efda4ce5aafc63b17ba62f8f457a1757d23ca146d0093624373d2365c893577cb81dd763b190c0ed092ac67f4d82e1a27c3e7691712f2f75a198df6bbd22f43153a4907441277ffc0424953f14797dc04f7ccdfc78cc04a3f3c25411cec30c9d7b50b45d3179d0c88cbe9a1dcd25317b1ed8b2a13eb266ca7ee688148adb700740930e2011ae4a34462cf6c1c125525e725ed8860dad59dcef96bbda304a2b6c969e0939eebc424f2066302c0f9fae054f4ccd2a53b39979bde82d8e6bbee39a5948020d967edc59f125c3922dc", @ANYPTR], 0x0, 0x0, 0x0}) r3 = getuid() ioprio_get$uid(0x3, r3) 03:37:04 executing program 4: ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 03:37:04 executing program 0: r0 = getpid() get_robust_list(r0, &(0x7f0000000180)=&(0x7f0000000140)={&(0x7f0000000040)={&(0x7f0000000000)}, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)}}, &(0x7f00000001c0)=0x18) r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x804) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) [ 508.080935] binder: release 25211:25215 transaction 1229 out, still active [ 508.085669] binder: 25219:25223 ioctl c0306201 20000440 returned -22 [ 508.108233] binder: undelivered TRANSACTION_ERROR: 29201 03:37:05 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="00008003b63f8200174b199fb04a9e61b865b2352f748afe71b4f96c3b8ede7f3e887cadea6f15197334e8455fb60f3c74cd47aec5b46c667c89b4e2d54af89a63fbad14203fcc"]], 0x0, 0x0, 0x0}) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x20400, 0x0) ioctl$TIOCLINUX5(r1, 0x541c, &(0x7f0000000100)={0x5, 0x80000001, 0x7ff, 0x1, 0x8}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='rdma.current\x00', 0x0, 0x0) [ 508.170536] binder: 25229:25236 unknown command 129 [ 508.171482] binder: 25233:25238 ioctl c018620b 0 returned -14 [ 508.177636] binder: 25230:25239 unknown command 536872064 [ 508.193232] binder: 25237:25240 unknown command 536871040 [ 508.196881] binder: 25229:25236 ioctl c0306201 20000440 returned -22 [ 508.201550] binder: 25237:25240 ioctl c0306201 20000440 returned -22 [ 508.211141] binder: 25230:25239 ioctl c0306201 20000440 returned -22 [ 508.218632] binder: 25237:25242 unknown command 536871040 [ 508.232205] binder: 25237:25242 ioctl c0306201 20000440 returned -22 [ 508.235968] binder: 25229:25236 unknown command 129 [ 508.248457] binder_alloc: 3591: binder_alloc_buf size 8192 failed, no address space [ 508.256635] binder: 25229:25236 ioctl c0306201 20000440 returned -22 [ 508.268632] binder_alloc: allocated: 7784 (num: 262 largest: 32), free: 4504 (num: 1 largest: 4504) [ 508.287473] binder: 25233:25246 transaction failed 29201/-28, size 6144-2048 line 3155 [ 508.304882] binder: 25233:25246 ioctl c0306201 20000440 returned -14 03:37:05 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 03:37:05 executing program 4: ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 03:37:05 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xffffffffffffffd2, 0x0, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0}) 03:37:05 executing program 5: r0 = dup(0xffffffffffffff9c) r1 = mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x100000f, 0x10, 0xffffffffffffff9c, 0x0) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x3, 0x32, 0xffffffffffffff9c, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000240)={0x0}) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x158, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0e630c4000000000000000000000000011634840040000000000000004000000000000000000000010000000000000000000000018000000000000001800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=r1, @ANYBLOB="0100000000000000"], @ANYPTR=&(0x7f0000000040)=ANY=[@ANYBLOB='0\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="0200000000000000046304400400000001634040020000000000000001000000000000000000000010000000000000000000000048000000000000002000000000000000", @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="8561646600000000010000000000000004000000000000000300000000000000852a747001000000", @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000003000000000000000a00000000000000"], @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="1800000000000000380000000000000028000000000000003800000000000000"], @ANYBLOB="0063404000000000000000000000000000000000000000001100000000000000005000000000000000d3812bc6d7e3a10d29d016378019d73b0ccdb93f0fbb7c9722c22453022ed52cf05ee31277c2d59adf37ac8d479da387bf56536113f492bc346b7167635fb16c6706e24dfaed7bae1fb090e3d4c6bcff5419b5cf27daa8907856fd097f3f43c47acdf0c1a52be76266c9277c3fc1d8a2c3b28f41149f608f56e01bd57cc80ad05cb52ec27df24b9a0c195dfabaa5db778b3e8044f6beb7b6a61f0a97c1d65dbcb55aaa1a06dceb4974244fafba9eeeede3c36962741d", @ANYPTR=&(0x7f0000000180)=ANY=[@ANYBLOB="852a6a770a000000", @ANYRES64=r2, @ANYBLOB="0300000000000000"], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB='@\x00\x00\x00\x00\x00\x00\x00h\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="09631040", @ANYRES64=r3, @ANYBLOB="000000000000000011634840040000000000000001000000000000000000000011000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="852a646600000000", @ANYRES32=r4, @ANYBLOB="000000000400000000000000"], @ANYPTR=&(0x7f00000002c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="030000000000000005630440010000000d630000"], 0xf5, 0x0, &(0x7f0000000600)="e42fc32b3aa7c7ad531677a6fda070e9e35749db335f957aee6787f464e26ad39a845e523b2b8480503735627417463b40fd9919082ea5cd6f11f361bbfe3b38dce4a9a7d90d7a75b9304a0f70441175548ccd2cc34e20c6faaf2235c913bc3359bfd23323b10ee9e78651d4778ef6b5a28996981ed6696dab6ece23a938297d7428719f26f14b4bbd72396c4f41d67bae07a54e02b639644b47ca392a4a1c9ca058bbf8463702641e5975bc35d6c6c65849bbb895f7f2f888e52d786edb8ffcf8304778dc67071f62bde9d1639fdcac73d7a9607a230ec8780df7701f5b9f697ef16b644128d57e71159c79323b484486420b2c74"}) r5 = syz_open_dev$binder(&(0x7f0000000380)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@', @ANYPTR], 0x0, 0x0, 0x0}) 03:37:05 executing program 2: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) read(r0, &(0x7f0000000080)=""/229, 0xe5) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='rdma.current\x00', 0x0, 0x0) write$binfmt_elf64(r0, &(0x7f0000000480)={{0x7f, 0x45, 0x4c, 0x46, 0x7ff, 0xffff, 0x8, 0x100, 0x8, 0x2, 0x3e, 0x1f15, 0x110, 0x40, 0x67, 0xfffffffffffffffe, 0x7, 0x38, 0x1, 0xf8f, 0x5, 0x52b}, [{0x60000000, 0xac011bf, 0x401, 0x3f, 0xfffffffffffffc00, 0x401, 0x800, 0x1000}, {0x7474e557, 0xfff, 0x4, 0x9, 0x2, 0x20, 0x2, 0xaecb}], "bd3c45fb43dd8b0726da42f50b71a1337b660a938e7c31e02cec173e34bc395e96641e33bdac22b410b6a6a501899ae0b1ff7b832e34effa248ff129441856145a85eef61ab7098fc5423a4964856305e03937f939d87488c809657d394a3e78d298b6dc16155bbe9e165c19c73890a288f3f495c975810e9a3c1b75cb183ab9e6c167463c844ffcadd421954a34a2850185f1c8d15e82c3d40606ec9038ae6bd85f1bfd0b7e289e74a9bc39348263fc61febd9e56865d87e46948bdafd50e", [[], []]}, 0x36f) write$P9_RMKDIR(r1, &(0x7f0000000000)={0x14, 0x49, 0x1, {0xa1, 0x1, 0x8}}, 0x14) write$selinux_user(r1, &(0x7f0000000180)={'system_u:object_r:default_context_t:s0', 0x20, 'system_u\x00'}, 0x30) 03:37:05 executing program 4: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 508.572436] binder: release 25189:25203 transaction 1222 out, still active [ 508.598503] binder: 25253:25256 transaction failed 29189/-22, size 0-0 line 3018 [ 508.615068] binder: 25254:25259 unknown command 536871488 03:37:05 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0xfffffffffffffffc) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) fsync(r0) [ 508.634336] binder: 25253:25256 transaction failed 29189/-22, size 0-0 line 3018 [ 508.639497] binder: 25254:25259 ioctl c0306201 20000440 returned -22 [ 508.642816] binder: undelivered TRANSACTION_ERROR: 29189 [ 508.655696] binder: 25260:25264 ioctl c018620b 0 returned -14 [ 508.667542] binder: 25254:25268 unknown command 536871488 [ 508.674186] binder: undelivered TRANSACTION_ERROR: 29189 [ 508.684056] binder: 25254:25268 ioctl c0306201 20000440 returned -22 [ 508.739509] binder: 25260:25275 BC_ACQUIRE_DONE node 1237 has no pending acquire request 03:37:05 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000005f0000000000000000000000000000180000000000000008000000000000", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040), 0x4) sched_rr_get_interval(0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') 03:37:05 executing program 4: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 03:37:05 executing program 5: rename(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='./file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@', @ANYPTR], 0x0, 0x0, 0x0}) 03:37:05 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/full\x00', 0x800, 0x0) ioctl$PIO_UNIMAP(r1, 0x4b67, &(0x7f0000000140)={0x1, &(0x7f0000000100)=[{0x5, 0x4}]}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="000000dcba32c23caa480000a79b"]], 0x0, 0x0, 0x0}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='rdma.current\x00', 0x0, 0x0) pipe2(&(0x7f0000000080), 0x801) 03:37:05 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="0c8098b3406800af3b3aad34fb4a3eadeb9009adc8c7a5c4f1bf652e197dbdcf011d5798ed687eead380dd293fbddb1d9f25a50a10597694e387a4afde"]], 0x0, 0x0, 0x0}) [ 508.961782] binder: 25233:25238 ioctl c0306201 20000140 returned -14 [ 508.968937] binder: undelivered TRANSACTION_ERROR: 29201 [ 509.002616] binder: release 25278:25282 transaction 1239 out, still active [ 509.013704] binder: 25279:25285 unknown command 536870912 [ 509.015203] binder: undelivered TRANSACTION_COMPLETE [ 509.021275] binder: 25283:25287 ioctl c018620b 0 returned -14 [ 509.028794] binder: 25277:25286 ioctl c018620b 0 returned -14 [ 509.038749] binder: 25279:25285 ioctl c0306201 20000440 returned -22 [ 509.044394] binder: 25277:25286 unknown command 536870912 [ 509.055388] binder: release 25278:25284 transaction 1240 out, still active [ 509.068032] binder: 25277:25286 ioctl c0306201 20000440 returned -22 [ 509.082933] binder: undelivered TRANSACTION_COMPLETE [ 509.091777] binder: 25277:25286 ioctl c018620b 0 returned -14 [ 509.091782] binder: 25277:25291 unknown command 536870912 [ 509.091793] binder: 25277:25291 ioctl c0306201 20000440 returned -22 [ 509.110600] binder_alloc: 3591: binder_alloc_buf size 8192 failed, no address space [ 509.118437] binder_alloc: allocated: 7832 (num: 265 largest: 32), free: 4456 (num: 1 largest: 4456) [ 509.128156] binder: 25283:25292 transaction failed 29201/-28, size 6144-2048 line 3155 03:37:06 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 03:37:06 executing program 4: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 03:37:06 executing program 5: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/enforce\x00', 0x210041, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000280)={{0x0, 0x2, 0x800, 0x1, 0x100}}) ioctl$BLKROSET(r0, 0x125d, &(0x7f00000001c0)=0x3) r1 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@', @ANYPTR], 0x0, 0x0, 0x0}) r2 = dup3(r1, r1, 0x80000) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040)='TIPC\x00') sendmsg$TIPC_CMD_RESET_LINK_STATS(r2, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20080}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x28, r3, 0x600, 0x70bd25, 0x25dfdbfb, {{}, 0x0, 0x410c, 0x0, {0xc, 0x14, 'syz0\x00'}}, ["", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x4011}, 0x40000) read(r1, &(0x7f0000000200)=""/119, 0x77) 03:37:06 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB='\x00\x00']], 0x0, 0x0, 0x0}) r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f0000000040)={0x1, 0x4, 0x7, 0xffffffff, 0x8000, 0x4}) 03:37:06 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) write$binfmt_elf32(r0, &(0x7f0000000080)={{0x7f, 0x45, 0x4c, 0x46, 0xfc, 0x0, 0x9, 0x7, 0xfffffffffffffc00, 0x3, 0x3e, 0x9, 0x32c, 0x38, 0x300, 0x9, 0x4, 0x20, 0x1, 0x400, 0x9c, 0x7}, [{0x7474e557, 0x4, 0x1, 0x0, 0x8000, 0x3f, 0x100, 0x37}, {0x4, 0x60, 0x6, 0x0, 0x20, 0x5, 0x3, 0xfff}], "173d369322e43473393fa2de8be11f37c46f797bc42c8aa483cf93e0fbca14b5d7c45d5af8ec4bec", [[]]}, 0x1a0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xfffffffffffffdf4, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) close(r0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='rdma.current\x00', 0x0, 0x0) [ 509.428031] binder: release 25260:25264 transaction 1236 out, still active 03:37:06 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x3) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='rdma.current\x00', 0x0, 0x0) 03:37:06 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 509.474021] binder: 25297:25302 transaction failed 29189/-22, size 0-0 line 3018 [ 509.476320] binder: 25298:25304 unknown command 536872064 [ 509.497198] binder: 25300:25306 ioctl c018620b 0 returned -14 [ 509.503347] binder: 25298:25304 ioctl c0306201 20000440 returned -22 [ 509.513849] binder: 25298:25304 unknown command 536872064 [ 509.529315] binder: 25297:25311 transaction failed 29189/-22, size 0-0 line 3018 [ 509.537253] binder: 25298:25304 ioctl c0306201 20000440 returned -22 [ 509.544793] binder: 25310:25314 unknown command 536871488 [ 509.553498] binder: 25310:25314 ioctl c0306201 20000440 returned -22 [ 509.557260] binder: release 25312:25315 transaction 1247 out, still active [ 509.571454] binder: 25300:25317 BC_ACQUIRE_DONE node 1244 has no pending acquire request [ 509.576884] binder: 25310:25314 ioctl 40046205 3 returned -22 [ 509.598134] binder: undelivered TRANSACTION_ERROR: 29189 [ 509.604073] binder: undelivered TRANSACTION_ERROR: 29189 [ 509.610584] binder: 25310:25320 unknown command 536871488 [ 509.622057] binder: 25310:25320 ioctl c0306201 20000440 returned -22 [ 509.629344] binder: 25310:25314 ioctl 40046205 3 returned -22 03:37:06 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000005f0000000000000000000000000000180000000000000008000000000000", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040), 0x4) sched_rr_get_interval(0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') 03:37:06 executing program 0: r0 = syz_open_procfs(0x0, &(0x7f0000000200)='mounts\x00') ioctl$PIO_FONT(r0, 0x4b61, &(0x7f0000000240)="4eb52178c2934d8ff0fc8f621076448cb3766d32a6c6e50fb1201944fd49e771f986f4f8fc890b355b42a20ee5bc9bead248a8ce0875d168fdbe79f1c4c4d9a220388894aee0a9c3458d5138f09508a17780ae35ca7c47c9a0ae93292a1c89df8a648cf5e2c34621e72cd447d14e52ac3780e958") r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="f5ae87a81c21995bbef00120e4ee654f93e7e0d1a5e728294e64f2c3a15b85b8be185cb202e59398b69c85284d9e2339379d4c2f530ba3865fadc9b296ea7dec1114b4cc83bc9cb5fcfaf22ae0c50d01d8fef51279cddde730ccafcb2e6fab80591763fb455c20000000fa096e2f2ce965436dee921f98987c5f7df46c2d23a43b9ab798c86d64b22d862718d24a23bf5fb9534a92c1b6c35e87da3f95c87443db6368812814b09783de1554cb47c7bfbc34787bad073dfe288be72bad39de8711d1c63fd5b673f8d06e3380bbdb7ae2d54674925af97cf10a"]], 0x0, 0x0, 0x0}) r2 = getuid() sendmsg$nl_netfilter(r0, &(0x7f0000000380)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)={0x190, 0x2, 0x3, 0x8, 0x70bd2d, 0x25dfdbfe, {0xf, 0x0, 0x8}, [@nested={0x17c, 0xa, [@typed={0x8, 0x77, @ipv4=@empty}, @generic="e2801478bb925b63dac0f155d9a1009bdca2f9175cfa5d7f314a154066ace474fa9b2a61fee4c2a285babeb43ea1c47591", @generic="3620714bbe2f59a635e00725d8db1db089bf4964644f6209595f83c51668b53c441341722a587adf76660ef68408e73a65c0100778fd94d2509267028515a5786ce1fb3c7bf778a9cfc4972995213918c23af02bf0150c296908ffaec25fd6981cdf2a3b101d4a0d3e7648067ac48ae357769f4b5bb920f66feb88b0bd4c64eb048465202c6aa5d40806949f044ecc9adf049be86f11cf0d457adfeaef1fb7733390e36368d3f18dc42e41b19ae2f831126a76853e90cbaa5250d2", @typed={0xc, 0x21, @u64=0x3}, @generic="25d6c0a08649132c1b7e82b7f5269534e7a6df9b52fb2723d81e9b55be5bca154c7425d72db0c5a446f107492792591d5381adfb283eb979157d8a2ce8be5ca0df742d422fc97a6bc8af397a8230b71f4c029b9c", @typed={0x8, 0x82, @u32=0x8}, @typed={0x8, 0x7c, @uid=r2}, @typed={0x14, 0x73, @ipv6=@mcast1}]}]}, 0x190}, 0x1, 0x0, 0x0, 0x40004}, 0x800) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) clock_getres(0x5, &(0x7f00000003c0)) prctl$PR_SVE_GET_VL(0x33, 0x19bf8) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0x20) ppoll(&(0x7f0000000000)=[{r1, 0x4}], 0x1, &(0x7f0000000080)={r3, r4+30000000}, &(0x7f00000000c0), 0x8) 03:37:06 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = accept(0xffffffffffffffff, &(0x7f0000000000)=@in={0x2, 0x0, @dev}, &(0x7f0000000080)=0x80) accept4$inet(r1, &(0x7f00000000c0)={0x2, 0x0, @multicast1}, &(0x7f0000000100)=0x10, 0x603e71e6e5b25af8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@', @ANYPTR], 0x0, 0x0, 0x0}) 03:37:06 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 03:37:06 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000280)='/dev/full\x00', 0x2000402000, 0x0) write$cgroup_subtree(r1, &(0x7f0000000080)={[{0x2d, 'io'}, {0x2f, 'rdma'}, {0x2f, 'pids'}]}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) write$apparmor_exec(r1, &(0x7f00000000c0)={'stack ', ',(\x00'}, 0x9) ioctl$UI_ABS_SETUP(r1, 0x401c5504, &(0x7f0000000100)={0x0, {0x6, 0xfffffffffffffffa, 0x100000000, 0x0, 0x8, 0x8001}}) keyctl$join(0x1, &(0x7f0000000140)={'syz', 0x0}) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f00000001c0)=@nat={'nat\x00', 0x19, 0x2, 0x2e8, [0x20000480, 0x0, 0x0, 0x200004b0, 0x20000738], 0x0, &(0x7f0000000180), &(0x7f0000000480)=[{}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x0, 0x20, 0x88ff, 'bond0\x00', 'bridge_slave_1\x00', 'eql\x00', 'team_slave_0\x00', @broadcast, [0x0, 0xff, 0x0, 0xff, 0x0, 0xff], @dev={[], 0x25}, [0xff, 0xff, 0xff, 0x0, 0xff], 0xa0, 0x110, 0x160, [@pkttype={'pkttype\x00', 0x8, {{0x3}}}]}, [@arpreply={'arpreply\x00', 0x10, {{@broadcast, 0xffffffffffffffff}}}, @snat={'snat\x00', 0x10, {{@local, 0xfffffffffffffffc}}}]}, @common=@log={'log\x00', 0x28, {{0xac0000000000000, "e80be16d2496f51df5e66e8ba1d94db07fe58938f57736fcc20eec16b9ac", 0x6}}}}, {{{0x5, 0x68, 0xe867, 'bridge0\x00', 'teql0\x00', 'syz_tun\x00', 'dummy0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, [0xff, 0x0, 0xff, 0xff, 0x0, 0xff], @random="94a4e73f7b05", [0xff, 0xff, 0x0, 0x0, 0xff], 0x70, 0xc0, 0xf8}, [@common=@log={'log\x00', 0x28, {{0x6, "7ec90e84001b89076e0ebaf5e8697d1c401ce4878ed093c6b9c3a44086f7", 0x8}}}]}, @arpreply={'arpreply\x00', 0x10, {{@random="2fadde07af89", 0xffffffffffffffff}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe}]}, 0x360) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='rdma.current\x00', 0x0, 0x0) [ 509.811617] binder: 25283:25287 ioctl c0306201 20000140 returned -14 [ 509.818350] binder: undelivered TRANSACTION_ERROR: 29201 [ 509.847459] binder: 25324:25330 unknown command 536871168 [ 509.853817] binder: release 25325:25329 transaction 1250 out, still active [ 509.859412] binder: 25326:25334 ioctl c018620b 0 returned -14 [ 509.869559] binder: 25323:25333 unknown command 536871488 [ 509.870504] binder: undelivered TRANSACTION_COMPLETE [ 509.875656] binder: 25324:25330 ioctl c0306201 20000440 returned -22 [ 509.889521] binder: release 25327:25332 transaction 1251 out, still active [ 509.890009] binder: 25323:25333 ioctl c0306201 20000440 returned -22 [ 509.914574] binder: 25323:25338 unknown command 536871488 [ 509.920599] binder: 25323:25338 ioctl c0306201 20000440 returned -22 [ 509.923005] binder_alloc: 3591: binder_alloc_buf size 8192 failed, no address space [ 509.938475] binder_alloc: allocated: 7936 (num: 269 largest: 32), free: 4352 (num: 1 largest: 4352) [ 509.951775] binder: 25326:25339 transaction failed 29201/-28, size 6144-2048 line 3155 03:37:07 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 03:37:07 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00000031ba99c700", @ANYPTR], 0x0, 0x0, 0x0}) ioctl$int_in(r0, 0x5473, &(0x7f0000000000)=0x3ff) r1 = request_key(&(0x7f0000000080)='id_resolver\x00', &(0x7f00000000c0)={'syz', 0x3}, &(0x7f0000000100)='/dev/binder#\x00', 0xfffffffffffffffb) keyctl$KEYCTL_PKEY_QUERY(0x18, r1, 0x0, &(0x7f0000000140)='self\x00', &(0x7f0000000180)) 03:37:07 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 03:37:07 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1000001, 0x10, r0, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='rdma.current\x00', 0x0, 0x0) write$P9_RRENAME(r1, &(0x7f0000000180)={0x7, 0x15, 0x2}, 0x7) r2 = ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82) ioctl$LOOP_CTL_ADD(r1, 0x4c80, r2) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000540)='IPVS\x00') sendmsg$IPVS_CMD_GET_SERVICE(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="000725bd7000fedbdf2504000000180003001400060000000000008000000000ffffac1414230800050004000000c846d28d5cb3f377e02a44fa594f5e461ac32fe79dfb78b9dc654a626f771cee7376ad0bec89b4ff7020f7b8aba973754062cdfd7c9805dd16dd13b1d6deb1e607ea6a73135506d657a33fb0608ffa72474feb8c20a14f9ee767cea8"], 0x34}, 0x1, 0x0, 0x0, 0x40000}, 0x48000) ioctl$ASHMEM_PURGE_ALL_CACHES(r1, 0x770a, 0x0) [ 510.276718] binder: release 25300:25306 transaction 1243 out, still active [ 510.301855] binder: 25342:25346 ioctl c018620b 0 returned -14 [ 510.312324] binder: 25343:25348 unknown command 822083584 [ 510.315093] binder: 25345:25349 unknown command 536871488 [ 510.322354] binder: 25343:25348 ioctl c0306201 20000440 returned -22 [ 510.324433] binder: 25345:25349 ioctl c0306201 20000440 returned -22 [ 510.332628] binder: 25343:25348 ioctl 5473 20000000 returned -22 [ 510.347220] binder: 25345:25349 unknown command 536871488 [ 510.350579] binder: release 25344:25350 transaction 1258 out, still active [ 510.353968] binder: 25345:25349 ioctl c0306201 20000440 returned -22 [ 510.363719] binder: 25343:25348 unknown command 822083584 03:37:07 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 03:37:07 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@', @ANYPTR], 0x0, 0x0, 0x0}) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="7f454c4608e3ba01020000000000000003003f0000002000630200000000000040000000000000001000000000000000fc7f00000100380002000400ff7f0000129ada9a1995fa3cf70b2d74115d4d546606710c2565e8bb4d894e2a37e2f50000000000000000000000000000000000b3f20000000000000000000000000000000000000027c6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x15f) ioctl$FS_IOC_FSGETXATTR(r0, 0x801c581f, &(0x7f0000000180)={0x9, 0x6, 0x6, 0xc1, 0x2}) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000200)='/proc/self/net/pfkey\x00', 0x4001c0, 0x0) ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82) 03:37:07 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="810000001a0000002412814a206af9ca116f8275f223c111aa6d655b63579664bfdee4874f867fc959f483e793fb3de69d58d42d74b620656f4e4bd711888c7efbde5dc376566b965bd27f61823003bfd2fda5d3085f0b2ad8f114aa0fa91ebd76ccba3fcbee4a9b7d8adb1502a1f0212b9f795b15b7cdc4f2ed99ad0f58d3aa"]], 0x0, 0x0, 0x0}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='rdma.current\x00', 0x0, 0x0) [ 510.367345] binder: 25343:25353 ioctl 5473 20000000 returned -22 [ 510.374884] binder: 25342:25355 BC_ACQUIRE_DONE node 1256 has no pending acquire request [ 510.392222] binder: 25343:25348 ioctl c0306201 20000440 returned -22 [ 510.401618] binder: 25356:25359 ioctl c018620b 0 returned -14 [ 510.417435] binder: 25356:25359 BC_ACQUIRE_DONE u0000000000000000 no match [ 510.463377] binder: 25363:25367 ioctl 801c581f 20000180 returned -22 [ 510.467578] binder: 25362:25366 unknown command 536871040 [ 510.471807] binder: 25363:25367 ioctl 801c581f 20000180 returned -22 [ 510.484225] binder: release 25363:25367 transaction 1261 out, still active [ 510.485385] binder: 25362:25366 ioctl c0306201 20000440 returned -22 [ 510.492099] binder: undelivered TRANSACTION_COMPLETE [ 510.501273] binder: 25362:25369 unknown command 536871040 [ 510.509066] binder: 25362:25369 ioctl c0306201 20000440 returned -22 [ 510.511252] binder: release 25363:25367 transaction 1262 out, still active [ 510.525835] binder: undelivered TRANSACTION_COMPLETE 03:37:07 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000005f0000000000000000000000000000180000000000000008000000000000", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040), 0x4) sched_rr_get_interval(0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') 03:37:07 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={0x0}) r2 = mmap$binder(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1000008, 0x50, r0, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)={0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x74, 0x0, &(0x7f0000000180)=[@acquire_done={0x40106309, r1}, @free_buffer={0x40086303, r2}, @transaction_sg={0x40486311, {{0x4, 0x0, 0x3, 0x0, 0x34dfd5972840397a, 0x0, 0x0, 0x60, 0x18, &(0x7f00000000c0)=[@flat={0x77682a85, 0x10b, r3, 0x3}, @ptr={0x70742a85, 0x0, &(0x7f0000000080), 0x1, 0x3, 0x2a}, @fda={0x66646185, 0x2, 0x4, 0xc}], &(0x7f0000000140)=[0x78, 0x58, 0x38]}, 0x5}}, @acquire={0x40046305, 0x2}], 0x82, 0x0, &(0x7f0000000200)="12c2398ec650157df46199a0607a572e6220de192b70223f178728d01ca5a5f8e94333eabfbb38a271f29ea84972908f4a3934a0fa0860d8d3c8b04e979c0ef9d32ceee0b79aefecfe848c6fd5a8bc6ea7b352b6fb2c1532923ed1877e42a133c000030aaae8903b276a569391c30f078f48c2e588fb12282fda6e5cd0277e0bc1e3"}) 03:37:07 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 03:37:07 executing program 5: time(&(0x7f0000000000)) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@', @ANYPTR], 0x0, 0x0, 0x0}) r1 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000040)='/dev/keychord\x00', 0x81847410b6665f2c, 0x0) r2 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0)='TIPC\x00') sendmsg$TIPC_CMD_GET_NODES(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r2, 0x722, 0x70bd28, 0x25dfdbfe, {}, ["", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x84}, 0x0) 03:37:07 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYRES32=r0], 0x135, 0x0, 0x0}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='rdma.current\x00', 0x0, 0x0) [ 510.641989] binder: 25324:25330 unknown command 536871168 [ 510.647727] binder: 25324:25330 ioctl c0306201 20000440 returned -22 [ 510.656244] binder: 25326:25334 ioctl c0306201 20000140 returned -14 [ 510.662956] binder: undelivered TRANSACTION_ERROR: 29201 [ 510.716298] binder: 25375:25381 ioctl c018620b 0 returned -14 [ 510.723620] binder: 25376:25383 ioctl c018620b 0 returned -14 [ 510.726456] binder: 25380:25385 unknown command 536872064 [ 510.731902] binder: 25376:25383 BC_ACQUIRE_DONE u0000000000000000 no match [ 510.735606] binder: 25378:25382 unknown command 3 [ 510.749034] binder: 25378:25382 ioctl c0306201 20000440 returned -22 [ 510.756503] binder: 25380:25385 ioctl c0306201 20000440 returned -22 [ 510.766418] binder: 25380:25385 BC_ACQUIRE_DONE u0000000000000000 no match [ 510.773807] binder: 25378:25388 unknown command 4 [ 510.779035] binder: 25380:25385 BC_FREE_BUFFER u0000000000000000 no match [ 510.782592] binder_alloc: 3591: binder_alloc_buf size 8192 failed, no address space [ 510.787040] binder: 25378:25388 ioctl c0306201 20000440 returned -22 [ 510.800735] binder_alloc: allocated: 8032 (num: 275 largest: 32), free: 4256 (num: 1 largest: 4256) [ 510.801220] binder: 25380:25385 got transaction to invalid handle [ 510.810621] binder: 25375:25390 transaction failed 29201/-28, size 6144-2048 line 3155 [ 510.817262] binder: 25380:25385 transaction failed 29201/-22, size 96-24 line 3018 [ 510.830778] binder: 25375:25390 ioctl c0306201 20000440 returned -14 [ 510.840891] binder: release 25377:25384 transaction 1263 out, still active [ 510.850472] binder: 25380:25385 unknown command 536872064 [ 510.851506] binder: undelivered TRANSACTION_COMPLETE [ 510.858672] binder: 25380:25385 ioctl c0306201 20000440 returned -22 [ 510.868957] binder: 25380:25394 BC_ACQUIRE_DONE u0000000000000000 no match [ 510.881248] binder: 25380:25394 BC_FREE_BUFFER u0000000000000000 no match [ 510.887281] binder: release 25377:25389 transaction 1264 out, still active [ 510.895985] binder: 25380:25394 got transaction to invalid handle [ 510.903207] binder: 25380:25394 transaction failed 29201/-22, size 96-24 line 3018 [ 510.911468] binder: undelivered TRANSACTION_COMPLETE 03:37:07 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x2) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x8, 0x0, &(0x7f0000000300)=ANY=[], 0xfffffe06, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='rdma.current\x00', 0x0, 0x0) ioctl$TIOCGPGRP(r1, 0x540f, &(0x7f0000000080)=0x0) fcntl$setownex(r1, 0xf, &(0x7f00000000c0)={0x2, r2}) 03:37:07 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 03:37:07 executing program 5: syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) init_module(&(0x7f0000000000)='/dev/binder#\x00', 0xd, &(0x7f0000000040)='/dev/binder#\x00') 03:37:07 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x4, 0x10, r0, 0x0) 03:37:07 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 511.102788] binder: release 25342:25346 transaction 1255 out, still active [ 511.117327] binder: unexpected work type, 4, not freed [ 511.135248] binder: undelivered TRANSACTION_COMPLETE [ 511.138635] binder: 25401:25407 ioctl c018620b 0 returned -14 [ 511.142948] binder: 25404:25409 ioctl c018620b 0 returned -14 03:37:08 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 511.152669] binder: 25400:25406 unknown command 536872064 [ 511.153929] binder: 25401:25407 BC_ACQUIRE_DONE u0000000000000000 no match [ 511.158568] binder: 25400:25406 ioctl c0306201 20000440 returned -22 [ 511.172256] binder: 25399:25408 unknown command 0 [ 511.177828] binder: 25399:25408 ioctl c0306201 20000000 returned -22 [ 511.187781] binder: 25399:25410 unknown command 0 03:37:08 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYPTR], 0x0, 0x0, 0x0}) [ 511.197319] binder: 25399:25410 ioctl c0306201 20000000 returned -22 [ 511.231041] binder: 25413:25416 ioctl c018620b 0 returned -14 [ 511.238329] binder: 25404:25418 BC_ACQUIRE_DONE node 1269 has no pending acquire request [ 511.243754] binder: 25413:25416 ioctl c0306201 0 returned -14 [ 511.246816] binder: 25414:25417 unknown command 0 [ 511.254674] binder: 25413:25416 BC_ACQUIRE_DONE u0000000000000000 no match [ 511.267551] binder: 25414:25417 ioctl c0306201 20000440 returned -22 03:37:08 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040), 0x4) sched_rr_get_interval(0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') 03:37:08 executing program 0: r0 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000040)='/dev/keychord\x00', 0x10000, 0x0) ioctl$TUNDETACHFILTER(r0, 0x401054d6, 0x0) ioctl$BLKPG(r0, 0x1269, &(0x7f0000000100)={0x100, 0xd99, 0x65, &(0x7f0000000080)="fdfb27ed71025c3435aa214faddb44fd93c4df540d039ef15607fffdd55829ba5b36363b33361d0e6aa2eb170e6c3ec60122a456f39859a8963fdeb8117d453b1229483f7ffccd525686f9fcb5802e7d092dd49cf5f3d256be8d8924f209e2cbfc8e452056"}) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) 03:37:08 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00']], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='rdma.current\x00', 0x0, 0x0) setsockopt$inet6_MCAST_MSFILTER(r1, 0x29, 0x30, &(0x7f0000000480)={0x101, {{0xa, 0x4e20, 0x7fff, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x8}}, 0x1, 0x4, [{{0xa, 0x4e22, 0x6, @remote, 0x1000}}, {{0xa, 0x4e20, 0x800, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {{0xa, 0x4e22, 0x9, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x8}}, {{0xa, 0x4e23, 0x100000001, @dev={0xfe, 0x80, [], 0x13}, 0x401}}]}, 0x290) ioctl$FIGETBSZ(r0, 0x2, &(0x7f0000000000)) 03:37:08 executing program 5: r0 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup3(r0, r0, 0x80000) ptrace$setregs(0xffffffffffffffff, 0x0, 0xfffffffffffffffe, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2001, &(0x7f0000002500)={0x77359400}) pipe2(&(0x7f0000002540)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) getsockopt$inet_mtu(0xffffffffffffffff, 0x0, 0xa, 0x0, 0x0) fcntl$F_GET_FILE_RW_HINT(r0, 0x40d, &(0x7f0000000140)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$addseals(r1, 0x409, 0x2) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x6, 0x0, 0x0, 0x0, 0x9917, 0xffff}, 0x0) r2 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) fallocate(r2, 0x0, 0x3, 0x4003ff) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x4006, 0x0) sendfile(r3, r3, 0x0, 0x8800000) fadvise64(r0, 0x0, 0x18a, 0x0) write$cgroup_type(r1, &(0x7f0000000040)='threaded\x00', 0x9) r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@', @ANYPTR], 0x0, 0x0, 0x0}) 03:37:08 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 511.507470] binder: 25375:25381 ioctl c0306201 20000140 returned -14 [ 511.514531] binder: undelivered TRANSACTION_ERROR: 29201 [ 511.545454] binder: 25425:25428 unknown command 536871488 [ 511.551227] binder: 25425:25428 ioctl c0306201 20000440 returned -22 [ 511.557293] binder: 25427:25432 ioctl c018620b 0 returned -14 [ 511.565059] binder: 25429:25433 ioctl c018620b 0 returned -14 [ 511.572696] binder: 25427:25432 ioctl c0306201 0 returned -14 [ 511.573765] binder: 25425:25434 unknown command 536871488 [ 511.579351] sched: DL replenish lagged too much [ 511.580955] binder: 25427:25432 BC_ACQUIRE_DONE u0000000000000000 no match [ 511.593348] binder: 25425:25434 ioctl c0306201 20000440 returned -22 03:37:08 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 03:37:08 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xffffffffffffff75, 0x0, &(0x7f0000000300)=ANY=[@ANYRES16=0x0], 0x0, 0x0, 0x0}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='rdma.current\x00', 0x0, 0x0) [ 511.608033] binder: 25424:25431 unknown command 536872064 [ 511.632647] binder: 25435:25438 ioctl c018620b 0 returned -14 [ 511.637039] binder: 25424:25431 ioctl c0306201 20000440 returned -22 03:37:08 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='rdma.current\x00', 0x0, 0x0) symlinkat(&(0x7f0000000000)='./file0\x00', r1, &(0x7f0000000080)='./file0\x00') 03:37:08 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 511.656379] binder: 25435:25438 ioctl c0306201 0 returned -14 [ 511.664675] binder: 25439:25441 ioctl c018620b 0 returned -14 [ 511.666901] binder: 25429:25437 unknown command 536871488 [ 511.672014] binder: 25435:25438 BC_ACQUIRE_DONE u0000000000000000 no match [ 511.685836] binder: 25439:25441 ioctl c018620b 0 returned -14 [ 511.691951] binder: 25429:25437 ioctl c0306201 20000440 returned -22 [ 511.748831] binder: 25447:25449 unknown command 536871488 [ 511.762560] binder: 25448:25452 ioctl c018620b 0 returned -14 [ 511.772854] binder: 25447:25449 ioctl c0306201 20000440 returned -22 [ 511.788282] binder: 25448:25452 BC_ACQUIRE_DONE u0000000000000000 no match [ 511.798216] binder: 25447:25453 unknown command 536871488 [ 511.809780] binder: 25447:25453 ioctl c0306201 20000440 returned -22 03:37:08 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 03:37:08 executing program 0: r0 = openat$selinux_validatetrans(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/validatetrans\x00', 0x1, 0x0) ioctl$EXT4_IOC_MIGRATE(r0, 0x6609) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="dd023b6bdfc9f187228f20fc93f75202221b1328c0123f8c23808b79401745006f4f7e997f0563af2a13cb8b17838233495905ddb040014bc1075487"]], 0x0, 0x0, 0x0}) r2 = request_key(&(0x7f0000000100)='logon\x00', &(0x7f0000000140)={'syz', 0x3}, &(0x7f0000000180)='#,posix_acl_accesssecurity}+\'selinuxcgroup&}(\x00', 0xffffffffffffffff) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f00000000c0)={'syz', 0x2}, 0x0, 0x0, r2) signalfd(r1, &(0x7f00000001c0)={0xfff}, 0x8) syz_execute_func(&(0x7f0000000200)="c4c25537cec4e17910263e676526660f76a803000000c462792a9000800000660f3a0fa0ffefffffdb430f0f7f81b0c4827d184600c442d19b94b0dd0000003666470fe63fc4819d14ec") 03:37:08 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 511.942951] binder: release 25404:25409 transaction 1268 out, still active [ 511.950397] binder: unexpected work type, 4, not freed [ 511.966632] binder: undelivered TRANSACTION_COMPLETE [ 511.988741] binder: 25458:25461 ioctl c018620b 0 returned -14 [ 511.996265] binder: 25460:25462 ioctl c018620b 0 returned -14 [ 512.000917] binder: 25458:25461 BC_ACQUIRE_DONE u0000000000000000 no match [ 512.004414] binder: 25459:25463 unknown command 536870912 [ 512.015414] binder: 25459:25463 ioctl c0306201 20000440 returned -22 [ 512.054156] binder: 25460:25465 BC_ACQUIRE_DONE node 1273 has no pending acquire request [ 512.135089] binder: release 25426:25430 transaction 1275 out, still active [ 512.145299] binder: undelivered TRANSACTION_COMPLETE [ 512.153886] binder: release 25426:25440 transaction 1271 out, still active [ 512.164296] binder: undelivered TRANSACTION_COMPLETE 03:37:09 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040), 0x4) sched_rr_get_interval(0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') 03:37:09 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='rdma.current\x00', 0x0, 0x0) ioctl$TIOCGPGRP(r1, 0x540f, &(0x7f0000000080)=0x0) sendmsg$nl_netfilter(r1, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2c000000060f080226bd7000ff00df250f000004ec8a669a83a38c39e965604c3428a3ad08007a00", @ANYRES32=r2], 0x2c}}, 0x8000) 03:37:09 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 03:37:09 executing program 0: eventfd2(0x7e, 0x1) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$UI_DEV_CREATE(r1, 0x5501) eventfd2(0x8, 0x256b8a58a8962412) ioctl$FIONREAD(r1, 0x541b, &(0x7f0000000040)) 03:37:09 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x6, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00a@B', @ANYRES16=r0], 0x0, 0x0, 0x0}) [ 512.356998] binder: 25429:25433 ioctl c0306201 20000140 returned -14 [ 512.411074] binder: 25470:25474 unknown command 1111515392 [ 512.418198] binder: 25472:25475 ioctl c018620b 0 returned -14 [ 512.426921] binder: 25470:25474 ioctl c0306201 20000000 returned -22 [ 512.435720] binder: 25477:25478 ioctl c018620b 0 returned -14 [ 512.439087] binder: 25472:25475 BC_ACQUIRE_DONE u0000000000000000 no match [ 512.448904] binder: 25473:25479 unknown command 536872064 03:37:09 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xfffffea9, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="f4d63d00", @ANYPTR], 0x0, 0x0, 0x0}) 03:37:09 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 512.461049] binder: 25470:25474 unknown command 1111515392 [ 512.461192] binder: 25471:25480 unknown command 536871488 [ 512.468284] binder: 25470:25474 ioctl c0306201 20000000 returned -22 [ 512.473403] binder: 25473:25479 ioctl c0306201 20000440 returned -22 [ 512.487782] binder: 25471:25480 ioctl c0306201 20000440 returned -22 [ 512.502850] binder: 25477:25478 unknown command 536871488 03:37:09 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040), 0x4) sched_rr_get_interval(0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') [ 512.513910] binder: 25477:25478 ioctl c0306201 20000440 returned -22 [ 512.523814] binder: 25471:25485 unknown command 536871488 [ 512.532397] binder: 25471:25485 ioctl c0306201 20000440 returned -22 [ 512.539208] binder: 25473:25482 unknown command 536872064 [ 512.545420] binder: 25473:25482 ioctl c0306201 20000440 returned -22 03:37:09 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB='\x00\x00']], 0x0, 0x0, 0x0}) [ 512.560936] binder: 25483:25488 unknown command 4052724 [ 512.575144] binder: 25483:25488 ioctl c0306201 20000440 returned -22 [ 512.584635] binder: 25487:25492 ioctl c018620b 0 returned -14 [ 512.616311] binder: 25491:25495 ioctl c018620b 0 returned -14 [ 512.618581] binder: 25487:25492 BC_ACQUIRE_DONE u0000000000000000 no match [ 512.637889] binder: 25494:25499 unknown command 536872064 [ 512.658017] binder: 25494:25499 ioctl c0306201 20000440 returned -22 [ 512.682561] binder: 25491:25501 unknown command 536871488 [ 512.689415] binder: 25491:25501 ioctl c0306201 20000440 returned -22 03:37:09 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 03:37:09 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@', @ANYPTR], 0x0, 0x0, 0x0}) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/policy\x00', 0x0, 0x0) 03:37:09 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="00018af20000000000000000000000000000db05504e09f832abe500283e9dcf844a207c4a2ff8c2eb20fdaf73871c04b4c26f7756190c59c87c37eba760a1e3afba9e57b483534b46bfd2ff5cf29456cc4f00000000000000ec3eab1fb5bb44877192b3b0ea38c1eedc3ea63e59bd2d4047fef4efe75bb845c0948d373f1b51e215e93fe2477673a06e74cd59ee5e7b25f9b9c87de86769948dae1966511769932eba7bfc2cf4fda1b9e564a95a36c95b0223fa9a9d35baa61d0240b4273a8e21b8a082f120ee7a42cc08533b1533d169a9570cac0681"]], 0x0, 0x0, 0x0}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='rdma.current\x00', 0x0, 0x0) 03:37:09 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 03:37:09 executing program 0: r0 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup3(r0, r0, 0x80000) ptrace$setregs(0xffffffffffffffff, 0x0, 0xfffffffffffffffe, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2001, &(0x7f0000002500)={0x77359400}) pipe2(&(0x7f0000002540)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) getsockopt$inet_mtu(0xffffffffffffffff, 0x0, 0xa, 0x0, 0x0) fcntl$F_GET_FILE_RW_HINT(r0, 0x40d, &(0x7f0000000140)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$addseals(r1, 0x409, 0x2) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x6, 0x0, 0x0, 0x0, 0x9917, 0xffff}, 0x0) r2 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) fallocate(r2, 0x0, 0x3, 0x4003ff) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x4006, 0x0) sendfile(r3, r3, 0x0, 0x8800000) fadvise64(r0, 0x0, 0x18a, 0x0) write$cgroup_type(r1, &(0x7f0000000040)='threaded\x00', 0x9) r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@', @ANYPTR], 0x0, 0x0, 0x0}) [ 512.789157] binder: release 25460:25462 transaction 1272 out, still active [ 512.817307] binder: 25507:25510 unknown command 536871040 03:37:09 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 512.842537] binder: 25506:25513 ioctl c018620b 0 returned -14 [ 512.843876] binder: 25507:25510 ioctl c0306201 20000440 returned -22 [ 512.850364] binder: 25509:25514 ioctl c018620b 0 returned -14 [ 512.865097] binder: 25506:25513 BC_ACQUIRE_DONE u0000000000000000 no match [ 512.870846] binder: 25507:25515 unknown command 536871040 03:37:09 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) getrandom(&(0x7f00000000c0)=""/153, 0x99, 0x1) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) r1 = openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x101801, 0x1d1) ioctl$TUNSETVNETLE(r1, 0x400454dc, &(0x7f0000000080)=0x1) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='rdma.current\x00', 0x0, 0x0) [ 512.902393] binder: 25507:25515 ioctl c0306201 20000440 returned -22 [ 512.923409] binder: 25509:25521 BC_ACQUIRE_DONE node 1278 has no pending acquire request [ 512.923841] binder: 25518:25519 ioctl c018620b 0 returned -14 [ 512.937481] binder: release 25505:25512 transaction 1281 out, still active 03:37:09 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@', @ANYPTR], 0x0, 0x0, 0x0}) r1 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x0, 0x0) ioctl$TUNGETFILTER(r1, 0x801054db, &(0x7f0000000040)=""/134) [ 512.967103] binder: 25518:25519 BC_ACQUIRE_DONE u0000000000000000 no match [ 512.971751] binder: undelivered TRANSACTION_COMPLETE [ 513.003684] binder: 25524:25525 unknown command 536871488 03:37:09 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 513.013936] binder: release 25505:25512 transaction 1276 out, still active [ 513.022155] binder: 25524:25525 ioctl c0306201 20000440 returned -22 [ 513.049724] binder: 25524:25525 unknown command 536871488 03:37:09 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="0aff7f91fd09d20185ef7fa49fde6472c5843934bbdf4b5cd1addfc100ad0eeb9eb0d6dd7f1d82b80da496b12ae28364df8bda61efb4963f183d"]], 0x0, 0x0, 0x0}) [ 513.067029] binder: 25524:25525 ioctl c0306201 20000440 returned -22 [ 513.068870] binder: undelivered TRANSACTION_COMPLETE [ 513.076577] binder: 25528:25532 ioctl c018620b 0 returned -14 [ 513.110305] binder: 25528:25532 got transaction with invalid offset (0, min 0 max 0) or object. [ 513.124869] binder: 25528:25532 transaction failed 29201/-22, size 0-8 line 3230 [ 513.125235] binder: release 25526:25533 transaction 1283 out, still active [ 513.189116] binder: undelivered TRANSACTION_COMPLETE [ 513.202070] binder: undelivered TRANSACTION_ERROR: 29201 [ 513.208021] binder: 25535:25539 unknown command 536870912 [ 513.211642] binder: release 25526:25533 transaction 1282 out, still active [ 513.214790] binder: 25535:25539 ioctl c0306201 20000440 returned -22 [ 513.224976] binder: undelivered TRANSACTION_COMPLETE [ 513.232275] binder: 25535:25540 unknown command 536870912 [ 513.239957] binder: 25535:25540 ioctl c0306201 20000440 returned -22 03:37:10 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR], 0x0, 0x0, &(0x7f00000003c0)}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040), 0x4) sched_rr_get_interval(0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') 03:37:10 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="000000000baa89d36a932e2fa910728d1a55d93bee4f1563ccf7f3acd3ab89f1976b57f32d469875865aab8db63e63c50da469ad718368b674e0c30975a6fecab36147445b3cc635c97375d47277c2d5bb3a16c863f9a3400fdc37d4eff7e0a8a39e7f17ab7eed5120c5bf66fbbce91e7e8dc27caeef25f7d62ae83006cee95bec19c5775145dac1a34bd22f5a3042fb181c77a013d2b8f63d5535d6db1e37a4af23c76f9e4c2c7db2e5b25344f9de246252c32d8a575b58aaed705fe383386ba17d142b86b3e7f68f46babcaab1750b5a31c8efc2c1914c7b8e7e7abc2bde4f4595305ca0ca21619ded4f7fffd4ca3939a591873a2c2303c08a8e220a514c90", @ANYPTR], 0x0, 0x0, 0x0}) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000500)='/proc/self/net/pfkey\x00', 0x23f6, 0x0) setsockopt$inet_MCAST_MSFILTER(r1, 0x0, 0x30, &(0x7f0000000040)=ANY=[@ANYBLOB="000000000000000002004e20ac1e0101000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000100000002004e23ac1414aa000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x110) [ 513.402164] binder: 25491:25495 ioctl c0306201 20000140 returned -14 [ 513.435021] binder: 25544:25546 ioctl c018620b 0 returned -14 [ 513.435390] binder: 25542:25545 unknown command 0 [ 513.456723] binder: 25542:25545 ioctl c0306201 20000440 returned -22 [ 513.467672] binder: 25542:25545 unknown command 0 [ 513.474907] binder: 25542:25545 ioctl c0306201 20000440 returned -22 [ 513.494372] binder: 25544:25548 unknown command 0 [ 513.499290] binder: 25544:25548 ioctl c0306201 20000440 returned -22 [ 513.516279] binder: release 25504:25516 transaction 1280 out, still active [ 513.525047] binder: undelivered TRANSACTION_COMPLETE 03:37:10 executing program 2: syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) r0 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x1ad, 0x0, &(0x7f0000000080)=ANY=[], 0x0, 0x0, 0x0}) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r1, 0x40086602, &(0x7f0000000080)=0x7) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='rdma.current\x00', 0x0, 0x0) 03:37:10 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='+'}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 03:37:10 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 03:37:10 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x2b7, 0x0, &(0x7f0000000080)=ANY=[], 0x0, 0x0, 0x0}) 03:37:10 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 513.640176] binder: release 25509:25514 transaction 1277 out, still active [ 513.667001] binder: unexpected work type, 4, not freed [ 513.674383] binder: 25556:25561 unknown command 0 [ 513.674394] binder: 25556:25561 ioctl c0306201 20000040 returned -22 03:37:10 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@', @ANYPTR], 0x0, 0x0, 0x0}) r1 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000000)='/dev/keychord\x00', 0x4002, 0x0) write$P9_RLOCK(r1, &(0x7f0000000040)={0x8, 0x35, 0x1}, 0x8) r2 = mmap$binder(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x4, 0x2f221692a3dc5fba, r1, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)={r2}) [ 513.680572] binder: 25558:25562 ioctl c018620b 0 returned -14 [ 513.694790] binder: 25552:25555 ioctl c018620b 0 returned -14 [ 513.707972] binder: 25558:25562 got transaction with invalid offset (0, min 0 max 0) or object. [ 513.726213] binder: 25552:25555 got transaction with invalid offset (0, min 0 max 0) or object. 03:37:10 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) r1 = fcntl$dupfd(r0, 0x406, r0) getsockopt$inet_buf(r1, 0x0, 0x30, &(0x7f0000000080)=""/249, &(0x7f0000000000)=0xf9) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='rdma.current\x00', 0x0, 0x0) 03:37:10 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYPTR], 0x0, 0x0, 0x0}) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x149000, 0x0) ioctl$PPPIOCGUNIT(r1, 0x80047456, &(0x7f0000000040)) ioctl$sock_SIOCADDDLCI(r1, 0x8980, &(0x7f0000000080)={'syz_tun\x00', 0x8001}) [ 513.735380] binder: 25558:25562 transaction failed 29201/-22, size 0-8 line 3230 [ 513.752054] binder: 25553:25568 ioctl c018620b 0 returned -14 [ 513.758230] binder: undelivered TRANSACTION_COMPLETE [ 513.763110] binder: 25567:25571 ioctl c018620b 0 returned -14 [ 513.769142] binder: 25558:25570 BC_ACQUIRE_DONE u0000000000000000 no match [ 513.781192] binder: 25552:25572 BC_ACQUIRE_DONE u0000000000000000 no match [ 513.789956] binder: 25567:25571 unknown command 536871488 [ 513.798960] binder: 25552:25555 transaction failed 29201/-22, size 0-8 line 3230 [ 513.808229] binder: release 25564:25565 transaction 1288 out, still active [ 513.814480] binder: 25567:25571 ioctl c0306201 20000440 returned -22 [ 513.817844] binder: undelivered TRANSACTION_COMPLETE [ 513.829931] binder: 25553:25575 BC_ACQUIRE_DONE u0000000000000000 no match [ 513.834409] binder: 25567:25571 ioctl c018620b 0 returned -14 [ 513.842764] binder: release 25564:25565 transaction 1287 out, still active [ 513.844373] binder: 25567:25577 unknown command 536871488 [ 513.851961] binder: 25574:25576 unknown command 0 [ 513.857742] binder: 25567:25577 ioctl c0306201 20000440 returned -22 [ 513.863543] binder: 25574:25576 ioctl c0306201 20000440 returned -22 [ 513.878530] binder: undelivered TRANSACTION_COMPLETE 03:37:10 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 03:37:10 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x60, &(0x7f00000004c0)={'filter\x00', 0x7, 0x4, 0x480, 0x280, 0x0, 0x0, 0x398, 0x398, 0x398, 0x4, &(0x7f0000000000), {[{{@uncond, 0xf0, 0x140}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@broadcast, @empty, @dev={0xac, 0x14, 0x14, 0x15}, @local, 0x9, 0xffffffff}}}, {{@arp={@loopback, @multicast1, 0xffffffff, 0xffffff00, @mac, {[0x0, 0xff, 0x0, 0xff, 0xff, 0xff]}, @empty, {[0xff, 0xff, 0xff, 0xff, 0x0, 0xff]}, 0x1, 0xffffffff, 0x4, 0x10000, 0x3, 0x77c0, 'ip6tnl0\x00', 'ip6_vti0\x00', {0xff}, {0xff}, 0x0, 0x8}, 0xf0, 0x140}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @mac=@random="131634426c17", @empty, @loopback, 0x8, 0xffffffff}}}, {{@arp={@multicast1, @broadcast, 0xffffff00, 0x0, @mac=@dev={[], 0x25}, {[0xff, 0xff, 0xff, 0xff, 0x0, 0xff]}, @empty, {[0x0, 0x0, 0xff, 0x0, 0xff, 0xff]}, 0x1f, 0x8, 0x20, 0xff, 0x8, 0x0, 'netdevsim0\x00', 'syzkaller0\x00', {0xff}, {0xff}, 0x0, 0x342}, 0xf0, 0x118}, @unspec=@AUDIT={0x28, 'AUDIT\x00', 0x0, {0x2}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x4d0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) setsockopt$ARPT_SO_SET_ADD_COUNTERS(r1, 0x0, 0x61, &(0x7f0000000100)={'filter\x00', 0x4}, 0x68) set_robust_list(&(0x7f00000000c0)={&(0x7f0000000080)={&(0x7f0000000040)}, 0x5}, 0x18) r2 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/hash_stats\x00', 0x0, 0x0) connect$inet6(r2, &(0x7f0000000280)={0xa, 0x4e21, 0x40, @empty, 0x4}, 0x1c) [ 513.892082] binder: undelivered TRANSACTION_ERROR: 29201 [ 513.905472] binder: 25574:25576 unknown command 0 [ 513.908173] binder: 25578:25581 ioctl c018620b 0 returned -14 [ 513.917274] binder: 25574:25576 ioctl c0306201 20000440 returned -22 [ 513.920898] binder: undelivered TRANSACTION_ERROR: 29201 [ 513.950147] binder: 25578:25581 got transaction with invalid offset (0, min 0 max 0) or object. [ 513.961745] binder: 25578:25581 transaction failed 29201/-22, size 0-8 line 3230 [ 513.962921] binder: 25584:25585 unknown command 536872064 [ 513.986087] binder: undelivered TRANSACTION_ERROR: 29201 [ 513.998356] binder: 25584:25585 ioctl c0306201 20000440 returned -22 [ 514.012273] binder: 25584:25585 unknown command 536872064 [ 514.027711] binder: 25584:25585 ioctl c0306201 20000440 returned -22 03:37:11 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR], 0x0, 0x0, &(0x7f00000003c0)}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040), 0x4) sched_rr_get_interval(0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') 03:37:11 executing program 2: prctl$PR_TASK_PERF_EVENTS_ENABLE(0x20) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/policy\x00', 0x0, 0x0) ioctl$PPPIOCSMAXCID(r1, 0x40047451, &(0x7f00000001c0)=0xffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x8, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0563020000000000"], 0xa7, 0x0, &(0x7f0000000080)="303348ece2b5c40ab66d68f01afdc5df193023d8a7d10d18a04deb6b5f1eb80833c582640f87ae0880c476c835fa794891a03d4adf177fcf61699c0f45cdefc7c9422d0606e44e6361597275238e18523a10d52f4ee57913f56b7b3bdad85101217a3fc978fe6331fea67d639cb6af6511159833b39b6380c1b667382c8e377e74fdf0fdf0e4f75115ec4603925a48b7d93153f48d6c3826b1f80ce52b698b3b447ee983071754"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB="ff00000004000000"]], 0x0, 0x0, 0x0}) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='rdma.current\x00', 0x0, 0x0) ioctl$EVIOCGABS2F(r1, 0x8018456f, &(0x7f0000000140)=""/47) 03:37:11 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@', @ANYPTR], 0x0, 0x0, 0x0}) [ 514.234772] binder: 25544:25546 ioctl c0306201 20000140 returned -14 [ 514.270557] binder: 25595:25597 ioctl c018620b 0 returned -14 [ 514.279031] binder: 25594:25596 transaction failed 29189/-22, size 0-0 line 3018 [ 514.289296] binder: 25594:25596 transaction failed 29189/-22, size 0-0 line 3018 [ 514.289617] binder: undelivered TRANSACTION_ERROR: 29189 [ 514.304660] binder: undelivered TRANSACTION_ERROR: 29189 [ 514.322378] binder: 25593:25598 unknown command 156421 [ 514.328925] binder: 25595:25600 unknown command 0 [ 514.335676] binder: 25593:25598 ioctl c0306201 20000200 returned -22 [ 514.340330] binder: 25595:25600 ioctl c0306201 20000440 returned -22 [ 514.345403] binder: 25593:25598 unknown command 536871488 [ 514.357550] binder: 25593:25598 ioctl c0306201 20000440 returned -22 [ 514.367084] binder: 25593:25602 unknown command 536871488 [ 514.367151] binder: 25593:25598 unknown command 156421 [ 514.374043] binder: 25593:25602 ioctl c0306201 20000440 returned -22 [ 514.381341] binder: 25593:25598 ioctl c0306201 20000200 returned -22 03:37:11 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='+'}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 03:37:11 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 03:37:11 executing program 0: r0 = epoll_create(0x7) fallocate(r0, 0x1, 0x0, 0x9) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="2b1f34e3afd39afe159df3e2a9efdaf677fdf6011eae2a5fab82e27184190d28d9a7eb117a61abd14489be5b29af9f419d99cba29202f325e52b9820e19e01399caee9e9b5db8e9276d7d1aa9c6800000000"]], 0x0, 0x0, 0x0}) 03:37:11 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00635018", @ANYPTR], 0x0, 0x0, 0x0}) openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/sockcreate\x00', 0x2, 0x0) r1 = creat(&(0x7f0000000180)='./file0\x00', 0xd) ioctl$TIOCGPGRP(r1, 0x540f, &(0x7f0000000040)) syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) memfd_create(&(0x7f00000000c0)='\x00', 0x7) 03:37:11 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB="ff030000"]], 0x0, 0x0, 0x0}) r1 = accept4$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={[], [], @remote}}, &(0x7f0000000080)=0x1c, 0x800) accept(r1, &(0x7f00000000c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, &(0x7f0000000180)=0x80) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='rdma.current\x00', 0x0, 0x0) [ 514.580782] binder: 25605:25611 ioctl c018620b 0 returned -14 [ 514.587903] binder: 25609:25612 ioctl c018620b 0 returned -14 [ 514.588468] binder: 25607:25614 unknown command 407921408 [ 514.595292] binder: 25605:25611 got transaction with invalid offset (0, min 0 max 0) or object. [ 514.606701] binder: 25610:25615 unknown command 536871488 [ 514.611310] binder: 25605:25611 transaction failed 29201/-22, size 0-8 line 3230 [ 514.617857] binder: 25606:25613 unknown command 536870912 03:37:11 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 514.627680] binder: undelivered TRANSACTION_ERROR: 29201 [ 514.631668] binder: 25607:25614 ioctl c0306201 20000440 returned -22 [ 514.646116] binder: 25610:25615 ioctl c0306201 20000440 returned -22 [ 514.654305] binder: 25606:25613 ioctl c0306201 20000440 returned -22 [ 514.663970] binder: 25610:25617 unknown command 536871488 [ 514.672176] binder: 25609:25619 BC_ACQUIRE_DONE u0000000000000000 no match 03:37:11 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) vmsplice(r0, &(0x7f0000003580)=[{&(0x7f0000000140)="914d474fd5", 0x5}, {&(0x7f0000000180)="eacb1b896f187de73e28a9a796bb6f33e0f8aca5a5c92b285ad4f50af50aa29c46bf8e3941162fdd3eef0fd8dd141f263537a2d5889c386543cf8f5c5450e488de2e260db46c3719a176cae1aea497dffca474b6dfca37c11d9fdbcb73f73d2b635037eaf66ab59fe9e9150df52447f86b98483e546e7d4775ef1ef42cbc0ef8678654e6ebe7a0c97407d4fb32319da11a415dcd1edf3583e6b28a3e7d", 0x9d}, {&(0x7f0000000480)="cb82397a9a69cd9cf4fec2ae0f41279b4ba92c52fecb560f0686a71f85326c4d337309a28f8ed3aa9bac5137f4fa2c4cc9c320664749f123a6ca38a51566180439252fc5f73e2ba0b49c87a81037fcd8576698773942c786f0970d0253f6d638da6f0544e129ce79eabc0189a870107f82a3637e9d7c0e82368a7dc395ff08b04a71ccaad4dc2d2fb43ee7afac2d6a37a6ef2263b5c806226b43e5dc224bd34015cc6ba22f27a770499ecb5b951a6db6f229eac5c17e17184df15563f14e599a194d73c8931380113a2ce1215f78591e1f54c53d71a3755bc2e011652264ec16a926231f97a1812afd2a7262c0154d51b3161d0715d0c4942f462eca8a9169ca4d9b26aebc4d5d9613d20f02ac477562e26fabb467701089aafb0f9892a6534e6d666f817d0b3170feaccdea1a882f77663e859f4137899bb41ee11ea3976ef046f92b5136b8190b7a31ac4fd20e7b3305873160141e35396472c6d17f96965e01170a1c166f17fa3982b00748ef313d5c519409dc464691471a99a75359f05fb00733d73ca7ad3b083e007236ca03b896d443bfdb1ecf3f1616a9109be3d2c10a681e9efe9e4bf1b4f7309e536ef13a940b9134c7212c39bd90eda0c99ab757820db359dd3e655641f699ec1e61823992c5f21891bf3cdbe53036d62c0214a0ddad8e0653a081b44ad2b8ef7a418a224d4bfcabbcd007c5f98c86c6b3a49d2b80da23d2744ce9660af927dd6f2170666ec1520578f30f7a35ee9e82f9e973d8b2195aa11e1c10fa72c00805bcda9ebfe7b6a5c4f0fa52a6601da0f9a7288097fdba247087e101fda38919144f40398932a4c749316c3bffbe05702aca80c946b53f01cbc9e2bb2a382621d612a631e2082d6909e86c7e1e81e1a13639b53c64b166f42398b0f0e13d98528ea280a5ba22d16e7a212eca530540e416d94ece3cdec6993afd06be84db9dbfba4797bc2a28a3e058e1c5253b89c1fa849529a7cba99a4f725e959a17f6bf199510da1a3afbe58b50d6ebc19ce1beba2eeb2712cdaa5f6fc7f5bfeff019cddfe304973abb8f001044cf5ac3ecf82fafdb3b4d82a0eeb8ee2bd363405063c4e81ce1205a90556a9fe5508c653758605d192cc8bc89b3e28ae619f8044aa7160ffdfb5307922d7856cb459478d3da84252a6aa9f148e60ad53d65712450d0d27f600ef47a33ad1ac239414c753044d253a4a5b90b8625595284968e034ed2cd071c723fe2acb660f3693cd96b662548beb47c65f59f4977afe61519dd7ccb4ecbbbbe682ca2a23605365b214ca5ff1eb6f6251171ecb34d22a5333a394585b290b6245481d4c30f26ad59334022f7a26e3e51def6bd4133bff7c7f8c05ebe3ac94373c667031d3ea32bb9a426e13190666cee0139ca422ebdc8f88326cadae231f0f8eee0a9a1ee1e4be5c5ff0506c3dd7bc6d6594524ae9f0fe31a4b78e428ce024a2c8717ab80edb54d009dfee05064b1b79978dd9d08c47d23b5e3a72ef14d7c7aaf024f4ea6fb1ca555d3ea7added3c0010f3e540bb7faa6cc748c2a693749f6cf5cb3f94e2b6910d6c371edd57993205ac20fa0ed1ec36862bb2802a6bafc2c615207948785fca77a609383d70500005e51795c6100212864dd3de262e4e7b8f1b25dc55ef3b9fe167bf3d9a6b4772e43e002a5dc7a78d175c1fef2e193306365e9aa3907b9653116f3af84bf5dd5a37ee9b3713c5daef90145d7948187880e582c1feeaab3ca8634517413f5f7002f8b02b186911613bdcaa86647a841e09ed94bb5b9bb0a9def7c3d72c0bbef80a3fc72bbe6f3b281c52a349daa3c57e2512820181e8050680d50856d539deac632cf1f731b1fbf34b4ae81794bef9e6758bd1d473c229599b68e551c466e81f39a38c7cacaebe6df0db9446edb75ac0f1d33acb82e551004e0530b341f2556fafedef96baf8820e89f54ebd9ae2c5737b53603c7665aeb63cc2ec620ae08884dc8b839fd35cd25e78c37cf0b04f4d6e4b540d77450d1ddc47a6fe20ae624c58b82480640be62a2ca11106b8901019cc56675e72ad451f01e9d98d8d63c182bed8bf41e5c0fde2ff2de114be0cc652114f99199b5297072e17c9fb7a82c207ccf5e6da220b769a9151c140c2e28f0b1b2e6b2552ce4f6f47bc5d28508683307a431a5e806fa9bd55dc1831095ddf9b751d5fc19cefcd95e9814f92c5407c1104cf04094042b5a8fccd799567140f0221202a93f5156f5426acf071ca49242566d576c59b16a27ff2521f8faf2ca697d8182883351e9acc0a53b6da9a4cb195d687c82c7ff0318560e36951a89869c058b9db7406413ae5385b89934d9deb47772a14cc3dda7f2a2bd9f2a59390fb2e04fe8b8dd2ee7a57ee04ce96666b8d3d896e5b47f3b8018dc8490eefc1c741d7ecc5aef0bff8ee9dbc3a0e482495e8a94cd1028759817e325587148c0eb7cf714584eedfbb2d395cad77d3ea4dfb7d16531735b1af61639a1ab4649dd9a1b010825c100bb677fab23973b9817e5c4dd77e006d6b4faf95f6fd5f197d187fa0b636b1a2b50210ea3f11674b53295452bcf6ac0bfbf8b0b4a8857995ad0c0e59f592e952c5082beef1505f1390d6a77480051ad055ab5e27d190025777d544cd422e5369312137c64b5ee916f7bcbaeb9fa218e05342a45ac3e95cf6ffb53d1230bae90ac9ae68f5370535ebbf26e277162484abd3a6b73d2d318343a1270b97d1bd03fce840ff04d9c593be436af9781b67a78b083a80ade748ca9914841ec64e2e5ca927cad80901dccd79c230b41db086d9b444aab77bfd26b288cbe3075b5b259f313ffebe2f346e18747796ee3f534dd0088db3170097d570f4c49a9d48eb62a725adf6bd7f40e2c0b3844b3ced09c9a6dc74179da227534b7971118e761a2de55edf1995ce96e0d6eda6e0da015f8ff6f28876fff3ea6cf27b0960efa7640b8fc6a74d90b7e3bf4f751030ce1526ea78c374d17ec57f4311a0d57266b28fae713f2323face6f8eee2ba8fe5974488648b2e9a1caf51c28771b1f549b5660bc01d97c421039434538efbc40324f1700bef24a0c6311f1057ecb53d436e599374e17a0e9160c63da22f40dea4b30fea633c998ffe27ff72be4236e70109051348f2bc027d54db73bfea5336136b39cd6f7892917fb5e69e4451e225b9a757569624ebb86e59db458b045d669ce4fd3863a6c6f1a7de85a0e61be0707921c4452d95dda7b2d6fef9ca3075b2f28dad15abeef1865f74a4789f0b0754c8d13d9cf77969b6d063a5e6262949d07f938c2ec306db76097c7241ef462fb5eaf4b46e37dd5aeb6af5ba16140ddc905dd06fb7b40407608b12ad29824ec4fb1e1df9782fb847aeccb31fff3fd931e31c03d318f1bdd8fd2b8f1cbcfa76b43279e0fabf929feb4fa8b09068374ca4473a6574c0dc7fdd22df7b9bfbcdbe6fbcb9928e1005284fb75fa556251180fa2fa48b6eab307a3c3fe10e79c663299ca51b88e5e521065eacfc52edde141dcdf295bb0326a14e26d658198361331fe5b7174666d85e0c037920d33639fd0054504d2b199fa1536f473c313ce379c516ce101a00cd78223ac6e1f56aeeecda4280080ae84ebdde1985b2815b7ba35b78b79f677092e04e6b9f16ef9261503b3e129693d9ab284bb4153e8036110eb2e77a562555d621e706b7690cb363d926bf9ea9e039917ec0a89c6b7473011550478664dc969a3a0ed373388f10c934ba8388b9eeba83e5e709c178ef3854a6c6ea4aca7db6b17eefbf624a14fd1a1bc4e4c1d28fd9ea1ecb174b3ee7676f9fe7e2a341b0b63dbd46e4a63e5da780e31eb16cae0bf125ac4c7557a3b7a9973f2ed8108acd7645cf32bc7bdcd7f768b92da9723c60014a704fa06b4c4e25755fc61307a7fbb6c344491257d9ec4dd6f02ee3e8dc18b662c782acd9aa3ff38e26a23d97bea6be9e711b51f0a7f27eef12ca93bb81200473fa01a228fee168192113b143991d2e213169e096da8e050b6606918c22c924d00b72efeb44fd7de6c33250f7c9fdfa7fd003f4127f19d5b1156c19746f436dc97ce8d8ae85eead997fc9a738c07e2567375c686b635a6e3d418b034a1411f242892b9532f7dcf7afd43c1f5c59f77ba20d5fadda252ed55e7de0a769ee56ac79c84a65c8eebc66ec604b8acfc696fe11b779a68240f8fd8b6d6c883083b1686a41c4a77fc8eb7729cfb809df7a978410edf3eb321ab3a6d9607111f4246dd67803983fd80af984f1df6d501363372fa3da6b9f592bdcb65cb1f41d5d7d1cbc9333117be1c365e81b856feb9d8b5a28cb9b173a0c8ef055151f10c1d2231d41ff18bd4b430f21c8e208af6fbf446705257a58aeae8bdccf7c36ff06470e9c43df7f684038a06dff382b4bbdb8d299a182ec1eec00be8b377ae71782ae12d38d9bc33f4b2053ac0d4f863c2a299e6000d5fba7afca93f0cd8a73c249bf43a8bcd34540d21afcced61188ba42a2a194a4d280e4baac128a3e57eb125eb5f033a2a3edc164ec6a6b3fe401555afd8f442cce60cf01cec5922040132fea24aff0286cd2600611f6b40a12ebb4f2ed1d1a5b92791537d00ed9b4abe45330c3be252b6a07e7c5642143084da05abbec71db2f4557c30a79fcf813a0b6c43f32a33d113e6ef1b6ce30934c4644a4a75f0e235a79da27c7aa4f7af6cb3a46cc99a97c8fd508106eedb438879433f7315cafa9631121c529281b068a720fb221ac1f45a185752ac3eafca1521f4249f6ae42b55f981891b01a24ee44ff670f2499c1890c790588f88640a2196e1d24bf4144d1620eb7153ff322c28b100a19f7bb4992e3fad7add09eac0c19fe9e2505e2dc71c9ee4d25d7ac98f1ca3c182a46756bd664b04560c00f999060f18a3c0a18a3eaa372a7e1d3d3f6302c55401ad9ca30ed1da9a7397d97bd633b9009ba58aa92d5675fb93adb796c64e14badfeff06ff0f5cd4be0e482fad067988e7f3bf9acb39d738b9b5c1ea92f691863e57b4aa331e54e79fcd8be93663e473fc3183f5c9915ed8b81583f7c73e1ea9b2cce52b10668d9c3e81a78085b694c673441647313d9d7dd8f35289915b11f80545fb65ba861176b951ad24219ff869ef6fd584d33ee98bf10473efc7a2fe14035fa763caff5892a9848383800d09da5f52acaff3fa4497804f95778695c7288eeef6d25e96c07abbf2584f14eba493cf79d93c125ec86e53864c5c7b6b7840ed947c048f104149468d6e881a9839f577d5d3190f1d6940df31718e8ad10b58191cea2cfc217666b1f302378ff38fa2817a44783a41c30951470411888afdaf525369ac535fb8aca08b55c83832766a05e091a09ba3d1edb978ba6ab9eb5e54ab36b9afce6dddb4fa2e923c55c2eaa2eb994533fe6fdcb5a6a18c518b56a3f793d65633f5f20e3148be277aabc140fa5ea5a9f2356c0906a17651a65a3a528929b407d47c5c97a5659e6773cca9a8b242c1226d30d9db7939b3db9a2c3530bf2e1e9278c1f47d588da7d2b47313f932b8baaea587157932ca713ec2fe76d834111bec562c83df5cb7ff2d49a01e39fb2fb03b968bc1b7e24fe52a73459f6da445e115f871b3e43d89177148fdcd8aba9ae442bec9eea869db06a783765f8790f4ac7f94a20b867ed9c7c7b230943f287cd86e3efe6e302d8bf1f634fa1b0399cc89259e0b1e4c9ab721e5a01d92898bd46836361e1d3df5d28837feca026e9e944c560d770064274e897853fb1aece890b54f5d8a61e085a6ce02887c72283acdb55386210c0983ff244949b4c", 0x1000}, {&(0x7f0000000240)="1fc80f9095d51c77c143793ef8d1ceee95dbca9018230c714f9a60ebcd3c33a8cd95ed31e4385515b3788fa7a6e2fd709f77b558b95c17b36b5ad11fe10b92ce0a2146c1a20dd357e019f99f291bdabff9dd5cf1c14a1b7b471f1c479934d5b7837631d83ca01a8400a78cea4b2064f311b15f62c9d386143ed195c034df94d141b75f9276b4fe5320d0738fbfbd19e1a32481dbe228151fe5e8a27907029d6f3a15c639ef6a306be6f4f5e57f7ccbe1763baccd5bee8fc2fd4310b109eaec30395b547fcc37c9021038e511b95e37720507cc5566f66848331004", 0xdb}, {&(0x7f0000000340)="7e6746765651ad0513368c0180325066305f58ad24b8f00d89288b905928bfc24b9a5022d8dc7f4156acaf335d1d4b27649012b98d448b20a0242c1ec6fd66", 0x3f}, {&(0x7f0000000380)="f7afe485cd37ffa3fcf645fea0b387e7136791d30fc087f8fed63decd55110b605f3b69b5584b781cc3072878a", 0x2d}, {&(0x7f0000001480)="346e61a5e185215f3958c4b6b438c1c51a9900b2b252b532e06285bfedc2c671f801bdf7a2b6f6736b78e35684d744900637856dff81662251f77458143fd276ba68447eda4c3cd8d04b18a4ce52e9a48c8e7df2327554bd32d1188ae78a44af2dff788f76e435af5ebb8ff6c81e2ec7e530a368e8da128d15a4786aa7e42e4b4298e370be0f105a7924c7c2e96508e5b730f46a40ec9318b2ac476a21e94fc82e40c1760914f3b0b207248a7542edfde53c9d0a9bf3e54947eedffad9f85e132daa0389c048ecc9cb0a353746e4e4aa", 0xd0}, {&(0x7f00000003c0)="6f186b7dc8a8ab0b67244f48b6f35786558b10abe73b8235f7ad", 0x1a}, {&(0x7f0000001580)="3b084038f2171af4d8275e050e58fdec0c3e55c65cedc4a9c661ccbff6f5fba49844fef77bfdfce3a2b396bc87832657a0e52919d5bec305cd404d53fc206a9306e532a230f8cca9ebfa208a398248e307bb903ec91634d27c23175564a70ddc98012ae68cada31df2c9eb41c0a912e381e8803f3d4df09cdd4e19b2bebd42c7255ed7b42f90693656eba5db162d12407844926c3c6fee505faa65ad4a3cb66f02a12b5a24bc63302aecb3867f0246ac0a380cd692560b790154264f6cbe5889def579b0e03a80daa4a7eca407412364389209f8f92ab5e38d579fe9e4c629976f8129d0c1894bfc01b01bee967d57e9b1e0cb806581b3b0d9add47ba6a2b68f2d49a9345b9f4638e9bcb4855eddce964060c130467c40a68531501dc75af34d0fe41ad408b39a73dd237e18e65a850d5d26898a171b22290269b0fc1cf9b11e06856af750d562c0fb123fed0683077dfb98b94163b8f0cb8029e7f6db4a394dd6be57e5c380980103efaaa276e977424bf9a60c6cad0cdc75b6809f79826e2d7c829a3291f280d1fe620e0674842e3ac9e3557a6b2604d4af3a422ab25bbe1878feb292eea2914048d3037aec1cb271d8462006a66194337c429182d969a6d23a882a3e4be7133e4a1ade0dd9b16e86885684f09516e9df95349eb5c336080895dcfaf2d20bb8cb8805c247ce12116b3053f1e7e0d1e4c421c87305539e630e1aa54a0c6df99a655d2117f565f56be5d0eec0b2494e4ff93f0d462ac84cdab4d2dd6b5c242cc58794642b2916266e21f8136edb1df47c667d125bc4fccb0599837895a1f594e3cbd50dd0d44c64afa4768ddbf608fcbd9d42310aec5c441643863cd1ab597eadc9f3de2ff64fd837458b2c85b4d3872a5e62d0aea097718d108649f1210a6991af900b720722a0d90f12a69b70f055f84d124cb50a27de18351ffb86867237cff0cfcfc47badfb3ec5d4083c7ba822750d6460296721faf94a72022dacb3497e87fd6784522bec4c28babac7688c3c83f08d64cc9ccb1b7894e5600ab480ff4c40ca3b0fb4e3d576814d28493661c15c1775eeb20c838482130c5bae16a443020fb1d44ff3089a4a6e46267cdc6379729bb9837084b4bd7e49da4a9fa0ecca28f4a12cb24d6becb01346dcd56487da0f52df344d10ef3fbddda321e3306569f17d179901f14253b5b7794ff9fb22a845bd78a989767703f4ddee1fc236954f34a659f7b768c92bda56a4486d1827992432fb43fcf6504226462aa6018d676efa0782e0e894fb1c7feb370fd4083d2c92941840088f00d4bfe0947d9dec455316f360513abc8e2f5c14ced93de93e62025019b7c5a0c6e64915842ced00fc402379fd0e029f50993c4444180e995ac026f33d7e07fdd59a1ac9aa55ed585a0c0d82539c6a4021f95642773bda76da85d4fc7a0c66c210a1eeee7fffba37d9f302a5eb79689f2935f55a5a2d61547739777f524256295cae6c85f67165c8c476b8bdb598914a35224407a05f3a34b7d6a9be283fe2758374f546ef41cfa8703fa59858a17b1c2200aaee319509c302492d12468a9e558fa561cf5dc35c66f4bc0da2de909fee6be3e8c4cbafd20b84e44874b4a0217fb5a4dfad330fa49144ec21b896276d121cbe641e5a99811f82e3d47819dda5e55f01b50363ccb1c99d20f867a2e81554f3b079356d7073a5e902f059246a3d9600a472e350a0849768eb2cf62e48ad1478fd2cd54209e0c187269f8649abaf9911deaac38e353a1802eb6fb6ffb0852a9eafa92c6f46c5deae535a1fce09a7911f392f753dfec14cadaa75a3cb3f8813bd4f66c3f6bc7b63594f01660514e0899a2280675d87d9159ef5c075e6d6958216a9d72740bdd9f2044767452181355c65aeb62967aa14bb33041673fa37f3c54bfaf5436e3877306acc561b860aaefea0a414b749dfabae070458dee7957da6efda14a8f6d9a0bfe06658c7254e1553acea2cc30f6b50bed5add9e9a166ee8d6c66b8268a09732b6b533f00ede4375d52da9c07403dc9e7887360ec111acee83815b92e535cc8d471e3dd71112b5e8d57e88d675530a609f51ea84a50dbd307c2dbfa172bbdb8ac318c1d27392b3ffd579f44577b43964830822e2167323fabb691c9e1d3623e7745948088f7073f86fe5d8f3eaa0d320a31c446ba7109c535c17c4dfe4f7be7ffafb0fb8f5a91df4efa0664ebefe4bc78a37dc8fe7507b43122d766c4806c2033d6c4e9fef3eed36b1c3072817c2d1634fe12cabae28cc25656bbf02e644220ef400700908060fa04663ae87543296f51246d714294eeaad73496ff6fe4ab3323e77e83aa213ebfd9555c5f0a1a5ca1643698230e60b7984a75f0f1cc23499f07947f6c012883dc720161aca76759b2e36b10ec97a168005a5efdc8cd9c4a01cb30b586a776b06f5e8e9ae516f2afc3bc917f85bc02b019ca7040ad5916273b2bee3d925deb725b89aca1892e26d04efd995245b34fa73d5cbbbcbe9ef0fd63182c05fa48fe0c189fac6b952cae842bdb983efc22700d5c33377793fdae1eb31c0d221d6b25afa0c6da345f9d9ed31250eadba62ad808a6584c26dba7f4d0a5449f430312a925a1c50fcc9af5fabb85221f467be9ae7918721ac65de2c7410bc487593299c4891de18f86312e2c258fce99b6abcccf0873b753cdfdde32be8cc9a025d47756747844f9b4fe5cf6bec1d119a7f36a80b6c0d5822c839fc7f44ea6ac9dde458f9513fef92c1959773705d30baaf366391c49276cf7a51be0df8a1db0c22b72a25066a1fe72b512ac48f808cf89936d3df3565f38a243dbf0926fa422e947ab0a1704c5b59d03bcc466e611d9c72634c3d900c8ef64c813389afcba50d85332988604903657c4fedcb9e4ec8c8df10c62cdf450b4659ae88976589dbf76af0e4dcf9ab41bc4dfe92d5527a83ab66d6e47f9b662a2d54b8b5b578043dc0703e0551705fef7907d57eb8b19d6c6cd646a45e9d05756d8ae6d573832cab79fce72f1eeff17d0a90507f0fa4c3d89ce14a3a289bfdf5ddd8480a914243e7f9545065daf576dbeb7b8edc2ef3730476923497e0ba69a1b60797ec817f2989602a5e7595421dd06f5ae00cdde284db97758c0d152eb69bae95b7d9c982645db0b3b73c73320b061546ce8445030ae8a2204c0604c279a38fee29abee06bdf875334b5abfccdacbb98ac5d3891f7a53c46f7a762a3617ab6a76a2606646e7b9045c94fb7a04b02299b0c2f6cea7d67ca3d6ff59a99e1628dff246049de8515a1123467bcd22b82eb997c8d984d32e91d4532b1bf67990af4c91ef610698015e6cc1358e1a38263042b03715caa54199622bb52879374c1bab62f6e554ea445dbc11563775d887dc3ec055cf28214cb09b3c23e7f4d21378e64a7b425a3165a5fa73a395342509913bd7b2354bb640f1a25bf1d0e0307a3949a5eadbe6833d6734a7ccc6e1fd0b567b65574394e3911de11ec546071c73ca363d77542d8a3b0a6eb101c49ef337befeb1887a32b67c0fb87d70b7c3aeb737e5f339fa7d01ad1d35e995b35d991214f365bd8587fb284877bbeb56c6cd250d83f3774518638a4431a8b873d76a15ba7cf01e15e0b38792583ac026b01c7b7f9cfb7ed0ef6072e2af6af1145013ae0d44312d1a941e7559e3580715b133264252e756c2007f155d364f03dc8c32c4ea7f885e25df67a5adc0d00d731e16b72c7cc3e3b0b5964a5f2e95454d98b23ab187eb50c273a3a30d2ccce78316cae3de35dd48fd24a20d341b8c20f0e1a023dfc6e4dd4094d4c5010cc15823309a4f26e5e49d67bd4ff41171d0514351402ff3412f24938d73efaa4d8b5c1b53f77278e1524adac6c19f0b1ac84dd42608997e5a96ac8708e162c7fba8fb2a608ce9159746cc19cc86ae655418e35bad3a8a92b374df58ede00613bf7a81766db73ad81c8b424ef4a1748872d62170a8d49d845863f05537ad4f11c9bda5cd928e05b45024d9d7a8551148561f773368cb1290c66b7fb3d3fa492502eb6105e6c9b73deb6ddd0b114216ea8d3ea2c6e28bfedfcd18badfe17ad2e9ccb0c53e02a3ee2f5111f8c47cb710b9fa65cb8777ce4950dd4fbaa2689c12ee261dfefedbaedb1aa3ddffeeaad4fdc4306348a4b5def99d75feb6ddd05343d18746a8176a724f7061a645e3e8a62321d2424f725b66da81d71cfa581cfee9663d3708da7aad5bcb564804798dd1d1abcb93b2d1f3ebc3a1394721630c13722a473eb042b649718fb8d5d906c87e875d4baf4e2f5f6a1e14fd498c17d01d7840c145f9c39c1773d438ae40c5ec1b474acb7c316373791db64d73cee72295cf65a7381c389d1caed3b1dfc81def62a7bdd2cb8234b0da4d0475d89f0c9e1454c9b5d6c73ae21ff30893f055ecc581178f0ea89ebe9f08deba9398f35506498a9ea678856984078972d3446dd3437bcf048285349c98185e5b2f6f37e977f45978f4ca8c8ba3f34dd64c5c10aa12db8eb25927324f0289bc2f4bc0f8840d102ee12c3778f9d7dc114c84ccc0b75cf5b07a109b13344a3f6ccef8cfcc154b8e43f401efb56d8912835745caddbfee575e080b7274a18ca55ee3b6a70a882d30eefe68a316c99cd7c9f98e8244561509579db6683f91e2da19386496267ddb8d8f942ea3c28ec9ae90f3f98ab13967d42eea2122995b13bc1ab5036d41de39dbc584c62787955ae5e20f18884e95b8b1a0ea3df50c4231268af97a6e56d10f423aa366ddf5f2c199ffd44b31e26b833c89b8e2992274757ca2a67d635933cccb94c6f9801f0c75d9d0fb35e5d7f8067ad1fd64d7e92e4e219be1e6c3999570929d88c23842c72aadccbe7ff946d03e893caf986bfde546c6840441bc0ff4945bf0819dca2d2908c9b7979d18dc19d6240aac1fdefe5b75d6abde653faca2322fdf8d3ae5d925d8385ecde0f19448dc6c484e59cd773d3bc2636097007d365c01458425fa71405057cff2b1a695a55d1af51f51a147cca886653ff8355024a958daeee45e8faa14324a8adeba7a0f240ebf51d66e162de5a4207810f3e2de38414a5c1129fd03f86f8760fd07d6cfa00b77812888f97b812e972b5639eb5ab93adbe828ee37b28bb2a643df43651f4f969f7642b50d456cdfaeed2dc749c2790b8d4b0edc6cce9be940eb54be29355f141660333af3927583901e7f04dd0a8dc5e079257100763aecf54dc1bee178f828406054447d03a167a242871f05d4f49352f2766f96e00549cf18049798c575bbeb0f2a3c88cc21e7744b30807dd25350b2a124a54882630f598f22c302f01df12462026f72713e36838e3d18db0c3d25e53d18e6591b2079a8bfbcb7aa8011dab39eab683973ca0c870bc3ba3a92c58c0c1156daab2fa8b9d2e9fcb8ecad1a69d2fb7a0782d9d980f1435aaadfc59d6802b1418bcbaf4078fb7632eeb3d125865945de95db79b947433e18079003f09f09d0244f5286534b2815ad9a8ff05400d8825058802a8c94eb1ad9f5c140accf2abe2a1533d6f3fdd3a877eef0a196a7f5ae6d9837707aa6ae5448969c630124a8dc87cad05e886792a8a6cdaa85bc2eb01e6e31b341acc5e66fbc288fe0bb32cbb74e4a473eada14bed74797a99117e4c458ba8d41c5cb7f03c8b5ddb65911a72d49f4938fea602e2ba311888745d255e17890dc396a3fef13052bc587382ab89e69a55369d1f0ae4f38773f9199579c58d9916db9fe1a48dea6bbcbc4eec025c4158d891423d71a414249fc400b6c0382be0553620f654983829a96b1", 0x1000}, {&(0x7f0000002580)="70dd1532d6b02384ee244eee3ac21d5b65c8eb8b90771a3d98286a0250fd26b1a7f404fd62bd1794a04e4adacfd1ef5be5b817c1bfb1cc87b104afdbf39593eefbce0dff2a45cd72fc9c543f4e54f6c20f12c3033297b2475f4ac5abd28f2d0f416d85aac2feff207ab5c2f664c7e78a5c1557146618d1f82e8e2921853b09816d90ca5e44ef45309c5b31147cf775aa90e6c4b9fa41e5c8e79b4ce3bf3949ec95b21f8676ff5ad9344faa4833a79a77ab61f82ebbe82362151cf0e13064a3d9e839889840e83a94cb2ef343550abd31bde3b0758d7f4b15d7c028d58fdacf86c4bed3ff6d0d9a0cc8282048221fac701868de194c329b1ccd4a49262176169715cc128e799204fd3bafb3c99891ff15be96d43c46ba185b67bfb1feb20c21702cf42d7d3d9712a63964a213036da85f9b5e779c3a02868850dbf2f3072792b1705363c9bb4a4efb277d937aad9a32c2a69c463a9cc255e1a7a749509825d421d627cf7ef73a2669ab8e3502bd2bf4c26d2aca3d4656723301fa2fc2366db7858da10a7f799aca525208372926c64891a77219cc070d3ef7dd3bb8461e48ea218d323a01283a1e1f50668b57fd29b9a4d26f35978e20693f1ebeb8707945f2273f280efe1641624eed81f6983df34fa4c0cc55bdb30c46a18f8eb7f24f083678a5a288245f68940aec1e58d167a7bf93df7f4b14c5388d9ed47d06d7a134c7daba0dfb6e03ac61c6bfded2d16cf3ccf70fa5a94bf8b982180267743b02c24a9e7f64ea3e0d37696793dfff42980aa97949bd61e67b58e0f14df42f6701c4936c7529e78cc0121cc7cb9ad733ff742a156f76a6c5d92093d17dc21344677c38a3a0bbcf1deac0474306f5968413b5813aeac2b35ff61277bf91159085ffe4dc9cb672282dfb5eeb13814cd5ff9425c89d3ea462c93145227c5702e42bbeb9b5445fb4724311d4803b93327a069b150af93450366c98da817e6915115ee72b38fa12581af7958e41e3f5e0b41d3861cf4e3d963c7416e73990dd16a37cd44674bd348b2a99acf83de3fdc1a233eac5b2c75f6a5c826544317ba53901170bb0935445fe06c2132012c1ed7ec6397f3cab723bb23bb656270f76e2afc003360fcdb531983ee933324d4e47f5aac945c0f4088230d977be594c4028bcb58e1d67906e371cbdcff41664a9196e3d5287ad35acd4534233bf5b2fea1215c1f9a9150b3fe182042058de1ecf80318babd66792f73a75f815d7031baf02b7f448913425ae2e173ff1f708b8b123342994f3a74378fb2e0e622f81e73bee743fdc2627d639f0a16d1d137f404af9ea7d91c5f07c5be0a6ef0f0567b627e2dd83132c7036e12003cf2da7bf442c0c9f18cf89dceda624dc96604e08c143dd25a3ea8aefe65cf04716b60fe13a8b99143fca421cd81b2f4d5732a7ebf01b1eb507c17bd4e640f9996c85bc846481e13091ff40c45566c47a9694e27d5f317fa6ef3f7e7164ea9b4ab152f7b975fcf8d948fdf686b38e818655f1f67ad3dcdcfee8fad17b399aaa0a5439e05263395e808e1c36dcfa70ee8331820881b439271f45df864f87efb9d0c146e02022eec9e5e72ded760d1be58bcefdd9daf62036f56c8e6e2005125b24b3064d406baf8e02fa8c533aae6f6b90febb4ad7f906a5539c2a588714b9a1e2bace754c49b2d6c6a73e50513c46b09766473ea750be0c0d2fe40efe941c17afc3dacf4caabc1d786296c9adaa20a3d462c5401e7ed6429d2517b46679a4184c0a92bf391b438fb3243710538c2501521147fc325d918e7d3ffd83f76138d0a29169072726834d99bca2d686cd1a902f0605603e02ce96f38e792a79bf67bfde722b232461551134c327a04ec0a181d7bec73a314952139b551c436b43e819ac1f02ea335ed19d7e31d2bf84439804078db97e11ce0873609799cdc931406ff44545a21b43a2b8ed59c41b31c2c2a1f587186def96059e89e81d3cba2b3eb42475023027283e16e1bfb24f62288742359c715f9981936b449118f4e4a9e68c2960f3d2ae811374e3a523d78d33e90de416792aa4375bc797c051545c911ec9b5b8bf255c77d0ef98b9054ca1f6ce9110c59bddeafbad7411c1f3cbef5cd938e3c55acef9cfa20b6b3118bff8df74d226af3a13a6750ab7cf8f4a5ee78c7dc76e7025c63c7c577c0b0f05ee005342debfb197d0bd4e0861d0ade8120d67ee1e605dadc4a46a0e6daec31855181fe444553fc133e4673f7ab51f4e1787abb0e9988dcea874bde367526598391c86733671dec6edda4f7c86a440ada7a6c43c31718c493de292b039055fd85e222ff5bb058928c2024cc349a82dd735801c5d0d53477fd1e3ec8fdee787dea3f049adc509166c7d0403053cfedc902e88fdd392976e7cc4c2d2e014f961c7f4ef549769bdab687487e8a833b9c22c725f7cecbacf2bf7994c930040aec4adc7617876a998b292991c7daec65c27272551b352f2451612db489a8aaf6f9e142e795ec76a369f0f31c7ff75f5a795899fd4b180578cf524865c584bd15e0de09c9b2e3c152eb6afcd17fb8964abf01d03821d6bf2a29a80e37a7a6b81c3677696bd2e0ac381269ecc427badac92c6777ecebc37314ee7fefb4f28f7f29fed30a1a4adac02fae0890006064b60a650e98f9a545715c7dae5ed145e9c164247163474c1556c3776ec8840b129a3c87e8a511e8aeed42d31ac4d23585df70dd0ce25f5219e34cb1a81b01b35ff2a3403cb4ae7d96259e40c009fdbd5a0846ed19b15712001da1f51ec8d92cb4641ac932e902530c48caf024e83b829a0958c7dde5e34221ee241e899e63051318a29cc0168f3a02c9b1f9ae2b9c25a938f850e768a4ed9f5878eb675ac5ddc05cf418793f8d760ebf0ca2971beb3db73599bcb6d16d2bebf656e061fc9beb820e291b0623d2db9f8f1ceeddb0b44e8eb221db03cbefa51af7bb73d776bdf28ef7d42b63265f29766ee88dbf4979ce48618ddab866f5e438e5ee088fba57059e0c682e94c172e22741b721fa7c67d5d835770ac3eeae3dd3217c75eaba33c1dc06dc32b5a249b63dfb6cae43a91f34f1fd867e0d3a27002ce4414ee6491b462d213175be755d0a50b36c29ac3f66dff9c5290cd3de7d15b0fd437abfadbef585b45c41b7842daae517267698fcf2042054ba084f251c01bebc915d8c550cf7b7348c363b35e7a912f7129c1ba7cd3bf3019110870f2b1a06535b18b18e6bdc796926c163dfe87216b8df50a7a387e3df0ff30087c824d6fcaa99c339ef8a75b0e2d1cc73ecc92bf788e9065a06b5cbef9cea73f77c4b5a36390a46086f889f2ae484945d68e724c43f491ca18c0056ad75f1c57e5acc4ba029d8d980dbb9712da2eae664a5a21de9b1b53050f58fdbc2a3fd36286e7466a37a2d121ecbec207c12e488eb0c1074ecfd4b14742261da89e84d539c21752a62660dc68b07c0da0fbb19fdf5fa25ea8331d2c13eab4b9ab54720047fc8b027ca705174c9bc9fcb96043a2795dd73b2870d7ae1c990e3a8b6e9e8ddb4fed03301b89e853f1cf8049e6cdc92bd510dcaff019fac225e9a82d7380189189a88019c6fb8caa71d6b2d3e9651cdd5257cb14fa4a42b22bf3bb5e4b0464072bae1e89fc8adee2980d04c57e9c925f99a2b211fc79aceab7562247f19aaafa2573efb1a1ba77294cd0bd8e48229ba9a76b64e13e822a861a49521d823357bfd0246867d3d1ab0776769c0a3919e7af4fbc0dafabccc6fe57c0960b6b75f91c7d1d19e043092173cecd101e9fbcef35a0b3a03e5c058fad2d31a7ae29dfdf854daa12b6c9871128b2224e0d25e13b089eb5afb994af3bd0004c6193b8d85d254ebde6ed0613a527b85a0d9971d75c4c5f2aad77981a25be1218267f11d0f0e16340b46e3f37365ac0d52bfaf931c9e7ffeb50e2e6e56e23e5e41e9f224ead9dcd4512aaf305085f53da4b7b408adb00e75a4e8b5088954fa0dfd54e25793259c423b2dbe831f53c8e1a4b17a31020dc49065d70fc63f46db1b85009101f2084b05abe9eda1252713b87d29590b4fe5e59a0051e22cb7b31a51f90eea75a2a0b9b590cca17f00d436dd710e9afee4a94be5846d3f4c9dc2540f5b38c0a6a2163319d2cd758480065f7ff1ba538873c37e910dd926fd36ec1de2a8b0aed46fc66fa555604ce006616a5b72355f67225b514bff656ab5a522ae8b88d266c413820b4636fb1562248498c985e3bc1673fa880709c81085a19b47fb61638d84539e233a595e519693c127dd51fe8ae595ea0a36a8e8443f07f7980dd7dca7fce6b8cff52917643c34e1e9ff2841951c12d0d402ced45c71f18f2130d85a0ed41d1d88bead7f69167d430199d993592c7f38f31004b23b3974e8e4ac8a6bab531eb70ca4d3778f9e5b6e53c310236d7d94af5958c09aeb7d5d4775ae3b54615a9468706d9b9cb1aae75ed0757f27a53c4387c62666e061459a2393629355cee13f67643dde1425ed3ab743344ba32289cc9bb05e4ae28510532b8bc19460c3fe38162aad8c17f4ce6fdba929cb9d42c88f0a3d25e379586f987805ff7d4a5894d32f5da7c27ca285662c8a185c3c63f53f088ddc1121b7e1d20a00923a3cab0bb83bdc59950df8a2acde88290d4b6f5c87bd995d4e4f2eba9166a43248349c88ddfab4ab621580b5519329bcfeba3abbad60a41ae0c26257f944e6b00863df2aee67cca2619f4596d47d14c21a7f777498d310239616f10b625e7493f1daa0582a856cfe66f8b5be9f20e6476c3a0eb7f18eb5b1a2f1e5d68089cc95ad124858577183ba737fdb3bf352851a65ef6d0f0a92de154640954affe16cddca617f4851efda0154157380a9530538240d96d0ef0407ca04ddea552405d2d834ecb5149217a15c382893aa3776d3f8eaed7c13d41da02aff6e44ac817a2da228a602f56938bfdde284f86943cf45870e08393d3e2f04e21501b93047ba2be5411cd3161b7222509996b637f82189f25c8dc51edf36ccda32cbfb3f9ecac130e9ac1fdf12f752fecd8b2f351bfbc21677979bbed43f36a410cccb35d7f02ea28f558e5e4da8b6db16063486ec820e7ca3b48a4315767ec66a8214e7322c6876359803db12bc1d6981e7ad84dc9a2bd6928cb0464224bc15e6bb27cdb6273ece240426e570b183eed9173e1ab86a88f4e7422e5b292b84428edff1cccb14935d7474c37a2c83517b94af57129e017b3661239dfe7144ffdeb39f4ef8699e0f9fa3cf50a587fba8db31847c45c387c8f2fba26a59b3eb6061e723a5e0f1bd151f4d4c48007c548b4bc7b1192c0b61ffacc9cdd2467d3f6f16ce43da828ce731e8dcdce978a4925cd2f63aeef3f79afe779863a69fa1cbd07d332ea7096373f31e53107bfd3509e448f2278a6b0b37e48cce3c749ed9501d467825fac7ad21eb3f50c03c7ede31e6f910b342215262087adef34acd56db74d7fcdde80690ed1438a94ec0328ef1d003d46324c1b5ba4575b194f48b88bc096ba8a0a23efb80dc640b2f059e30f6d02e3b67707950dfe42d886ecfd45614dc74a14b7f275faf2a8158b66d1cc2e5cde5d1d466c639dfe6addcfbf95c4d3cb6e78285bac96112a57d01017bb873ee4366d7695dee195fd56bc9a28752344dad5bcd276afccf901d760543fab1cb37a5d3e1b26f994376c78b0eaa5b42934a79c18c6cfc090d683fba1e490634264730c33c31c473e5921f55e663add88cac6c51a0e09012f9da6323644d7838a7431818a5d6d8de70477cde0bcf24501ae524e3b736d41", 0x1000}], 0xa, 0xa) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0xfc, 0x0) write$cgroup_subtree(r1, &(0x7f0000003640)={[{0x2f, 'io'}, {0x2d, 'rdma'}, {0x2f, 'memory'}, {0x2b, 'pids'}]}, 0x18) ioctl$INOTIFY_IOC_SETNEXTWD(r1, 0x40044900, 0xb4ee) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0063552b0c659fa8fa1aefa54643fb02fc40400000000000000000000000000000979b634000000000000000000000000000000000070000000000000000000000000000cd6ba374c3fa306830d071d01a578be2172df9141a014d0b314f27f60ec4be2a49d6855f6228bfa4839e35d532b29118f9459b3a672377250398651dc3cd30dda6cab0804e30849074be0a302d850876f4733403b0e5"], 0x0, 0x0, 0x0}) write$P9_RMKNOD(r1, &(0x7f0000000040)={0x14, 0x13, 0x1, {0x2, 0x3, 0x1}}, 0x14) [ 514.672244] binder: 25607:25614 unknown command 407921408 [ 514.681974] binder: 25610:25617 ioctl c0306201 20000440 returned -22 [ 514.694388] binder: 25606:25613 unknown command 536870912 [ 514.705106] binder: 25606:25613 ioctl c0306201 20000440 returned -22 [ 514.710836] binder: 25620:25623 ioctl c018620b 0 returned -14 [ 514.721432] binder: 25607:25614 ioctl c0306201 20000440 returned -22 03:37:11 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x802) r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/policy\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000180)={0x0, 0x0}) utimensat(r1, &(0x7f0000000100)='./file0\x00', &(0x7f00000001c0)={{0x0, 0x7530}, {r2, r3/1000+30000}}, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuset.memory_pressure\x00', 0x0, 0x0) ioctl$LOOP_CHANGE_FD(r4, 0x4c06, r0) pipe(&(0x7f0000000140)={0xffffffffffffffff}) setsockopt$SO_TIMESTAMPING(r5, 0x1, 0x25, &(0x7f0000000080)=0x100, 0x4) 03:37:11 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="7fc0f244141735d5c98fda697eae6246a5232e8e613c2d3411e9e4159279b97ebdf697f62cdbb430dbb90df36bd550d3ad67adde42afe4f49c27b4a1ccb220b57950db756b1b2328cbf6cf15d65ada6b0115bf02ada7a5b6ed6fe45b0360e6d6b2b83995841dcfd854d6a791d3a54dab460ce031e77baa0f4451fb34ffe188f180a8272b41cd26b1228f0eeacb1e15044f4193ecaaa917039f6270d6d9427d62763a94", @ANYPTR], 0x0, 0x0, 0x0}) tee(r0, r0, 0x9, 0x8) [ 514.731104] binder: 25620:25623 got transaction with invalid offset (0, min 0 max 0) or object. [ 514.749960] binder: 25620:25623 transaction failed 29201/-22, size 0-8 line 3230 [ 514.764201] binder: 25624:25626 unknown command 727016192 [ 514.774021] binder: 25624:25626 ioctl c0306201 20000440 returned -22 [ 514.789636] binder: 25620:25630 BC_ACQUIRE_DONE u0000000000000000 no match [ 514.797891] binder: 25624:25626 unknown command 727016192 [ 514.805118] binder: 25631:25633 unknown command 1156759679 [ 514.812397] binder: 25624:25626 ioctl c0306201 20000440 returned -22 [ 514.820358] binder: 25631:25633 ioctl c0306201 20000440 returned -22 [ 514.826652] binder: 25627:25634 unknown command 536872064 [ 514.829211] binder: undelivered TRANSACTION_ERROR: 29201 [ 514.842389] binder: 25627:25634 ioctl c0306201 20000440 returned -22 [ 514.855613] binder: 25627:25636 unknown command 536872064 [ 514.855992] binder: 25631:25633 unknown command 1156759679 [ 514.872333] binder: 25627:25636 ioctl c0306201 20000440 returned -22 [ 514.873357] binder: 25631:25633 ioctl c0306201 20000440 returned -22 03:37:11 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR], 0x0, 0x0, &(0x7f00000003c0)}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040), 0x4) sched_rr_get_interval(0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') 03:37:11 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 03:37:11 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) openat$selinux_status(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/status\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x80) write$selinux_create(r1, &(0x7f0000000040)=@objname={'system_u:object_r:crond_exec_t:s0', 0x20, '/sbin/dhclient', 0x20, 0x7, 0x20, './file0\x00'}, 0x4e) [ 515.070765] binder: 25595:25597 ioctl c0306201 20000140 returned -14 [ 515.102583] binder: 25641:25645 ioctl c018620b 0 returned -14 [ 515.109318] binder: 25642:25646 ioctl c018620b 0 returned -14 [ 515.113101] binder: 25641:25645 ioctl c0306201 0 returned -14 [ 515.121437] binder: 25642:25646 got transaction with invalid offset (0, min 0 max 0) or object. [ 515.127588] binder: 25641:25645 ioctl c018620b 0 returned -14 [ 515.131901] binder: 25644:25647 ioctl c018620b 0 returned -14 [ 515.138416] binder: 25641:25645 ioctl c0306201 0 returned -14 [ 515.145100] binder: 25642:25646 transaction failed 29201/-22, size 0-8 line 3230 [ 515.153159] binder: release 25641:25645 transaction 1295 out, still active [ 515.166797] binder: undelivered TRANSACTION_COMPLETE [ 515.177984] binder: release 25641:25648 transaction 1296 out, still active [ 515.190575] binder: undelivered TRANSACTION_COMPLETE [ 515.196361] binder: undelivered TRANSACTION_ERROR: 29201 [ 515.207442] binder: 25644:25652 unknown command 0 [ 515.213326] binder: 25644:25652 ioctl c0306201 20000440 returned -22 03:37:12 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='+'}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 03:37:12 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x7f, 0x0, &(0x7f00000000c0)=ANY=[@ANYRES32=r0, @ANYBLOB="28b06432496f9730b84af629a0e5219061c24f40caa2d006d43d056e640f1cb78a0a9762f9643dc9fce6651804e383a13c375311f7146961a88582c8266327aa99310c72224b11b7"], 0x0, 0x0, 0x0}) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0xff) 03:37:12 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0xa8, 0x0, &(0x7f00000000c0)=[@increfs_done={0x40106308, r1, 0x4}, @enter_looper, @reply_sg={0x40486312, {{0x4, 0x0, 0x4, 0x0, 0x1, 0x0, 0x0, 0x40, 0x20, &(0x7f0000000040)=[@fda={0x66646185, 0x1, 0x3, 0x6}, @fda={0x66646185, 0x8, 0x1, 0x1e}], &(0x7f0000000080)=[0x0, 0x40, 0x28, 0x28]}, 0x7}}, @increfs={0x40046304, 0x4}, @clear_death={0x400c630f, 0x1, 0x2}, @request_death={0x400c630e, 0x4, 0x1}, @clear_death={0x400c630f, 0x0, 0x4}, @dead_binder_done={0x40086310, 0x2}], 0xe7, 0x0, &(0x7f0000000180)="5baa5d18c2f7ead3e58c5995ebd0e608fd63d062c6940222dc11b3bfd9bb2be536b019264971e6423a4b5fda79e6f957b9b724961087d2f3aaed7f499347f784d197617184857904db0499e020e6f2bcd89575ee45df0a325c5eb9e28a5158ceed1e949eceda51b62554a476daada346c150cebfdf28cae0cb4e0361e00afc0ffe366c7b39d7b0fdc1bf3627687f053247a9c1031716f696cb4d1725818f78428feb45e0d96177c4a0260f045a79ae4d2f12bab0b806864c5371eb12c4febe2ceb95a1bd3928b753c18191ad78513cb13ce625de79471cc216f5cdcb1a2d4cbd9ac634b95683aa"}) 03:37:12 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 03:37:12 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) r1 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x40000, 0x0) ioctl$RTC_PLL_SET(r1, 0x40207012, &(0x7f0000000040)={0x0, 0xa2, 0x7, 0x0, 0x9, 0x2, 0x40}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 515.410180] binder: 25656:25660 unknown command 536872064 [ 515.413649] binder: 25654:25659 unknown command 3 [ 515.423952] binder: 25654:25659 ioctl c0306201 20000080 returned -22 [ 515.423991] binder: 25657:25662 ioctl c018620b 0 returned -14 [ 515.433662] binder: 25654:25659 ioctl 40046205 ff returned -22 [ 515.440374] binder: 25656:25660 ioctl c0306201 20000440 returned -22 [ 515.447331] binder: 25654:25659 unknown command 4 [ 515.452824] binder: 25661:25665 ioctl c018620b 0 returned -14 [ 515.459094] binder: 25654:25664 ioctl 40046205 ff returned -22 [ 515.463040] binder: 25655:25663 ioctl c018620b 0 returned -14 [ 515.469947] binder: 25654:25659 ioctl c0306201 20000080 returned -22 [ 515.475748] binder: 25656:25666 BC_INCREFS_DONE u0000000000000000 no match [ 515.490658] binder: 25657:25662 ioctl c018620b 0 returned -14 [ 515.491704] binder: 25656:25666 got reply transaction with no transaction stack 03:37:12 executing program 5: r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x404000, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000040)={{{@in=@empty, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in=@initdev}}, &(0x7f0000000140)=0xe8) setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000180)={r1, @dev={0xac, 0x14, 0x14, 0xd}, @local}, 0xc) r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@', @ANYPTR], 0x0, 0x0, 0x0}) 03:37:12 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) [ 515.504923] binder: release 25657:25662 transaction 1297 out, still active [ 515.504933] binder: undelivered TRANSACTION_COMPLETE [ 515.512475] binder: 25655:25663 got transaction with invalid offset (0, min 0 max 24) or object. [ 515.534402] binder: 25655:25663 transaction failed 29201/-22, size 24-8 line 3230 [ 515.543803] binder: 25656:25666 transaction failed 29201/-71, size 64-32 line 2926 [ 515.557796] binder: 25655:25671 BC_ACQUIRE_DONE u0000000000000000 no match [ 515.558149] binder: 25661:25670 BC_ACQUIRE_DONE u0000000000000000 no match [ 515.581450] binder: 25656:25660 unknown command 536872064 [ 515.584563] binder: 25672:25676 ioctl c018620b 0 returned -14 [ 515.588368] binder: 25655:25671 unknown command 0 [ 515.599831] binder: 25656:25660 ioctl c0306201 20000440 returned -22 03:37:12 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) write$P9_RSTATFS(r1, &(0x7f0000000040)={0x43, 0x9, 0x2, {0x2, 0x5, 0x8, 0xffff, 0x4, 0x3, 0x100, 0x2, 0x1f}}, 0x43) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:37:12 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) [ 515.601460] binder: 25672:25676 ioctl c018620b 0 returned -14 [ 515.612681] binder: release 25668:25674 transaction 1300 out, still active [ 515.627348] binder: 25655:25671 ioctl c0306201 200003c0 returned -22 [ 515.641562] binder: undelivered TRANSACTION_COMPLETE [ 515.668652] binder: release 25668:25675 transaction 1302 out, still active [ 515.673003] binder: 25678:25683 ioctl c018620b 0 returned -14 [ 515.698742] binder: undelivered TRANSACTION_COMPLETE [ 515.712290] binder: 25678:25683 ioctl c018620b 0 returned -14 [ 515.712326] binder: release 25672:25676 transaction 1301 out, still active [ 515.731288] binder: 25680:25684 unknown command 536872064 [ 515.737883] binder: 25680:25684 ioctl c0306201 20000440 returned -22 [ 515.747482] binder: undelivered TRANSACTION_COMPLETE [ 515.748903] binder: 25680:25684 unknown command 536872064 [ 515.754675] binder: release 25678:25686 transaction 1304 out, still active [ 515.768286] binder: undelivered TRANSACTION_COMPLETE [ 515.770595] binder: 25680:25684 ioctl c0306201 20000440 returned -22 [ 515.773968] binder: release 25678:25683 transaction 1303 out, still active [ 515.790247] binder: undelivered TRANSACTION_COMPLETE 03:37:12 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040), 0x4) sched_rr_get_interval(0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') 03:37:12 executing program 5: getpeername(0xffffffffffffff9c, &(0x7f0000000140)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}}}, &(0x7f00000001c0)=0x80) getsockopt$EBT_SO_GET_INFO(r0, 0x0, 0x80, &(0x7f0000000200)={'broute\x00'}, &(0x7f0000000280)=0x78) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000300)=ANY=[@ANYRES32=r1, @ANYPTR], 0x0, 0x0, 0x0}) mount$bpf(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='bpf\x00', 0x40, &(0x7f0000000080)={[{@mode={'mode', 0x3d, 0x21}}, {@mode={'mode', 0x3d, 0x7fffffff}}, {@mode={'mode', 0x3d, 0xffff}}, {@mode={'mode', 0x3d, 0xffffffff}}, {@mode={'mode', 0x3d, 0x5}}], [{@obj_role={'obj_role', 0x3d, '/dev/binder#\x00'}}, {@func={'func', 0x3d, 'FILE_CHECK'}}]}) 03:37:12 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 515.913400] binder: 25644:25647 ioctl c0306201 20000140 returned -14 [ 515.935380] binder: 25689:25691 unknown command 3 [ 515.941846] binder: 25689:25691 ioctl c0306201 20000440 returned -22 [ 515.956429] binder: 25689:25691 unknown command 4 [ 515.963012] binder: 25689:25691 ioctl c0306201 20000440 returned -22 [ 515.970817] binder: 25694:25696 ioctl c018620b 0 returned -14 [ 515.971391] binder: 25690:25695 ioctl c018620b 0 returned -14 [ 515.985198] binder: 25690:25695 got transaction with invalid offset (0, min 0 max 24) or object. [ 515.995768] binder: 25690:25695 transaction failed 29201/-22, size 24-8 line 3230 [ 516.005146] binder: 25690:25695 BC_ACQUIRE_DONE u0000000000000000 no match [ 516.026024] binder: 25694:25698 unknown command 536871488 [ 516.032355] binder: 25694:25698 ioctl c0306201 20000440 returned -22 03:37:13 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x26d, 0x0, 0x0}) 03:37:13 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) prctl$PR_GET_TIMERSLACK(0x1e) 03:37:13 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00400400", @ANYPTR], 0x0, 0x0, 0x0}) 03:37:13 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 03:37:13 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 516.282989] binder: 25701:25707 ioctl c018620b 0 returned -14 [ 516.287445] binder: 25704:25710 ioctl c018620b 0 returned -14 [ 516.296650] binder: 25703:25706 unknown command 278528 [ 516.300831] binder: 25701:25707 ioctl c0306201 0 returned -14 [ 516.302936] binder: 25702:25709 unknown command 536872064 [ 516.310611] binder: 25701:25707 ioctl c018620b 0 returned -14 [ 516.314363] binder: 25703:25706 ioctl c0306201 20000440 returned -22 [ 516.321221] binder: 25708:25711 ioctl c018620b 0 returned -14 [ 516.328442] binder: 25704:25710 got transaction with invalid offset (0, min 0 max 24) or object. [ 516.334011] binder: 25701:25712 ioctl c0306201 0 returned -14 [ 516.342587] binder: 25702:25709 ioctl c0306201 20000440 returned -22 [ 516.349590] binder: release 25701:25707 transaction 1308 out, still active [ 516.355842] binder: 25704:25710 transaction failed 29201/-22, size 24-8 line 3230 [ 516.372973] binder: 25703:25706 unknown command 278528 03:37:13 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) fsetxattr(r0, &(0x7f0000000000)=@random={'btrfs.', '!\x00'}, &(0x7f0000000040)='!\x00', 0x2, 0x2) [ 516.373805] binder: 25708:25711 ioctl c0306201 0 returned -14 [ 516.379697] binder: 25703:25706 ioctl c0306201 20000440 returned -22 [ 516.382205] binder: 25702:25709 unknown command 536872064 [ 516.392274] binder: undelivered TRANSACTION_COMPLETE [ 516.394611] binder: 25704:25710 BC_ACQUIRE_DONE u0000000000000000 no match [ 516.414189] binder: 25708:25711 BC_ACQUIRE_DONE u0000000000000000 no match [ 516.416955] binder: 25702:25709 ioctl c0306201 20000440 returned -22 03:37:13 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x2) fcntl$getownex(r0, 0x10, &(0x7f0000000140)={0x0, 0x0}) write$cgroup_pid(r1, &(0x7f00000001c0)=r2, 0x12) ioctl$EVIOCGUNIQ(r1, 0x80404508, &(0x7f0000000180)=""/41) getpeername$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, &(0x7f0000000240)=0x1c) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040be156e2afa81ac1752e4ebd3c44db5ff64d776d74e6cd1ff56e6d5caf1ff161da7fabf8ffdbba460b5dc9958524005ebeecfd24013243932e0ab2c06f2464c859cd3a5a4fe95b11ba0eca9af4fa11af03e5190b37453efd7baed64eca14462fbfc9d62b294cd76186753af692315eab9a3b9d0d6bdcd17af528092799f04b74732ed977646793f2cb666fd82612df70ff0304c56a61502a154b884b03c6730349713410c29dcb3af1c1df196bf24a5fe15a62f475b48542a47bbbf0112b641b50b47a8227b42f07dca98c4689f40edf8a29e", @ANYPTR], 0x0, 0x0, 0x0}) 03:37:13 executing program 0: syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) [ 516.426992] binder: release 25701:25707 transaction 1306 out, still active [ 516.446008] binder: undelivered TRANSACTION_COMPLETE [ 516.447789] binder: 25714:25716 ioctl c018620b 0 returned -14 [ 516.462272] binder: 25714:25716 ioctl c018620b 0 returned -14 03:37:13 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 516.510620] binder: release 25714:25717 transaction 1310 out, still active [ 516.518115] binder: undelivered TRANSACTION_COMPLETE [ 516.527655] binder: 25719:25721 got transaction to invalid handle [ 516.550676] binder: release 25714:25716 transaction 1309 out, still active [ 516.558970] binder: undelivered TRANSACTION_COMPLETE [ 516.566083] binder: 25719:25721 transaction failed 29201/-22, size 6963897621534472871--1511731377494958923 line 3018 [ 516.581806] binder: 25719:25730 got transaction to invalid handle [ 516.582385] binder: 25726:25728 ioctl c018620b 0 returned -14 [ 516.589324] binder: 25719:25730 transaction failed 29201/-22, size 6963897621534472871--1511731377494958923 line 3018 [ 516.598877] binder: 25726:25728 BC_ACQUIRE_DONE u0000000000000000 no match [ 516.609086] binder: undelivered TRANSACTION_ERROR: 29201 [ 516.630209] binder: release 25726:25728 transaction 1313 out, still active [ 516.642084] binder: undelivered TRANSACTION_COMPLETE [ 516.651928] binder: undelivered TRANSACTION_ERROR: 29201 03:37:13 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040), 0x4) sched_rr_get_interval(0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') 03:37:13 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 03:37:13 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634026000000000000000000000000000000002b8300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) 03:37:13 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 03:37:13 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000017c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@', @ANYPTR], 0x0, 0x0, 0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={0x0}) r2 = openat$selinux_status(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/status\x00', 0x0, 0x0) faccessat(r2, &(0x7f0000000400)='./file0\x00', 0x33, 0x1500) prctl$PR_SET_TIMERSLACK(0x1d, 0x2ea) setsockopt$inet_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000001480)={@in={{0x2, 0x4e23, @multicast2}}, 0x0, 0x6, 0x0, "01cbc85691b1cdbe090075367f52234b09293bcde1c2503c992588a5d8f0e43199319c5a82fb1d3cb5c33675630570ae49f0f01416452a37906283312ae2b234700d3e42b526617fcbe57748bad0f92e"}, 0xd8) fcntl$setlease(r0, 0x400, 0x0) truncate(&(0x7f0000000240)='./file0\x00', 0x23f) ioctl$BLKFRASET(r2, 0x1264, &(0x7f0000000200)=0x6b94df0b) epoll_create(0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001700)={0x5c, 0x0, &(0x7f0000001580)=[@transaction={0x40406300, {0x2, 0x0, 0x3, 0x0, 0x10, 0x0, 0x0, 0x70, 0x30, &(0x7f0000000340)=[@ptr={0x70742a85, 0x1, &(0x7f0000000280), 0x1, 0x0, 0x1f}, @ptr={0x70742a85, 0x1, &(0x7f00000002c0), 0x1, 0x4, 0x1b}, @fda={0x66646185, 0x4, 0x2, 0x1d}], &(0x7f00000003c0)=[0x38, 0x40, 0x38, 0x78, 0x28, 0x48]}}, @dead_binder_done={0x40086310, 0x4}, @dead_binder_done={0x40086310, 0x3}], 0xd1, 0x0, &(0x7f0000001600)="7758427b8acb8057c06635cbc645f3a066bef926f1c7d134e79060c6f1a47af899e10c36591c9ab059ff84e78e4ec1f29f35a0311d2b8c9fc8c9801b4d72819646028e4d51da382655f4d1571351a75299ddc71e40c6c4f4bd27ec130c71a0e1078fbb7bbf4fb0f2c9aa1f8a6914fa45e2679fda8d25d10d37676d81a3695cf2989e8237d2a63c6401e795654266dcbbb8d728831bb4853bdd878d64eb511ce7b6656b6f03bc93027ad2fb9fb3250c7801a9ede1f6054762383617279384c0ce9a1a26cb23205afb587bcc547ea2981ae2"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x64, 0x0, &(0x7f0000000100)=[@decrefs, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x18, 0x48, &(0x7f0000000040)=[@flat={0x77682a85, 0x1, r1}], &(0x7f0000000080)=[0x78, 0x715e3e60c75ec3ec, 0x38, 0x30, 0x78, 0x30, 0x28, 0x68, 0x18]}}, @decrefs={0x40046307, 0x3}, @clear_death={0x400c630f, 0x0, 0x1}], 0x1000, 0x0, &(0x7f0000000480)="4b46b60c8b247e66c32f970189e63315b3d58a56236fae221a672b24a245a3a6fafc670e8fddac975db08622b5f55eba2287f171223270ada3fe10bcd70f35d4b13921cb1842282e034091eb4aa8ee1bf33729f84f9123c99a17c0b9f20a4638f05878f7e2813eebc93331b538339c5405aa7ebc395b854b1ce0438a9200b0d5ef5de76a2df177b6930a405b640744322e4d1979720a0533f2bb32eb6269f6ad8fc735095cf4eb44e6138095687442216740afd8a68a91b80afa7d53bedf92e27c70281e05c8b5d3d2934066fdaf77a2edf2ae497fb2014b2a220ea43318b0628600f13b3945d9070cea9a7a2b07c36853db7388bd2c2c0615ec23b6728571bbece4dc1987c40e3b36d70bc22d06f1a1f6783ec6fcbc71d50dd93238dd3d965033a46c4a7bc86ec3c94aaf866cf66feb62b9fd79c5d192b8de05d20165a5732852e7ef91b10f2b134c3a00973475ac34dc133a1d22665292515c28b0e757fda79fa4739029c0a81d4ea7419522d0b116de1c53074511787cdb9e94d1fdfb5d6dc8eb580965bed49bf988e5ad90732642d6ce282f893b4879cd39340475564ea0dcccdc4cdc4d1d10ef1b246d098701f8e4e3c3cce98ad2398061cddb5b7e931f9e6c753a6f6e7b3ab83fcee8817eba4496cbe0052891613e6816a563bf5c1977066800e0d8db5651ac162d91c517b6798271b5eb66ee2e31e3409d3224f41cc21240932d483423024a36c9571c4f109b97854dd129b6970bca8135ce9021a442344fba9e3795723ff4da515c84532252de73e114c1cf408be72b0e629a6b26357431d26fd6f529b0c3e525d8e0a6f2524d243bc60775fe89dee1b2a08c530af87b9320c642a0cd16c1e85eb1971b6db07c2afa9600d7e3c28579cbe4dac577ab12452be2e4f2a8d52d61c049c65bb580f4ba5c7b3bd66c779a0944bdbdc647d77cf7994172b1694cba5e247fad647141d805c52cdeff17b728b0d5167850c0f1505cdaa54d27769b6db216050ef7d398c91c29ae96f4b9981afbc960e93153a9a27e360ef6a048f448a871096b038f47c41fe273ebde0f480cdf0190fabbc44540b87b11df5232144563d505a766158402c21939b7d9ed2dfdc88a8836af328d0bbfa4539adf896a9e0ae7327d07c39235e3983a5139e19c61037f857435b6a952cfae1a5a9ad64c7581a639695dd47a11e7ba909c02fb3e9de69b985e5262de372a3ec28b15b03560e9a4e0a77ef50071b9591d83b376daeff4213bef2d6ba054e874765f6f9aac0c340038da4ab0da640fbff0b377aa86da006226ef3a840867e34b0d8a67e9b8b29aa1783269fa24ebb615bca8c544baa9e20f0cd6aa0b11e64b96eeec861d655e6945f7e729669e0da46320b6c6a45139018314016c649b8322268f6c6a90b32000a859d410742a78cbadbf493f1a162e7dade65fb9a46b14a16cbec008eefe64314d0b17fbb4a9280385649bb18cb376123f30843a86b4f177fd88a83313a56ccbb10c06f1f3c959ebc5cce5fb1df180436ea68f967fc9fa35c37015a88a8eb38f94449c2aae391b08ba150988ccb98d12b4ca2e861fe7baa41502c5bf054675663db7e86eedf96485fc687822207ab696b734014cc02a502b5890b2f5f36ab54050a68e117f4a1436fd3545a0fa82d81b979aa4017f240b377f95e6dc286e6b00d942cde18dd12ca3aa528289f0c79a643b2dcc3d6175b70b7d575d75db05a30793a627435b883be1e297c6d049a2df294e1fbd5ed479e3398648125f9bd2b2fa4a4a70b7ed5855df9e6265d8e22abd65be65201ce7f022120c2071b28bd47552fc5a4bd0fb7c70dacd4bbed8c016ae3a48c55bd8ec050603a9d38b114df9668d184e2858d250d11b25937d61cb2ea1352c9a3e5a9a95478ffabc6d2def659af14ddaaa1ede43e9dca8af4f24f1976db51f8e006170eff1961a9a683b9d111d62185b31440b22aad3ddccdcb2ec020f00ee74661afcf9b909d89647028dbf859ec9353cc4dff50de865a9c99491546e34c6c5db45bad21ac25157cf1bec6f037f5401f8797c900bc6c71b98e21bc555079937952fc0c4fb6b65356833be51b03e44e3abc23ed22f1128000bd350cafac44282d493e4b070b0574107607d55d7df6128696d393988a3293abfbce576d314213984f5bf543ca0ed28c94e9195c55edef0cf1b41d2a737ceb4e5b56d34b6845fd30556e1e2c807c9bad1db3e1e80f3312fefc276faa969236099306387fbe9a219ba8cf45673f7aa92fe0d14ec2f498f01aab2841360f44e43fb87431de347d8ac944f89f3e4569b69b83d2356c8bbc03789b40a99f376fab64cf4ef13245c939d96b8f8fd99a75c8500f05859cec00cf5655ae355e57ed6be9165f40d03f44558ccbb8ed92bd1597b52532244e4027962f0897ed6dbd5d85adf9cd57a82b84983881860363520c88cdb9d28912c93bf81a682282549f7d3de5888ad75e76772452f6cec8efe87a1dbf5fe3e050a4a6ad19453def8e66ee69ce101e355706e7a062ae992447008380f17e82a5177ac57ef1b11c6ecf7e7f370b2b9152bf9018caa2d3091f9de258f2b2ac0bb103b4a2b871760de1dc3aa9f8f8a1b7d1d48ce12ee8ec33b5a3330b235bf34021582463313d0a7e4493611590f6be038d251eeafb01d92a3a6256d14c0f6875bb870dfa2237d90ccfacdb2a159427854d19011801c0f76ba109c9c4a86c899ee55a13daabbf56909c918bf3ad9e7cb1ef98ffa5a4a4f00ef2ae5df3a43eb81cb8fff50ceef77aaff78b6d380a8a043eb90f903917ac461786f6cf57040967dadf2dc9a137bc7943a0b0a12eda43fc7a037911b07269ca27ce12e228e1be1e6483313b09caf0a0f61f97764316a6f8753ac3ad11045164f26f9bb37c5b6b8ce71e7d4c570727fa67a9d0b3823d0f132ad7f5810e3ec1edcd6c2575d1c5ba3710ac5693ee4376c6c03c00a07259aff7a8ab5d47ecd001bfc104fcd1aeca6f0077055fcaaf77c5cc7fdc4fd5d6b72f2a5abd529a380b80890fc21ea233a225dfd75fe302fdf7ecb5e654addf421f97564bc123dd0b3a77a5f729502966c73348096d4c4c14170de8670637abffde3b72b21e93f43576547e9bf7cc1c35239e7fcb84e431efb05fdd313501f342336cb2e9faed7d7fd633f019ee3cf513d39e6c399b44bba3a1a2fcefa6be667acbc358590d24e6f38aa33bf91d3b26797ee9498216ef79e106c807ff8616004e01f80d6f34c275809696a99e88dcbd0df83be92cc37afb43401ce952501ce9491a5528d48f49f1e49f88ae0ddafbed3c5ff6e1ac3da1318928a6f47021fba2a3c75e451e6f22ddc8314a359fa0247abe21b983d8094003e4f6154f9f4f6bdb4b7cea8d35de1c376b02266ee0c6dcc366c825a1df6228280929bcacf7cf408de94ecdc72286fffbcda0daf5d5743706d204bba3074f85c6957ca07597c353fa226f78eb29ddfa3d7b0cf341ae1a3942df4bd18b940a32f7256270d2c33f58e1ad2be1920ce093cf2cf1998a07a39bd34f419bd27e7108e79fb7af30cfc6c9670ab7fb13a9429c5ccd64a90e9df960831ed745623db3210f92b2e133c89aa93ed407fbab392b06852e95f6d70aadd419a48cba04c65f29cf648811369119f614c7980c6aa22c53b402ef862470492f73ed527220080258fb39a108cc4ebe8c2ac7805c70e5255f51a3e2e2deb29304248451e5b2d84f9a2ca8b8e2305537166781652a2ebeaba66118466b17af2b02e836a709c1aba32a734e92fc9e18c17a6f0065eb5089d4f33666db178a091d3522539375de73891ade4f44779b21d614b95071fc644e549762a6972c618a84a502c4816ffff079a899a540d9731dedf00ff9fe762c38f6a47b02b5fb7094e1e19c83d30bb8f1efe381b709b78fdeb582dde2e697d7a3925e0412076d966a1fe0303e4df00480f59eb063cb5d0004d5a550614a4a0770c1a75675e7317d2b94a6ee626277b7202d6cf6458e63380c0ca1164d013fa40fa3dca995a8782b24de0f19e856043605e6e80755a5ec75cb3ebf9a3fa0aadb3d3cf95c75dced01e989d4f5a9b0c9de87c4af30587bfae254d89352368c6f54f79ac51ac33f5270c921e4246fcd5e56e23996f9a1253fbd67cc144bf28bcfee50e5a51f02c730fa7914beb6bef747979e2b068c5f0dcf97abf4cfe8f9b1e8944d9666e31f898a073b5650d2db0a05d46d9e688c68bbd6cbb0e66fe08faf1e95de1cb1039bdbafba49eaa156d81fa0459e512eada4cf52e34fe56fcadb51aa2e3ff1ebb132920f8cf415cc54e2ae89af272968e370c28cf569be1a029fa73929d27b2309cd670d0b1a4e1874ac42c5ee01b3c8dcc8f6b9f4bc8486540a44047497b3fc89e7ef087adba7dff067e8e3ae25089b6c6144d947e1ee3519c1e369ad88a233b57bfeb47a7f2bc1ce618512d88e5e3c8c0f5710b59c92c8a90d955c03098e59ddc65f42f59038f247def09135b4216a39a2d475f39abf36abbc6c37f08345ed99d92759a006873ff19e64abc7e0a9e0deb01b938fb8f53f86370b683ccced7caa6f41dc722ab029544aef74b0e3d7c30f9bf1c9df3e41bde2480538c47013ff70c2d3d385f6c3ce96878960ca48f88fffa69869c87bc449b1ccc3702a1a91978578cc495bf07517c36e51301db75ac02af5aa2d215318cf1cc6ef02c803ce9c0f8aad24078a0ec0de93ffa729938b04d84a96da1ae90a4e1263126f0ee4a63ecb92b4775ed69e210a2705fcf6648b45b3939f6ee7305e75c2d6ffc08730730cad73cedb4357d21e7367c1e7faa317529780d90ec940148c2318bb8c93aa35b4a26330d43c4a43712b1b855c7c206684af5c39875ef2315f4f491e9490e980cb0fe22b0f9ad199d92ef1c0923dd76b4d434fb5ad24eec6117fa2494fe8f4e9f656bbad1d8d198dfad93700e9eff16c2dd5265a24215ace025fd0aa346c4ba8f2964efe72830112661dafa65c1afe170d9095f2914b520b0fc1225777c1afee1792c6e792d2dd3a7b08a9045b0e55111de6834853f550c05e017546e57db41e3defb47fb15887b3fbaa26dcb360566c4b04cb6178e4fdf9ff507db2957546549ea0a3fa5114059a51263213580d600353e38ae597b73446690c6bd1343cf8404c7845932c52fcfcb3687160aef7a099668d6000b4350161e4ae2a90ebca65d6112ffe8dd4190768992865ee999e4763128d992d3580c0c0978b6f1009f4301cf06c8e64a462f6d231b7282cccc99974fd3c44cb62e17916b39b126b7e1ad01b10b941f4301c50a09482f4b511ce37216605bdcc52ba2fd236f87e8303e37e5b39e424794fb46a4d05e14061dfe88da5e2956ac4e20d4247be2289d796df50eba0e6c7ffa297d2920cae35de2f586b80bcd7ae6a674bd80cb0b204114117fbd1cb8d285fba8ea57a1498e0e9f7c955772dd9e17e5eefaa359633af5f91338455dd1dd89ef76fa8cc8086d9ee7cde7dd65435491db2ccd85f4c1de9a23d729ef788dcafd441982c5c09c75d9beefb97b86b322262c48f7bbc198a477438a2b64ca8f13a94083e43c230789dc1ca8f457aae6bc6d8a8cd13557afc4ad4ed8e44863ea542007c1c2ef1dace916c166e8f75c0840bed4be4c17ca508b6f8a3fd4c962260fb200ebac3978a1b6d0a56113232b2a18240cd8030dcd3ad3e8148bc03fbd3d9368208acfda10d527dcaff3449f2fa962dbbc841f5b98c5effe4f2b96958a5d4c06a5fb3a72b76bff31c157e4a9e2ee0ac7514816df401bef775b7144261e76874cbe780d9c2e"}) 03:37:13 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x1d6, 0x0, &(0x7f0000000040)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00db"]], 0xf4, 0x0, 0x0}) [ 516.770561] binder: 25694:25696 ioctl c0306201 20000140 returned -14 [ 516.815460] binder: 25738:25741 transaction failed 29189/-22, size 0-0 line 3018 [ 516.825315] binder: 25737:25742 ioctl c018620b 0 returned -14 [ 516.827711] binder: 25736:25743 ioctl c018620b 0 returned -14 [ 516.834445] binder: 25737:25742 BC_ACQUIRE_DONE u0000000000000000 no match [ 516.839937] binder: 25740:25746 ioctl c018620b 0 returned -14 [ 516.845921] binder: 25735:25744 ioctl c018620b 0 returned -14 [ 516.854705] binder: 25736:25743 unknown command 641753856 03:37:13 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000e86800000000000000000000000000000000000000000000000000000000008f1f4ecb062ec6338cd96d52d06059874534580abacb87153482807b13a6c5fc811c65ef9717f16182000e4770f5f88b4cd5e3fa1826887e3e965a6683fc4fe0cd02ccdd1d22291c291d9ddcb35506209ab355c092aa9c90a8474b137e92e71c49cdc58943bace0accff5afa25954bb65dc9cfd6db069439de750fb65ac993d73718144c54129f5e3b838d2a2b0705273c9fb96b1abd4fb3153206564859672eb2e67bd5990d96047bd8ef3ece1394df65df9dc2e0829d8ae352ec1e964199f5e795c66fac70cb7b5980d5a2d4576f8f0000000000000000000000"], 0x0, 0x0, 0x0}) [ 516.858876] binder: 25734:25745 unknown command 536872064 [ 516.865329] binder: 25736:25743 ioctl c0306201 20000440 returned -22 [ 516.873810] binder: 25734:25745 ioctl c0306201 20000000 returned -22 [ 516.885902] binder: 25736:25743 ioctl c018620b 0 returned -14 [ 516.897698] binder: 25738:25741 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 516.908091] binder: release 25737:25742 transaction 1315 out, still active 03:37:13 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 03:37:13 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xffffffffffffff28, 0x0, &(0x7f0000000040)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x158, 0x0, 0x0}) [ 516.919116] binder: 25738:25741 got transaction to invalid handle [ 516.927638] binder: 25738:25741 transaction failed 29201/-22, size 24-72 line 3018 [ 516.937202] binder: 25740:25750 unknown command 536871488 [ 516.939182] binder: undelivered TRANSACTION_COMPLETE [ 516.943894] binder: 25735:25751 ioctl c0306201 0 returned -14 [ 516.961363] binder: 25740:25750 ioctl c0306201 20000440 returned -22 [ 516.978090] binder: 25738:25741 transaction failed 29189/-22, size 0-0 line 3018 [ 516.982776] binder: 25735:25758 BC_ACQUIRE_DONE u0000000000000000 no match [ 516.993312] binder: 25738:25747 got transaction to invalid handle [ 516.995269] binder: 25753:25760 ioctl c018620b 0 returned -14 [ 517.003664] binder: 25738:25761 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 517.009805] binder: 25754:25759 ioctl c018620b 0 returned -14 [ 517.024178] binder: 25738:25747 transaction failed 29201/-22, size 112-48 line 3018 [ 517.041542] binder: 25756:25763 ioctl c0306201 20000440 returned -14 [ 517.049290] binder: 25738:25761 got transaction to invalid handle [ 517.051660] binder: 25753:25760 BC_ACQUIRE_DONE u0000000000000000 no match [ 517.057611] binder: 25738:25761 transaction failed 29201/-22, size 24-72 line 3018 03:37:13 executing program 5: r0 = openat$full(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/full\x00', 0x1, 0x0) sendmsg$nl_route(r0, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)=@ipv4_getroute={0x1c, 0x1a, 0x400, 0x70bd2c, 0x25dfdbff, {0x2, 0x20, 0x0, 0x4, 0xfd, 0x1, 0x0, 0x8, 0x400}, ["", ""]}, 0xfffffffffffffd92}, 0x1, 0x0, 0x0, 0x40}, 0x1) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@', @ANYPTR], 0x0, 0x0, 0x0}) [ 517.069852] binder: release 25753:25764 transaction 1319 out, still active [ 517.075638] binder: 25756:25766 ioctl c0306201 20000440 returned -14 [ 517.081958] binder: 25754:25759 ioctl c018620b 0 returned -14 03:37:13 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) r1 = fcntl$dupfd(r0, 0x406, r0) ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000000)) 03:37:13 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000000c0)='pids.current\x00', 0x0, 0x0) bind$unix(r0, &(0x7f0000000100)=@abs={0x1, 0x0, 0x4e20}, 0x6e) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001b5928687ce215bf51e761fe6d58e367a8d7437c6858ffd837c103685991f448221a2b3af2fb05ba587c7137e01eb92036024039d050053afc643248e083e6d438aa57ee4406615504e6044f83e7749d92531ef3b72e8bd36df3fa9d3bf741c8b54e92cf06fae49364edae"], 0x0, 0x0, 0x0}) [ 517.130264] binder: undelivered TRANSACTION_COMPLETE [ 517.159921] binder: undelivered TRANSACTION_ERROR: 29189 [ 517.169290] binder: 25772:25774 unknown command 536872064 [ 517.177581] binder: release 25768:25773 transaction 1323 out, still active [ 517.184247] binder: 25772:25774 ioctl c0306201 20000440 returned -22 [ 517.192902] binder: undelivered TRANSACTION_COMPLETE [ 517.196606] binder: 25772:25774 ioctl 894b 20000000 returned -22 [ 517.207580] binder: 25772:25774 unknown command 536872064 [ 517.208382] binder: release 25754:25765 transaction 1322 out, still active [ 517.214618] binder: 25771:25777 ioctl c018620b 0 returned -14 [ 517.222279] binder: undelivered TRANSACTION_COMPLETE [ 517.231241] binder: 25772:25774 ioctl c0306201 20000440 returned -22 [ 517.243230] binder: release 25754:25765 transaction 1321 out, still active [ 517.250949] binder: 25771:25777 ioctl c018620b 0 returned -14 [ 517.250979] binder: undelivered TRANSACTION_COMPLETE [ 517.269251] binder: release 25771:25780 transaction 1325 out, still active [ 517.280126] binder: undelivered TRANSACTION_COMPLETE [ 517.286606] binder: release 25771:25777 transaction 1324 out, still active [ 517.301448] binder: undelivered TRANSACTION_COMPLETE 03:37:14 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040), 0x4) sched_rr_get_interval(0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') 03:37:14 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 03:37:14 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f00000000c0)={0x0, 0x0}) clock_nanosleep(0x7, 0x0, &(0x7f0000000100)={r1, r2+10000000}, &(0x7f0000000140)) r3 = socket(0x12, 0x800, 0x9) ioctl$sock_inet_SIOCGIFBRDADDR(r3, 0x8919, &(0x7f0000000040)={'hwsim0\x00', {0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}}) ioctl$sock_SIOCGPGRP(r3, 0x8904, &(0x7f0000000080)) ioctl$sock_FIOGETOWN(r3, 0x8903, &(0x7f0000000000)=0x0) fcntl$setown(r0, 0x8, r4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB, @ANYPTR], 0x0, 0x0, 0x0}) 03:37:14 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) bind$netlink(r0, &(0x7f0000000040)={0x10, 0x0, 0x25dfdbff}, 0xc) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="80af"]], 0x0, 0x0, 0x0}) 03:37:14 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) write$P9_RREADDIR(r1, &(0x7f0000000100)={0x2a, 0x29, 0x2, {0x9, [{{0xa0, 0x3, 0x2}, 0x2, 0x800, 0x7, './file0'}]}}, 0x2a) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ad5ab88aec2f07d8607ef70fa1741fb7a06befc94d47e9bbbe0c0ec0da4acf59007f440076481d44da1fdfeaf7a40d682c215af1027891d7c67b12ce890c92af3e8e64e6c902468c2742c525c576846384408f299edc4c6173284212aa77a7306c318b4719b00a33964e7fdc06fd2277b3398d156471cb8bac62c57edf3e4dc79693b823c917e5671c3a3768835ff611ed58594d3bfbe5539e7456362fbfd73f1a8c0451b461393643d696c4f974fc73acfafbf3d3ecc790e907"], 0x0, 0x0, 0x0}) 03:37:14 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 517.627698] binder: 25740:25746 ioctl c0306201 20000140 returned -14 [ 517.664767] binder: 25784:25790 ioctl c018620b 0 returned -14 [ 517.675654] binder: 25788:25793 ioctl c018620b 0 returned -14 [ 517.686185] binder: 25789:25794 ioctl c018620b 0 returned -14 [ 517.687792] binder: 25787:25796 unknown command 536872064 [ 517.693630] binder: 25785:25795 ioctl c018620b 0 returned -14 [ 517.699931] binder: 25787:25796 ioctl c0306201 20000440 returned -22 [ 517.707902] binder: 25785:25795 BC_ACQUIRE_DONE u0000000000000000 no match 03:37:14 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000240)='/dev/binder#\x00', 0x0, 0x800) r1 = creat(&(0x7f0000000040)='./file0\x00', 0x180) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/avc/cache_stats\x00', 0x0, 0x0) r2 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0xffff, 0x8000) ioctl$LOOP_SET_CAPACITY(r2, 0x4c07) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="00af285ad5fd626e6443ece4911e0c4db75d045f313a3ab36e83249a84b90737414ae0504434c5817fe3bc1d142b8b64a2c40a56fff92cb8b7072ac850b80a4cec237f04e98449f8b429bb1cecfb7b907e539f8824d61a86412781740e2dea2b9e673653080a49c2e4cd0a228b7c2fcc697a757d4f0bc56e8274b2e4db61a93c38155edded8eb030458f76ca85aac14436c59b058d0169b4a2715a30646a8dcfc046483857aa89a019de942626b56b6e3d4bd931b0f5f7d33ff6c21d241f58ff78b72fab1aa348"]], 0x0, 0x0, 0x0}) ioctl$PPPIOCSFLAGS1(r1, 0x40047459, &(0x7f0000000200)=0x10200) 03:37:14 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 517.723120] binder: release 25785:25795 transaction 1326 out, still active [ 517.733897] binder: 25788:25793 ioctl c018620b 0 returned -14 [ 517.740789] binder: undelivered TRANSACTION_COMPLETE [ 517.747897] binder: 25784:25802 ioctl c0306201 0 returned -14 [ 517.763438] binder: 25786:25798 unknown command 0 [ 517.769205] binder: 25786:25798 ioctl c0306201 20000440 returned -22 03:37:14 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x410000, 0x100) faccessat(r1, &(0x7f0000000040)='./file0\x00', 0x1a, 0x1000) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 517.777126] binder: release 25788:25793 transaction 1328 out, still active [ 517.787238] binder: 25789:25804 unknown command 536871488 [ 517.787608] binder: 25784:25808 BC_ACQUIRE_DONE u0000000000000000 no match [ 517.800732] binder: undelivered TRANSACTION_COMPLETE [ 517.806666] binder: 25789:25804 ioctl c0306201 20000440 returned -22 [ 517.817261] binder: 25803:25806 unknown command 536871168 [ 517.825153] binder: 25805:25812 ioctl c018620b 0 returned -14 [ 517.828855] binder: 25803:25806 ioctl c0306201 20000440 returned -22 [ 517.836044] binder: 25811:25813 ioctl c018620b 0 returned -14 [ 517.842712] binder: release 25788:25793 transaction 1327 out, still active [ 517.848973] binder: 25805:25812 BC_ACQUIRE_DONE u0000000000000000 no match [ 517.862961] binder: undelivered TRANSACTION_COMPLETE [ 517.866206] binder: 25803:25806 unknown command 536871168 03:37:14 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x800) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vga_arbiter\x00', 0x200, 0x0) setsockopt$inet6_MCAST_MSFILTER(r1, 0x29, 0x30, &(0x7f00000016c0)=ANY=[@ANYBLOB="00000000000000000a004e220000000bff010000000000000000000000000001080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000070000000a004e2100000005fe880000000000000000000000000001ff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a004e2100007fffff01000000000000000000000000000101000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a004e2000000003fe8000000000000000000000000000bb15000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a004e220000000600000000000000000000000000000001ff0f000000000011f700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a004e2100000005fe8000000000000000000000000000bb04000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a004e2400000002ff020000000000000000000000000001050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000eb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a004e240000040000000000000000000000ffffac141410f8ffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x410) ioctl$TCSETSF(r1, 0x5404, &(0x7f0000000000)={0x45d, 0x9, 0x8, 0xfffffffffffffe01, 0x5, 0x6d96aa5, 0x80, 0x2, 0x1ab, 0x9, 0xb7d, 0x8}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="0090"]], 0x0, 0x0, 0x0}) 03:37:14 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x400, 0x0) getpeername(r1, &(0x7f0000000080)=@caif=@util, &(0x7f0000000100)=0x80) arch_prctl$ARCH_GET_CPUID(0x1011) setsockopt$inet6_tcp_int(r1, 0x6, 0x2a, &(0x7f0000000040)=0xfff, 0x4) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:37:14 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 517.873235] binder: 25811:25813 ioctl c018620b 0 returned -14 [ 517.879224] binder: 25803:25806 ioctl c0306201 20000440 returned -22 [ 517.887447] binder: release 25805:25812 transaction 1329 out, still active [ 517.939746] binder: undelivered TRANSACTION_COMPLETE [ 517.959676] binder: release 25811:25813 transaction 1330 out, still active [ 517.966123] binder: 25822:25826 ioctl c018620b 0 returned -14 [ 517.974734] binder: 25821:25825 ioctl c018620b 0 returned -14 [ 517.981018] binder: undelivered TRANSACTION_COMPLETE [ 517.986007] binder: 25821:25825 BC_ACQUIRE_DONE u0000000000000000 no match [ 517.989430] binder: 25819:25824 unknown command 536872064 [ 517.997243] binder: 25822:25826 ioctl c018620b 0 returned -14 [ 518.003566] binder: 25819:25824 ioctl c0306201 20000440 returned -22 [ 518.012022] binder: release 25821:25825 transaction 1332 out, still active [ 518.021200] binder: 25819:25829 unknown command 536872064 [ 518.031120] binder: 25819:25829 ioctl c0306201 20000440 returned -22 [ 518.047460] binder: undelivered TRANSACTION_COMPLETE [ 518.064041] binder: release 25822:25826 transaction 1333 out, still active [ 518.079598] binder: undelivered TRANSACTION_COMPLETE [ 518.085772] binder: release 25822:25826 transaction 1331 out, still active [ 518.093841] binder: undelivered TRANSACTION_COMPLETE 03:37:15 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB]], 0x0, 0x0, &(0x7f00000003c0)}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040), 0x4) sched_rr_get_interval(0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') 03:37:15 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x0, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x24, &(0x7f0000000040)=0x3, 0x4) r2 = add_key(&(0x7f0000000080)='id_resolver\x00', &(0x7f00000000c0)={'syz', 0x1}, &(0x7f0000000100)="5a173c0564a74d022ff7832afdbcd5f267b2e2308399f3422291abc34be422b2893face1eee473e19703c3faa434da90058590c2c853235c50cedd503bef5aae321442242606481291eff4b1941bf0ce7c8df1539ba0764c02481bcd0ca4d71cca74fa3bb23ca84c61b345389495da4956ed7f40717cb35418c9d1ea6cdaa502e454be", 0x83, 0xfffffffffffffffe) keyctl$get_security(0x11, r2, &(0x7f00000001c0)=""/255, 0xff) [ 518.490527] binder: 25789:25794 ioctl c0306201 20000140 returned -14 [ 518.519569] binder: 25834:25839 ioctl c018620b 0 returned -14 [ 518.522276] binder: 25786:25841 unknown command 0 03:37:15 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000000000000000000000ffe200000000000000000000000000fdbd00000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) 03:37:15 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffff9c, 0x8904, &(0x7f00000000c0)=0x0) ptrace$setsig(0x4203, r1, 0x9f, &(0x7f0000000100)={0x3, 0x10000, 0xf5}) r2 = dup3(r0, r0, 0x0) ioctl$BLKTRACETEARDOWN(r2, 0x1276, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="21d060bc012946399c1c2958a7ed53123fca5f84862279767cf894472540f8bb488be104ce1ea5911055806bc43f868299289bfc68b4781b864639b5b300005e8c7c4d0000004de60b41663b70c9750f4b152dea5e187e180ea0fc417b6685e165bb43e641b6012f871fbf271b9c53317294f5718f5616244b23e9f08c3a0e15b6284837000000277a047725725fecb3ff5312fbc8088cd4907052b6bfb8f5d34b7e4b60709594b25cf7994e833f64ba6cdd7826f49898c8f7e9eed81a9f82c23bd1a1253c71dd677419d2fcea46371b5e61ee30142d69074f4628bb35a4e3fc4a8c6ac9f274e06c916f27429d728c57ff291a00f191be72ca1e197b94276846d842fb8add8b8b7d5393685efaeca64e99c8ddc08444995a92342f45653247", @ANYPTR], 0x0, 0x0, 0x0}) 03:37:15 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 03:37:15 executing program 0: r0 = open(&(0x7f0000000000)='./file0\x00', 0x400000, 0x2) getsockopt$inet_mreq(r0, 0x0, 0x24, &(0x7f0000000080)={@loopback, @dev}, &(0x7f00000000c0)=0x8) write$P9_RXATTRCREATE(r0, &(0x7f0000000040)={0x7, 0x21, 0x1}, 0x7) bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, &(0x7f0000000300)={r0, &(0x7f0000000100)="6996e92165ca41e308846d0e636ff4b942283d520efe710e0f481491b0d422fac77f0de6e90b3c2eb0333490713bd82afb4412b7c2f28fd64e5f0be3c1ea162e5f78e7763b59460ea88e597f2507955158bd9a522b2b5736ccdafa6ec808cd15f0e859d93d8f79b9e00f8054b5b310b29b4918e9964eba07018a3f67200c9982500cf63ac180f8ef6ef9ea10a195c01c99c431ee842e1f1a9aae3cea9cf81a5fe7836c4ca2cec0643fa6caf5c227fc9ffab040ed8eab5c8185cb7c41578d67ab629f3e08d2c787201ced683e11ac494ae570e3f5712c577175cef69f478f22", &(0x7f0000000200)=""/219}, 0x18) syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 03:37:15 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 518.535701] binder: 25834:25839 ioctl c018620b 0 returned -14 [ 518.538896] binder: 25786:25841 ioctl c0306201 20000440 returned -22 [ 518.543161] binder: 25840:25842 ioctl c018620b 0 returned -14 [ 518.552923] binder: release 25834:25839 transaction 1334 out, still active [ 518.565363] binder: undelivered TRANSACTION_COMPLETE [ 518.597085] binder: release 25834:25843 transaction 1335 out, still active [ 518.607421] binder: 25847:25854 ioctl c018620b 0 returned -14 [ 518.614695] binder: 25845:25848 ioctl c018620b 0 returned -14 [ 518.624546] binder: 25840:25855 unknown command 536871488 [ 518.626893] binder: undelivered TRANSACTION_COMPLETE [ 518.632408] binder: 25852:25856 unknown command -1134505951 03:37:15 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 03:37:15 executing program 0: r0 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$TUNGETFILTER(r0, 0x801054db, &(0x7f0000000080)=""/171) r1 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) ioctl$EVIOCSREP(r1, 0x40084503, &(0x7f0000000000)=[0x6, 0x1f]) ioctl$PERF_EVENT_IOC_ID(r0, 0x80082407, &(0x7f0000000140)) r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bpf$OBJ_PIN_PROG(0x6, &(0x7f0000000200)={&(0x7f0000000040)='./file0\x00', r0}, 0x10) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0xfffffffffffffedd, 0x0, &(0x7f00000001c0)=ANY=[], 0xeb, 0x0, 0x0}) getsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000440)={@loopback, @local, 0x0}, &(0x7f0000000300)=0xc) recvfrom$packet(r1, &(0x7f0000000240)=""/44, 0x2c, 0x10001, &(0x7f0000000340)={0x11, 0xff, r3, 0x1, 0x8, 0x6, @random="d7c4bf17a486"}, 0x14) ioctl$FIBMAP(r2, 0x1, &(0x7f00000001c0)=0x100000001) [ 518.637090] binder: 25851:25857 ioctl c018620b 0 returned -14 [ 518.643667] binder: 25845:25848 BC_ACQUIRE_DONE node 1337 has no pending acquire request [ 518.655553] binder: 25851:25857 ioctl c018620b 0 returned -14 [ 518.660267] binder: 25840:25855 ioctl c0306201 20000440 returned -22 [ 518.666859] binder: release 25851:25857 transaction 1339 out, still active [ 518.675207] binder: 25852:25856 ioctl c0306201 20000440 returned -22 [ 518.687767] binder: undelivered TRANSACTION_COMPLETE 03:37:15 executing program 2: r0 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000040)={0x0}) bpf$BPF_MAP_GET_NEXT_ID(0xc, &(0x7f00000000c0)=0x10000, 0x4) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000080)={r1}) r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 03:37:15 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) fcntl$notify(r0, 0x402, 0x2) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000001c0)='net/dev_snmp6\x00') bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000480)={0xffffffffffffffff, 0x10, &(0x7f00000003c0)={&(0x7f0000000300)=""/144, 0x90, 0xffffffffffffffff}}, 0x10) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000500)={r1, 0x10, &(0x7f00000004c0)={&(0x7f0000000200)=""/201, 0xc9, r2}}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xffffffffffffff08, 0x0, &(0x7f0000000180)=ANY=[@ANYRESHEX, @ANYPTR64=&(0x7f0000000040)=ANY=[@ANYRESOCT=r0, @ANYRES64=r0, @ANYBLOB="ed8b2d8f09ece0980a6a18be733c0e1e8baa7feb1860b487dd1e0c7618a82257d77335f85e", @ANYRESOCT, @ANYRESDEC=r0], @ANYRESOCT=r0, @ANYPTR64=&(0x7f00000000c0)=ANY=[@ANYBLOB="df1766665f5c20077c5c0ad9263719dc6fffdc6f3bd30256a7a32e890b1697d8be8b356ab149935ff6347bcd746f4380d0aee33f6e0087ed28c96b21b8630cc2c469a1828bb9596e33d392961a6da2fc8b0325e96a0897f8f12eb64406a18dad1c2719314db9a9a6a7621aa47eb18889f5fd", @ANYRES32=r0, @ANYRESHEX=r0]], 0x29, 0x0, 0x0}) ioctl$FITRIM(r0, 0xc0185879, &(0x7f0000000000)={0x7f, 0x0, 0xffffffffffff0000}) [ 518.716921] binder: 25847:25861 BC_ACQUIRE_DONE u0000000000000000 no match [ 518.740855] binder: release 25845:25848 transaction 1336 out, still active [ 518.774844] binder: 25867:25870 ioctl c0306201 20000180 returned -14 [ 518.776034] binder: 25866:25874 ioctl c018620b 0 returned -14 [ 518.790019] binder: 25867:25870 ioctl 1 200001c0 returned -22 [ 518.792050] binder: unexpected work type, 4, not freed [ 518.798809] binder: 25867:25870 ioctl c0306201 20000180 returned -14 [ 518.811088] binder: 25869:25871 ioctl c018620b 0 returned -14 [ 518.811473] binder: 25872:25875 ioctl c0306201 20000440 returned -14 03:37:15 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 518.819663] binder: 25867:25877 ioctl 1 200001c0 returned -22 [ 518.828991] binder: undelivered TRANSACTION_COMPLETE [ 518.832643] binder: 25869:25871 ioctl c018620b 0 returned -14 [ 518.839761] binder: 25872:25875 ioctl c0185879 20000000 returned -22 [ 518.854616] binder: release 25866:25879 transaction 1340 out, still active [ 518.864484] binder: unexpected work type, 4, not freed [ 518.877327] binder: 25872:25875 ioctl c0306201 20000440 returned -14 [ 518.899230] binder: 25872:25880 ioctl c0185879 20000000 returned -22 [ 518.912200] binder: undelivered TRANSACTION_COMPLETE [ 518.920900] binder: 25881:25885 ioctl c018620b 0 returned -14 [ 518.930119] binder: release 25881:25885 transaction 1343 out, still active [ 518.938709] binder: unexpected work type, 4, not freed [ 518.946253] binder: undelivered TRANSACTION_COMPLETE 03:37:16 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB]], 0x0, 0x0, &(0x7f00000003c0)}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040), 0x4) sched_rr_get_interval(0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') 03:37:16 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 03:37:16 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040e40ac7d35ed18f25f0e27636d833b992016fd1a12b48aa968526c74a1092517c209c0a556f0294dae6721ec3bf3304fe33ecc85840139beafb499427f9b93e4e90943f98910dadd03af6bb0901e9263f061d730112c05b33fde07bd7975f3c583ab050ba3e6a276e776a6e21b198634e07cdcc158d76bf16ebeaba533ef786da04b1acf434c348bac1cb301f79d3205d7e87774cab8572d0ea3beb5d391b54b0435d0bed3219dda8739db14097c6d17db0caee18fc7c22ffef9c4c3b469b5508efcf6297bf887afb14f4beefbd66329360edd9903e748aa26e775b46b75cd2a3616d4f59826aa91a264098d2c2482f6c97f69c18a3fbefdff44e3b801950140cf55327a42860a76148ab29636b95c9af4474e57776e1af64aed0e4784d69d6c68d352eab16f548a6e1abafa236d1f24ffdb9ebb071f1ebe903afa7464479d544d2b7fd6ccd9132a74f469765cb9b", @ANYPTR], 0x0, 0x0, 0x0}) 03:37:16 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = dup3(r0, r0, 0x80000) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000000)='tls\x00', 0x4) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:37:16 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x101000, 0x0) [ 519.335329] binder: 25840:25842 ioctl c0306201 20000140 returned -14 [ 519.376250] binder: 25891:25893 ioctl c018620b 0 returned -14 [ 519.384140] binder: 25888:25894 unknown command 536872064 [ 519.394795] binder: 25890:25897 got transaction to invalid handle [ 519.394994] binder: 25889:25895 ioctl c018620b 0 returned -14 [ 519.401920] binder: 25890:25897 transaction failed 29201/-22, size -2696527599696700384--142932389463690522 line 3018 [ 519.408776] binder: 25888:25894 ioctl c0306201 20000440 returned -22 03:37:16 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 519.428933] binder: 25891:25893 ioctl c018620b 0 returned -14 [ 519.436725] binder: release 25891:25893 transaction 1346 out, still active [ 519.445226] binder: undelivered TRANSACTION_COMPLETE [ 519.451927] binder: 25896:25902 ioctl c018620b 0 returned -14 [ 519.470386] binder: undelivered TRANSACTION_ERROR: 29201 03:37:16 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 03:37:16 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000083f55871cb45beb57d6c8f363abc"], 0x0, 0x0, 0x0}) 03:37:16 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@', @ANYPTR], 0x0, 0x0, 0x0}) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/status\x00', 0x0, 0x0) ioctl$RTC_AIE_ON(r1, 0x7001) [ 519.482277] binder: 25903:25904 ioctl c018620b 0 returned -14 [ 519.498101] binder: release 25889:25901 transaction 1348 out, still active [ 519.513311] binder: 25906:25909 ioctl c018620b 0 returned -14 [ 519.521921] binder: 25888:25894 unknown command 536872064 [ 519.532847] binder: 25896:25912 unknown command 536871488 [ 519.534117] binder: unexpected work type, 4, not freed [ 519.544023] binder: 25906:25909 ioctl c0306201 0 returned -14 [ 519.547013] binder: 25888:25894 ioctl c0306201 20000440 returned -22 [ 519.555587] binder: 25903:25915 BC_ACQUIRE_DONE u0000000000000000 no match [ 519.566062] binder: 25907:25913 ioctl c018620b 0 returned -14 [ 519.570620] binder: undelivered TRANSACTION_COMPLETE 03:37:16 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) setsockopt$netlink_NETLINK_NO_ENOBUFS(r1, 0x10e, 0x5, &(0x7f0000000040)=0x4, 0x4) 03:37:16 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$ASHMEM_SET_SIZE(r1, 0x40087703, 0x40) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@', @ANYPTR], 0x0, 0x0, 0x0}) getsockname$inet6(0xffffffffffffffff, &(0x7f0000000040), &(0x7f0000000080)) 03:37:16 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 519.572609] binder: 25896:25912 ioctl c0306201 20000440 returned -22 [ 519.588759] binder: 25907:25913 ioctl c018620b 0 returned -14 [ 519.636651] binder: 25921:25922 unknown command 536872064 [ 519.637194] binder: release 25907:25913 transaction 1357 out, still active [ 519.643268] binder: 25921:25922 ioctl c0306201 20000440 returned -22 [ 519.660312] binder: 25921:25922 unknown command 536872064 [ 519.679648] binder: undelivered TRANSACTION_COMPLETE [ 519.686456] binder: 25928:25929 ioctl c018620b 0 returned -14 [ 519.687626] binder: 25921:25922 ioctl c0306201 20000440 returned -22 [ 519.693243] binder: release 25907:25913 transaction 1356 out, still active [ 519.714682] binder: 25928:25929 ioctl c0306201 0 returned -14 [ 519.722115] binder: undelivered TRANSACTION_COMPLETE [ 519.731626] binder: release 25906:25909 transaction 1351 out, still active [ 519.738906] binder: unexpected work type, 4, not freed [ 519.744787] binder: undelivered TRANSACTION_COMPLETE [ 519.750255] binder: release 25911:25914 transaction 1355 out, still active [ 519.758033] binder: undelivered TRANSACTION_COMPLETE [ 519.763786] binder: release 25911:25914 transaction 1354 out, still active [ 519.771933] binder: undelivered TRANSACTION_COMPLETE [ 519.783542] binder: release 25928:25929 transaction 1358 out, still active [ 519.792146] binder: unexpected work type, 4, not freed [ 519.797920] binder: undelivered TRANSACTION_COMPLETE [ 519.803833] binder: release 25927:25930 transaction 1362 out, still active [ 519.811431] binder: undelivered TRANSACTION_COMPLETE [ 519.820790] binder: release 25927:25930 transaction 1361 out, still active [ 519.828148] binder: undelivered TRANSACTION_COMPLETE 03:37:17 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB]], 0x0, 0x0, &(0x7f00000003c0)}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040), 0x4) sched_rr_get_interval(0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') 03:37:17 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0}) 03:37:17 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="00138dc3e73ff2067e3cc29f5b93f6bab91a2a9a6fc802ca221d4f0d27b0053de3f969c16d959c6933f1805bb512d4d471f46c05ff4a52e04f915615814f56b2627648a8e423b4b4ccc8bd5ad91e3fab782362c64ac670d92d80a6d88e2e8bd115e2fc5184f76611e5b181114cfbdb3d8c97cc5ec0a658d9043504f4b601a3eebc9605135aa622e161568de80d5d4a401db400875e318b638a3ae6d0222e973328ad9c8928c1a642c296f74fb010bdfe1339195063c40408bfb75ff713eafd10cb4bf759838f9d489210000000000000000000000000000000"]], 0x0, 0x0, 0x0}) fsetxattr$security_selinux(r0, &(0x7f0000000000)='security.selinux\x00', &(0x7f0000000040)='system_u:object_r:auditd_unit_file_t:s0\x00', 0x28, 0x0) 03:37:17 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 03:37:17 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x200000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@', @ANYPTR], 0x0, 0x0, 0x0}) [ 520.230140] binder: 25896:25902 ioctl c0306201 20000140 returned -14 [ 520.263675] binder: 25935:25940 ioctl c018620b 0 returned -14 03:37:17 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 03:37:17 executing program 5: r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x2000, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x7) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@', @ANYPTR], 0x0, 0x0, 0x0}) [ 520.286312] binder: 25935:25940 ioctl c018620b 0 returned -14 [ 520.305112] binder: 25936:25945 unknown command 536871040 [ 520.311876] binder: 25938:25944 ioctl c018620b 0 returned -14 [ 520.318420] binder: 25936:25945 ioctl c0306201 20000440 returned -22 [ 520.326582] binder: 25942:25948 ioctl c018620b 0 returned -14 03:37:17 executing program 2: fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000000)={0x0, 0x0}) get_robust_list(r0, &(0x7f0000000100)=&(0x7f00000000c0)={&(0x7f0000000080)={&(0x7f0000000040)}}, &(0x7f0000000140)=0x18) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r2 = syz_open_procfs(r0, &(0x7f0000000180)='mountstats\x00') ioctl$ASHMEM_GET_NAME(r2, 0x81007702, &(0x7f00000001c0)) [ 520.333759] binder: 25946:25950 ioctl c018620b 0 returned -14 [ 520.342272] binder: 25938:25944 ioctl c0306201 0 returned -14 [ 520.350888] audit: type=1400 audit(2000000237.200:52): avc: denied { associate } for pid=25936 comm="syz-executor.0" name="binder0" dev="devtmpfs" ino=5423 scontext=system_u:object_r:auditd_unit_file_t:s0 tcontext=system_u:object_r:device_t:s0 tclass=filesystem permissive=1 [ 520.362199] binder: release 25938:25944 transaction 1363 out, still active [ 520.381095] binder: 25936:25945 unknown command 536871040 [ 520.394104] binder: 25936:25945 ioctl c0306201 20000440 returned -22 [ 520.399829] binder: 25942:25954 unknown command 536871488 [ 520.402158] binder: 25946:25957 BC_ACQUIRE_DONE u0000000000000000 no match [ 520.409936] binder: 25942:25954 ioctl c0306201 20000440 returned -22 03:37:17 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 03:37:17 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@', @ANYPTR], 0x0, 0x0, 0x0}) 03:37:17 executing program 0: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x0, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x48) socketpair(0x1, 0x80000, 0x7fffffff, &(0x7f0000000240)) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f00000005c0)={0x80000000000000, 0x7}, 0x4) syz_genetlink_get_family_id$team(&(0x7f0000000180)='team\x00') getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) getsockopt$inet_mreqn(r0, 0x0, 0x0, &(0x7f0000000300)={@initdev, @remote}, &(0x7f0000000480)=0xc) getpeername$packet(r1, &(0x7f00000004c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000500)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) getpeername$packet(r3, 0x0, &(0x7f0000004d80)) getsockopt$inet6_mreq(r2, 0x29, 0x1b, &(0x7f0000004dc0)={@local}, 0x0) ioctl$sock_ifreq(0xffffffffffffffff, 0x891d, 0x0) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000280)=0x32, 0x4) connect$inet(r0, &(0x7f0000000340)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) pipe2(0x0, 0x800) ioctl$EVIOCSABS3F(0xffffffffffffffff, 0x401845ff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_opaque(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='trusted.overlay.opaque\x00', &(0x7f00000001c0)='y\x00', 0x2, 0x2) r5 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x8000, 0x0) bind$unix(r5, &(0x7f0000000040)=@file={0x0, './file0\x00'}, 0x6e) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000600)=ANY=[@ANYBLOB="2b29d4ca3da11207f9e7ad7d6bcf629febde0a7d7aeb2ec2ca69f00ceb7652e180f249706db382fdee03025aab7e626adcf0ec5fe78d5302b08b25590eedb157fbe440e7c5fbab25051f0f19556679e9a2d789a528609afca507c3b12312e3313c28929d05ac0552606cd6afb296d36ebb12c7c9c4ae2f56827a93e9c3c8ce87c49fbdbfdf205fe203820b8ad27616c3199ea70483a9c3f67ac51e4676b3968c2e812846ec37cc0a62831b6926d5ca5bd6b129943604d127e4ed7cf914b9d0872b539d798c"]], 0x0, 0x0, 0x0}) [ 520.436473] binder: 25956:25959 ioctl c018620b 0 returned -14 [ 520.487649] binder: unexpected work type, 4, not freed [ 520.494350] binder: 25956:25959 ioctl c018620b 0 returned -14 [ 520.497329] binder: 25962:25969 ioctl c018620b 0 returned -14 [ 520.515278] binder: undelivered TRANSACTION_COMPLETE [ 520.523354] binder: release 25949:25952 transaction 1366 out, still active [ 520.531733] binder: undelivered TRANSACTION_COMPLETE 03:37:17 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) flistxattr(r0, &(0x7f0000000480)=""/4096, 0x1000) [ 520.539012] binder: release 25956:25968 transaction 1368 out, still active [ 520.549441] binder: undelivered TRANSACTION_COMPLETE [ 520.575188] binder: release 25963:25972 transaction 1373 out, still active [ 520.587261] binder: undelivered TRANSACTION_COMPLETE [ 520.596068] binder: 25966:25977 unknown command 536872448 [ 520.602914] binder: release 25963:25971 transaction 1372 out, still active [ 520.612023] binder: 25966:25977 ioctl c0306201 20000440 returned -22 [ 520.619655] binder: 25976:25979 ioctl c018620b 0 returned -14 [ 520.626952] binder: undelivered TRANSACTION_COMPLETE [ 520.634389] binder: release 25956:25959 transaction 1367 out, still active [ 520.642363] binder: undelivered TRANSACTION_COMPLETE [ 520.648215] binder: 25976:25979 ioctl c018620b 0 returned -14 [ 520.663367] binder: release 25962:25969 transaction 1369 out, still active [ 520.673291] binder: unexpected work type, 4, not freed [ 520.679901] binder: undelivered TRANSACTION_COMPLETE [ 520.696587] binder: release 25976:25980 transaction 1375 out, still active [ 520.710953] binder: undelivered TRANSACTION_COMPLETE [ 520.718487] binder: release 25976:25979 transaction 1374 out, still active [ 520.728204] binder: undelivered TRANSACTION_COMPLETE [ 521.051568] binder: 25966:25985 unknown command 536872448 [ 521.058246] binder: 25966:25985 ioctl c0306201 20000440 returned -22 03:37:17 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040), 0x4) sched_rr_get_interval(0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') 03:37:17 executing program 5: add_key(&(0x7f0000000140)='ceph\x00', &(0x7f0000000180)={'syz', 0x2}, &(0x7f00000001c0)="2d1d5df1e80eac1a290288969778169aa47b5e950183bc223175361cada0df565aa63efdb3361a6469446dfb45c7c21fc29061f58b2935c32a0b09f624730e4d0c257a62c152d67e49c7c0a3296ddd8cafbb898406303d7cc449bea4abd8025757d3dab1bdc9fe355414887dab7fde233e79254494bbe423085e35eab95f9c90d2bd32f0028008a4303e7175b6ef9a636be428c265cd57b7038874f956f59cc7dbc52bd839b0f9ed760c7d5aa64f3ad8", 0xb0, 0xfffffffffffffff8) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x22000, 0x0) r1 = add_key$keyring(&(0x7f00000000c0)='keyring\x00', &(0x7f0000000100)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffd) add_key(&(0x7f0000000040)='id_resolver\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0, r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@', @ANYPTR], 0x0, 0x0, 0x0}) 03:37:17 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 03:37:17 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e31ca06162a2d2edd8ae9b05cd7c606eec7009c6169422cefb6f4dcced476f0095e35b1bb45d6789090a744270697c2e491856ac82fe9105dcdaa3a4bdea802a495188a19e64734cbe57a16ce0c8a34c25ea5c83abcd77db94624f24df16b71a9a758f26cd0687756cc481b3120bd8d1f527ddd94eab29f25bfa04d6b65d855c85701ee492c0a63b8b4e00c5371348739ad7fb1f096456a81c6556901e15ab3f61c3bb1f16c5c0ad0dc5f032cc0fe7cf74968f144316ffa55473b06b4a1e49115708da4c355d4423cfee6e3dc0af713d29af37ff107d2b4c220aebbeee0601a7befee3a02bfe03dd1a327447f55dd69feb7d6bb4e5890d4a939c50a9e994d5d68c62cd60c1a0"], 0x0, 0x0, 0x0}) ioctl$FS_IOC_GETFLAGS(r0, 0x80086601, &(0x7f0000000000)) 03:37:17 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 521.103365] binder: 25942:25948 ioctl c0306201 20000140 returned -14 03:37:18 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="36d73e4d2397f96a2f2f00af0680a8de263dc99bd33c08d6"]], 0x0, 0x0, 0x0}) [ 521.168688] binder: 25990:25993 ioctl c018620b 0 returned -14 [ 521.178121] binder: 25990:25993 ioctl 80086601 20000000 returned -22 [ 521.189664] binder: 25990:25993 ioctl c018620b 0 returned -14 [ 521.204369] binder: 25991:25998 ioctl c018620b 0 returned -14 [ 521.204997] binder: 25992:26000 ioctl c018620b 0 returned -14 03:37:18 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340be00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c22ef489dc3f"], 0x0, 0x0, 0x0}) prctl$PR_SET_KEEPCAPS(0x8, 0x1) [ 521.218659] binder: 25987:25999 ioctl c018620b 0 returned -14 [ 521.222801] binder: 25990:26001 ioctl 80086601 20000000 returned -22 [ 521.234154] binder: release 25987:25999 transaction 1378 out, still active [ 521.245099] binder: 25988:25997 transaction failed 29189/-22, size 0-0 line 3018 [ 521.246227] binder: 25988:25997 transaction failed 29189/-22, size 0-0 line 3018 03:37:18 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 521.272331] binder: 25995:26002 unknown command 536870912 [ 521.280594] binder: 25992:26006 unknown command 536871488 [ 521.284410] binder: 25991:26007 BC_ACQUIRE_DONE u0000000000000000 no match [ 521.293414] binder: 25995:26002 ioctl c0306201 20000440 returned -22 [ 521.305738] binder: 25992:26006 ioctl c0306201 20000440 returned -22 [ 521.311316] binder: 26005:26008 ioctl c018620b 0 returned -14 03:37:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) prctl$PR_MCE_KILL(0x21, 0x1, 0x1) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000180)='/dev/zero\x00', 0xa800, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000001c0)={{{@in6=@mcast1, @in=@dev}}, {{@in=@local}, 0x0, @in=@initdev}}, &(0x7f00000002c0)=0xe8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xe5, 0x0, &(0x7f0000000000)=ANY=[@ANYRESOCT=r0, @ANYPTR], 0x110, 0x0, 0x0}) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080)='TIPCv2\x00') mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2000000, 0x10, r1, 0x0) sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x34, r2, 0x100, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_BEARER={0x20, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'ib', 0x3a, 'teql0\x00'}}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}]}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x40}, 0x0) ioctl$RTC_WIE_ON(r1, 0x700f) [ 521.317104] binder: unexpected work type, 4, not freed [ 521.338476] binder: 26009:26014 ioctl c018620b 0 returned -14 [ 521.345660] binder: undelivered TRANSACTION_COMPLETE [ 521.346170] binder: 26005:26008 unknown command -1103076608 [ 521.354735] binder: 25995:26002 unknown command 536870912 [ 521.367712] binder: undelivered TRANSACTION_ERROR: 29189 [ 521.368758] binder: 26005:26008 ioctl c0306201 20000440 returned -22 [ 521.376666] binder: 25995:26002 ioctl c0306201 20000440 returned -22 [ 521.386328] binder: 26013:26016 ioctl 6611 0 returned -22 [ 521.387595] binder: undelivered TRANSACTION_ERROR: 29189 [ 521.395686] binder: 26013:26016 unknown command 808464432 [ 521.400565] binder: release 25990:25996 transaction 1377 out, still active [ 521.406465] binder: 26013:26016 ioctl c0306201 20000440 returned -22 03:37:18 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpuset.memory_pressure\x00', 0x0, 0x0) ioctl$GIO_SCRNMAP(r1, 0x4b40, &(0x7f00000004c0)=""/4096) creat(&(0x7f0000000040)='./file0\x00', 0x9) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) [ 521.415062] binder: undelivered TRANSACTION_COMPLETE [ 521.424734] binder: 26005:26008 ioctl c018620b 0 returned -14 [ 521.428284] binder: release 25990:25993 transaction 1376 out, still active [ 521.435161] binder: 26005:26017 unknown command -1103076608 [ 521.443350] binder: undelivered TRANSACTION_COMPLETE [ 521.451834] binder: 26005:26017 ioctl c0306201 20000440 returned -22 03:37:18 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000680), 0x0, 0x0, 0x0}) 03:37:18 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x4000, 0x88) syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x800) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f0000000040)=0x7) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000001580)={{{@in, @in=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in6=@ipv4={[], [], @multicast1}}}, &(0x7f0000000280)=0xe8) setsockopt$inet6_mreq(r0, 0x29, 0x1c, &(0x7f00000002c0)={@rand_addr="311db0e5b7e051c122cbf24ec1634d5b", r2}, 0x14) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634034480b4000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000d4083c813923aae43b95e00a92dd27e661d5d2f90b4fe9ad3d07bbb09f91f474c4c38c0b4fbd6e38c97eac1b70ba8208b1209003e14f17827d59b369d8d154a75c0d1d8c829b110ea0dc4085f5e87ce9390fa896d6c7cc217aa441c381b82501f117f1272c0414ce52e4eea7fd9938bf7904f3301e36da1eb7bbdd6eeed2706a5274a775337b7b67d2304b6524bedb2e38f1e5b070fd3568acd71a6d22da8ee7d058d36af002075036193c56bf3c1307adf6debaee4e3b28242828000000000000000000000000000000008f98e64067cb52c61dc18f82ab1644f93faa0591cc25abcaa16ead88c4154887ceb61dabd3cd3535d049e7cbc12f0d7fb5d647ed9889984da0b8dc880505c0b080fcecee66006165ca356519b6e1b2bdc63afe534ce3bd4c00000b69e34b08b6a15e63cd05e78593da6ecb6c13798d4ff6605a2836aab5d4c1075f7778df2bc6935859bd4c82c0f17b562ee38a765d43fd206354e3570000000000000000005f138619f90b67897768f15628d9ccdd9c17636b2656acdc52ae71790c872f456a3be28008d4868d540915ed7ffa1fdeecdeb39046f59445a1e1e3ca587ea6c9734e19caa6b821ef94fca16a33302937f43de4544c597a4a51da28f654a01c6129eef349d7e54bda7aa57ea2d5283e5aac6340ef7a3fd560630ece0fcc58862a8905e504c214bba61424b06faeafae89dca982d820f4"], 0x0, 0x0, 0x0}) [ 521.480420] binder: 26013:26016 ioctl 6611 0 returned -22 [ 521.480822] binder: release 26009:26014 transaction 1383 out, still active [ 521.488352] binder: 26013:26016 unknown command 808464432 [ 521.531433] binder: unexpected work type, 4, not freed [ 521.532939] binder: 26013:26016 ioctl c0306201 20000440 returned -22 [ 521.549728] binder: undelivered TRANSACTION_COMPLETE [ 521.556184] binder: 26025:26029 ioctl c018620b 0 returned -14 [ 521.564168] binder: 26026:26030 ioctl c018620b 0 returned -14 [ 521.574160] binder: release 26025:26029 transaction 1386 out, still active [ 521.578926] binder: 26024:26031 unknown command 536872064 [ 521.588966] binder: 26024:26031 ioctl c0306201 20000440 returned -22 [ 521.594536] binder: 26026:26030 unknown command 876634880 [ 521.603734] binder: unexpected work type, 4, not freed [ 521.608208] binder: 26024:26033 unknown command 536872064 [ 521.616552] binder: undelivered TRANSACTION_COMPLETE [ 521.624832] binder: 26024:26033 ioctl c0306201 20000440 returned -22 [ 521.628076] binder: 26026:26030 ioctl c0306201 20000440 returned -22 [ 521.644784] binder: 26026:26035 ioctl c018620b 0 returned -14 [ 521.656099] binder: 26026:26035 unknown command 876634880 [ 521.663857] binder: 26026:26035 ioctl c0306201 20000440 returned -22 03:37:18 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040), 0x4) sched_rr_get_interval(0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') 03:37:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@', @ANYPTR], 0x0, 0x0, 0x0}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)) 03:37:18 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000680), 0x0, 0x0, 0x0}) 03:37:18 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="c7b00efe13885975afc16329a0a3c9635a5d7472770e835c5901de9c4c68225015018e1aa27d95f13ef427c62e8dce9a41b9d5e9d372b8d2b43a25b184648dd89164e1c081b56fec8f69d41394cac4a0fcd98fe78684a032c7ef69a566ba354c5f3d08fa371f19c769607ef32d628ffe5ec51e5ec6776aa6847448c5ca8e853e8cb6c9f0eac18a3e7ba36eb0db3ea36b02489df8524baa5525d900e0bbb7ecfc844e586f66c60322dd7cfae9c303d1a36190a9939a89ff683386776e51d9cd3a426d93aea80941c1a9afab6a3d4f811a2fd157615b27b34fec2f5e7dfc1dbe0b9faa5d14c16750e415eeaa8aa693a128dfe2ae6125e27fb168f707179669ca78a48f51756e07046d656e59258cef2bbba0ca7b56e59c3b43c34684938a80678ed6a7b877fe1a3e8613c4edd6cc6450ee5aff5b2779bbfb75a063f080b6c227d7098049cd7ea30c8b7ab560ae06e4cf4dfc36a14e45243a2ae32c8c63"]], 0x0, 0x0, 0x0}) 03:37:18 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x4000c0, 0x0) r2 = gettid() write$cgroup_pid(r1, &(0x7f0000000040)=r2, 0x12) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:37:18 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 522.008624] binder: 25992:26000 ioctl c0306201 20000140 returned -14 [ 522.059781] binder: 26039:26047 ioctl c018620b 0 returned -14 [ 522.066988] binder: 26041:26046 unknown command 536870912 [ 522.067350] binder: 26043:26048 ioctl c018620b 0 returned -14 [ 522.079942] binder: release 26040:26051 transaction 1390 out, still active [ 522.081314] binder: 26044:26049 ioctl c018620b 0 returned -14 [ 522.089787] binder: 26041:26046 ioctl c0306201 20000440 returned -22 [ 522.102099] binder: 26045:26050 ioctl c018620b 0 returned -14 03:37:18 executing program 5: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@', @ANYPTR], 0x0, 0x0, 0x0}) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='cpuset.effective_mems\x00', 0x0, 0x0) ioctl$RTC_PIE_OFF(r0, 0x7006) mmap$binder(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 03:37:18 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000680), 0x0, 0x0, 0x0}) [ 522.104342] binder: undelivered TRANSACTION_COMPLETE [ 522.113597] binder: 26043:26048 ioctl c018620b 0 returned -14 [ 522.123260] binder: release 26039:26047 transaction 1391 out, still active [ 522.139480] binder: 26041:26046 unknown command 536870912 [ 522.145618] binder: 26041:26046 ioctl c0306201 20000440 returned -22 [ 522.150790] binder: 26057:26059 ioctl c018620b 0 returned -14 [ 522.154630] binder: unexpected work type, 4, not freed [ 522.171339] binder: 26044:26061 BC_ACQUIRE_DONE u0000000000000000 no match [ 522.172683] binder: 26045:26062 unknown command 536871488 [ 522.179927] binder: undelivered TRANSACTION_COMPLETE [ 522.191776] binder: release 26040:26051 transaction 1389 out, still active [ 522.194111] binder: 26045:26062 ioctl c0306201 20000440 returned -22 03:37:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@', @ANYPTR], 0x0, 0x0, 0x0}) setxattr$security_ima(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='security.ima\x00', &(0x7f0000000100)=@md5={0x1, "fba46fd661778c501fc2d60bc53e127e"}, 0x11, 0x2) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='memory.swap.current\x00', 0x0, 0x0) write$P9_RAUTH(r1, &(0x7f0000000040)={0x14, 0x67, 0x1, {0x2, 0x2, 0x3}}, 0x14) [ 522.199795] binder: undelivered TRANSACTION_COMPLETE [ 522.220430] binder: release 26043:26054 transaction 1395 out, still active [ 522.227912] binder: undelivered TRANSACTION_COMPLETE [ 522.239946] binder: release 26043:26048 transaction 1394 out, still active 03:37:19 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) lseek(r0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = socket(0x7, 0x7, 0xfff) ioctl$sock_SIOCGIFCONF(r1, 0x8912, &(0x7f00000002c0)=@req={0x28, &(0x7f0000000280)={'ip6erspan0\x00', @ifru_hwaddr=@local}}) vmsplice(r0, &(0x7f0000000240)=[{&(0x7f0000000000)="6641b88d35aa343cd4eca96f1eb74cf80b98e8259d9d6675517950a58bccf07de1c0106105ed5d10754f0a66d6956f840fa7af9deef8571eded5cdd111ef897e6ebc1df0c0d788041caab5d7e1fececeb3088b972a6a7b2ee753bc5dfa2e2cdfa2fa5b84fb04a5c32e28cca85d690db05d480505ee6bc8c01d49b5fba4e4cb884f7c52bb8b6992edca644e424d9e4b118224b5ad1fc3", 0x96}, {&(0x7f00000000c0)="2a5f1091f7db9d3cf6a140b69f3a28b6cea3cafd720c49184889eabda2b4c19d389045b0d3c3acc3288f87a14cfe36ad0bf1d6790175a69d3905843639d8b6d19cffa6476c3e67ae2889c824cc55e3ec416765cdeca5bfe0", 0x58}, {&(0x7f0000000140)="ea8d1d8a34faab152bc9aa5fbaa5602951d36372422b05186c290a44e85b4d217081b2eade32507674063cdfd37a635438172bb66bb2d379dc3681c43ee92088d9e41924a3cda8c8b2595661ff65d6922864569b1bff3922b569aa3367f0a2de77bfa4bafcec3878b01547daac89e7b9c5d63e48631c240545c6ef5cec22b032608e204164bc2c0d71846b97d3779cec4e6c6d5d08f872289ae943df0e69755e2315e1fbdf208d270f2a3a6274ee4b0b59fb1619bfd137e640d7611680bdfe75c643f4433da34e9de9db5eebfda98e7f7f024496a468910eec7a47", 0xdb}], 0x3, 0xe) 03:37:19 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x0, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x48) socketpair(0x1, 0x80000, 0x7fffffff, &(0x7f0000000240)) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f00000005c0)={0x80000000000000, 0x7}, 0x4) syz_genetlink_get_family_id$team(&(0x7f0000000180)='team\x00') getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) getsockopt$inet_mreqn(r0, 0x0, 0x0, &(0x7f0000000300)={@initdev, @remote}, &(0x7f0000000480)=0xc) getpeername$packet(r1, &(0x7f00000004c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000500)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) getpeername$packet(r3, 0x0, &(0x7f0000004d80)) getsockopt$inet6_mreq(r2, 0x29, 0x1b, &(0x7f0000004dc0)={@local}, 0x0) ioctl$sock_ifreq(0xffffffffffffffff, 0x891d, 0x0) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000280)=0x32, 0x4) connect$inet(r0, &(0x7f0000000340)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) pipe2(0x0, 0x800) ioctl$EVIOCSABS3F(0xffffffffffffffff, 0x401845ff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_opaque(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='trusted.overlay.opaque\x00', &(0x7f00000001c0)='y\x00', 0x2, 0x2) r5 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x8000, 0x0) bind$unix(r5, &(0x7f0000000040)=@file={0x0, './file0\x00'}, 0x6e) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000600)=ANY=[@ANYBLOB="2b29d4ca3da11207f9e7ad7d6bcf629febde0a7d7aeb2ec2ca69f00ceb7652e180f249706db382fdee03025aab7e626adcf0ec5fe78d5302b08b25590eedb157fbe440e7c5fbab25051f0f19556679e9a2d789a528609afca507c3b12312e3313c28929d05ac0552606cd6afb296d36ebb12c7c9c4ae2f56827a93e9c3c8ce87c49fbdbfdf205fe203820b8ad27616c3199ea70483a9c3f67ac51e4676b3968c2e812846ec37cc0a62831b6926d5ca5bd6b129943604d127e4ed7cf914b9d0872b539d798c"]], 0x0, 0x0, 0x0}) 03:37:19 executing program 0: ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000000)=0x0) ptrace$poke(0x5, r0, &(0x7f0000000040), 0x7) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x803) fallocate(r1, 0xa, 0x0, 0x5) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) [ 522.259364] binder: undelivered TRANSACTION_COMPLETE [ 522.290987] binder: release 26057:26059 transaction 1396 out, still active [ 522.305644] binder: 26070:26074 ioctl c018620b 0 returned -14 [ 522.322761] binder: unexpected work type, 4, not freed [ 522.331442] binder: 26072:26078 unknown command 536872064 [ 522.339328] binder: undelivered TRANSACTION_COMPLETE [ 522.350713] binder: 26070:26074 ioctl c018620b 0 returned -14 [ 522.350943] binder: 26072:26078 ioctl c0306201 20000440 returned -22 [ 522.365159] binder: release 26065:26071 transaction 1400 out, still active [ 522.383173] binder: undelivered TRANSACTION_COMPLETE [ 522.393551] binder: release 26070:26081 transaction 1402 out, still active [ 522.401408] binder: undelivered TRANSACTION_COMPLETE [ 522.407298] binder: 26072:26084 unknown command 536872064 [ 522.413281] binder: release 26070:26074 transaction 1401 out, still active [ 522.422617] binder: 26072:26084 ioctl c0306201 20000440 returned -22 [ 522.429703] binder: undelivered TRANSACTION_COMPLETE [ 522.432750] binder: 26069:26085 unknown command 536872448 [ 522.436772] binder: release 26065:26071 transaction 1399 out, still active [ 522.464704] binder: undelivered TRANSACTION_COMPLETE [ 522.466844] binder: 26069:26085 ioctl c0306201 20000440 returned -22 03:37:19 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040), 0x4) sched_rr_get_interval(0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') 03:37:19 executing program 5: r0 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x3}, &(0x7f0000000080)="8a0ba6243eba81994babd10fc66dca724ffc45540ba66fd0ba05df449ca90f7d2fa989cfccf521bb100cdaff1cb6bdecb830debf8c9d2df377d1d5797442a94df9b7f2e0761fee5229ff2b34a5d4c77bb004d8909c6827d50c18308d5ea4337aa0a95e2dfe3d175583cb547b63aab2dd536f1f1db5f32f2d84273886f31cf47b8212e4bc056f8dca597498b15b4c289b07bd9914fbb8f1c1a00a7d5b0f85417e9f7591", 0xa3, 0xfffffffffffffffe) r1 = request_key(&(0x7f00000003c0)='ceph\x00', &(0x7f0000002740)={'syz', 0x3}, &(0x7f0000002780)='@\x00', 0xffffffffffffffff) keyctl$instantiate_iov(0x14, r0, &(0x7f0000002680)=[{&(0x7f0000000140)="925d425d546039664e4563525da758b58df3212a6bd92e37246e98990b8a6281da9e130a961f3f9fd062456fc0490eb2bd10c148ac0592aeca6a4aac2989a9082d1a73561ceaf7d87168faaf13200b9154caffa56ce854412dde3a8e584c5c6835b25f8d64222509309d092e305c80c73311", 0x72}, {&(0x7f0000000480)="4fc067315755be11fa80f61fb57e1b81e823765199037e84848bde17b43fb9e51af2e380f1da79fc547e6e2979348a2e5fd2a351cd62b5fc77126a4ca41e1393e7b18d175e75128b4e2c440563bc415ef418bd4d369102ff0db1ef8baf848c616cbcbf9772509c99b92d7fea79538cabd2270e1f2e63c9cb8210765463edde6771e09f7a7eee8ba866a77d641c485f2d11ea4a38a44fdf3f9e25d97a97af59249d3b7bd8b1cb5537cf12f7fe889710d1aeb9593033e3e9295db0c4f1160840d1ede8078e11fbabbddde71e3d4c15d36eee5cd9d8ab7f137c13a60df494d20cb5bc0c640313cbb391bc30a40c2ffb012b7f852eae0d090c20e43691f5506555cd1e79b93ef2e9e8097d6c780987687709491c48600b02c2fb72f52466f516f6a7d107e54d5d5e419103e239466ac7a4a8348921b744e761f5d0e6a1ec891dbf96d483115ed366ad61cd87d9d717176e10d93bbd33872f30186b92c8ee15e1ebebe8c4e4b36ff1a20fd90ccda5489b3dbd402c495cc465c86e6f32a2c194c74d449db39d2d0e818cc8f7b6b64b1cdf9de240027d07a153fba4d8f406229796e9098b3fe9884ff9d3ab941989842d7402c944baf16f07de507c6f550613f3031a22b56abec9bdfd3d5dc10f0c1119b20ffe6a02e4bf7fd39cb63a38f7a37fcbb448ff15dbe2695aec944f86396a36f1266cee225aaa6666285ae972bd972d5a67db5ab6a99d46a714978366112f095bfb740dbe4a1c8462a932182f2a89cbd0147d9cf7e6b3abb82c4ba47a223fda4c32e09eaa794d480d71629c943704460f338dfd76b6fff1d240ad51381b534b1681e1bbdeb4ae67019709e195baea321b78bdd0406c158945402a9862b27d6d3063d30e5e167db6ed76279ab72481e5028157af24ac3a373e621cecde5b1bf61ef5ac1641046b8fc47d04db62035b6a2f738494ce19dc7db4df49d01df969ded9f5dd21498c1f1a52f8e05c83a43808b9d66e86035263bfa47809aaee407f6780afed49c48aed2c86c9bf6d386370fef71981df097d62ad0b7b025db89d13ecdef8c532494e7f32489a8aba2900d0199016c3a86afa0c76bb9ef76de071452f3d2b1594b3e6dd802fd0724848572738492ce95d144c5c17301f8719366d769e9e3e03da75d09233be353ff2b16fb711e601efec03ad8c18fb9e2e9241a067ff483bb3122b24c408fef325e4e32e6cb9a1e49f5b741da697500a1476599f4253aa24c1da19a178174b40b31fbdc9a79363d734dbf4ac73dcf87e790ad3fe8e498aaab5e0d1dbf122983332038ecae539b5b4ca3027a0d7d13d254b8bb5391a72d8404cc05101a10badcd4bdc990b0e4bcac4dda206fdfb11bd61d2ed2a28ecd44577179acf6016c98712e83b4db0d447b4c44da1e7f1996eb94fc17624847f4f9cda59835c111fb6a8b054f664da34aad5e784051bd19d7905f42ea343ad2d451c595a7e99d902eac6380d4d73f465494a60e17f537da4dabe8c9281545970d9474897ec42d3cc2fb3e659bf11daec4152e63e19b55739ed1f5385c62c1ca5a93853ef1147ad14f3415688a050d9cdc166239569bbc86b6c1d95778bf51337c8b515f15ea690a10941822243a1e26a126828c0b9c1cd4c314397e52d42fca4f4c64376df5441f4804e5a1b0d41d7459e7d17a82c97d0cdc36346856b1fe216fcba976fa8e4d607d8684706e1469f6c35eb96118d2d668ae64cd865ae8e16783eae9ed33cb984b3e988e4fb8a11ac0eee559d273b470997542ba4ffc69769a6f33d60db8fa552815decbd2b23797fefafc2216e279d388ed396f28071f0cdb90da0b308cd923becf071e551b1487bb6e71c8bdf5ed0fd99a763d0e3fc8df35be5f938aaa50a40aa2aa37dfacae5c45868f3c827a069a581d8aab644125d24c6ca3a1819886734898288aa0daec6fc3635bffcfb5a0c5323cf9139c4681295080bec7bb8494f99499a3c90ddbfe21c4b81f49e7305ab02a8d128c89c59b0188108516b02368a54010a66838a969cf90e8bf5b530798de15af01f7ded5caea8d78dd93029d3505cd9cbb7882a68998c9bb7e05af2e4c68b6d58e37cbe608088f2165aad702a2ea67ed627fff8237836aadb16e37ac7e92c60ab6801efcf899ff698990b7ef816382c30875ea88e917ca25ba70891032f7d24bf823748e15c94f2c7ef0fe1c0293e443ca1e1ce1a7dfe1983d27d550fcb8d4da95144d37cda344ffc5f3326aebee7c621ba4b0b30ac623b10aa46d99197a3ae637a65f31e4f6414f4424d4c83b1885b2a88ffaca8ed91cf9cb2be1d355a05ad8f77b64d505bf442528f1a7a95330f3eea089f86375c77df536bcefb0bc6f3730727cf11321952f692c98c8bb5d977315cb88288ad339d59d3ef8f85b78dc441205eeb49b6b242a347dee5c77827a1d59c46a71d3d357b6a3db16e99e59cbbc8f7602e131f7cd15450cdd2b898756794aeda05c05f42ea9b5b3e1b6732f87ad7c26e0c2d3a201c2a711f8cc2ce09deadaf06840f30a6ce3e73af413715c9e3fc8f760dc9c871a8795cf217b175d937568c0688198f80c8cadd5e009c0f26b4259114068f5c30f53dc821a6ba0f937e77d58d4dcee429e822a599866f6db8563cf2c6b912a3995355787086d57fe419009a20a6886d9e3e14d715b175e9bc405cf21c08719c76a69f6f4fbb8caf7146f51f75c86895cc11dc5edd6e784b92ccb6a2baec9c142bb85dd88b1573054c701e17852299f6f771bbe95bf02df45b5a4fdc12fc95e5d2fa6794eb0917ecec1747caca6b9a10b3e9776343da3fd4cc4b7167d50b102fd33e8657b969b7e97ee65604873eedf53bc75249ef41d8649b1e39bd77775e7177c3f3edc64051f186f9853e46f8a3ca342ea71f264f0650b064cecd2cf3e0bdd97d5c17a3d9158871a3aeb417a07563550c5f59b7e5fc7700478f3909c4e8991773df248bcf2bcbb5a58b4c900c2a0793dbd153ac9b6da43cf42adfd77c1c58841f81bcb0177e85a6e486c4506e48a4203caefd81028904fc08d882d26987e401900604e6f7719e28007cfdd3ea22ee9b8f2972eda5ca573dbfef4763484442ca1c0d3b92041d373258ee71eec61d487666c8071f64a70ba9fad3997c7840e85b0b65fd37a773de7db684d8dbbea48277a1961a53093f71f199a7be8018bcf505f53c067dbe6f72e40b357a065c436ca7b291f125b5757eddf2ee7dd498710648325a1bd57af6b1dccc7af13fff24920ed197e37d4cf8dfb6c81ae32a90af560cd7758604eec82df1850015754a31163944bb0e853dbeb2443a9a0fe22bbff134a95d2d2c707e72de95f66a3fc9242b84b3ce1e40f20124458d67f959be464a24bd4cf0e06e6a7782eaa43064e7adc327c29231fde72d4869a373fdd11937b94c9998a1153277633c5395de0bebf808adcb6e6405830698534d929004634753e3d9584b18a8b45ed6b4947c94322d6d2bedc1a7c10172d58d6f4ab42a0069b79bccdf398df5e38b24a995f44004e5df2770e37aaeac912f1fd9a9a1e14d5b1a281611e6d5dfb8b0b7e7b91c87e8ae8807e1541a75f609023f9badf066a2706e25048b1d0799bac1eefc09749f6d8f6878031cb50b026f520c2ca98ceed4e5f78c766583ec9438e4f7fd92e54fc4a0623f843ab96144c3947962edd620857a0455c09b75773d263d999a3f214ed020fbb986f34c6e04d4199018526de19d3b9bef77a0955e92e3881dcbccadf2fc887b79cbdd7340e7bf1bdb50b7d02444a5874184d9360a12709feb18578b9d477d8cc6acf34f8611a978aacb8c9ea3f485107c8cf0f934314fbc3ddf9a239d2e6bda2fb52d04e6854cf05200946cf9b08bb28dada971be408618b913339b2373a589f34ac9603b17fae094fc2c685dc8e9e7702d74ca72204bba309bd77c8b043bf7aa5288ff8ca037f66fa72e1d65cb2b79a4151ce61e922d3c5a2d0c9bb683ebe7d5ed0cab82aea463bbc29686ede056ea74dd01535d7fe1ec089104854b92575c992390b88c2b062a7e9ebc13fe0bbaa5577b8bb877d1b7a79fafdcf33263f221b7e7b2c02aecbb042f871813babfd7692e13a2c9c765b6b0e60a09926d062f496d875a1de157729a5037aff73da1529553ee52e2620814b0a1dc652c1b555bdecbfc925f73c9c5b4d985273ab65d38b13623d91fc00483880da035cb68c72009c34baa31ec3555944aa4d8f4e1e4788f987ca50d7351fdcedaf631f853a673b27420dea759ec88f0bc2d1004b55a2df1238bebde92b27a36332adb385456d097b3df927a4d78b89e07c32cdbe0d3571fd0039ea0a741fe0dab0423c2509239566666bcdde79068baaba5e1379c203a87b3b52699a06639c90d51b6d68bd2c07e5b5758b0ffefaf00c5b132e5d2a7ad8073aa0a669845dcbe1137bb43fbac94c287ab9500ae80d3f7424c9f4396a2d217264304b95ae5adaa0138fcb8814a274f6d4ac8adcb36b7c2dc8f97f86752fdbcc0d30a47b21a3c6997e21cfebcde0392198da8b326259c8e138eb286b1955ab09f6671099c9a065e4e18a7760bd759f13729704823941e13a0600e1669a363108164e109c3cfbd72601751caf06a5ff25b75efe5f4326cd81f92c7563df92eb4364e56e8b9c98b730814b9ae4b32e6f39d16db72f03c2b2501c0c87e2dda664d24a3d8c6ab9c35f57da2e6c90a4bae87d4fd078526f431500e3f711d73db44c70410d77b1e6ea921cede4104aa41aa2dd27d1662b19a46cec639ba149f74ba30abcf21cad04aa9e09c9c2ebee90d9e58d3fcaa9606cf3c4c654055200f272538d8a392b393dcbd2d244ee756c6818aa70432ee8768fe49696d97bfe999d7359c2d6f9d262dad23c054e014e28abeaf96e0508c9773b944ba0854f61a0977845b0da4451f84ddcc3b3df081e4e9a3b7119752279cf6589f35e6672b6235e2418705d9f238adda44041eaaf27b1c99edd197db81c361356a0eaa0f0e8f6c43ffb2e1ae5752ee09e30db485bee2ac99d8f9b1c8aecab17f7e65f9304f6f0c84e31c1777359b7673c438c5378c31464de32998cfd4c4fc003180995696c8ad83db46037a0a7bd624c30c474038c5c4e78db9e7e2b73167a65e664fdfe3f65fd732cdb9bd5ca9142bd17af8a1720e6a6f0c6d0f3d4a6f4388e9b1a3c8780f91412d6e5b719c52d804dde7518903a5b2487e8c9f94817944fb9668d30686847701083e5d2bcb8feda2c856bb236e4abc595590f4851f9d15dcaee87286c5e689383e2241eab724dc4f7856f2c397f1c79d390b07a3a5f4a058d40f88dd331787bcbbde559c0b8181a302a06ee21facac5d32afd2ce87be6e659c2193b5a259ce1a55ada4a12334dd9d9f02f1c70dcb6d6fd6184089627e778a97f69b670b70780649776023d24b65b7ddcd7da0a65a4765761b4687bf593095876499d44ef5d5aa5e648d79d99894ba739297eb2187320c7537bcf360ffad42fce39f0e9776bef29cc4083dca71fbf31a677a088e2f2846cad0e495304de54051d33bc1209fe8d1bd3010e804f50c797d67538a92825a40c8016b63f6c3460955ec27c2a67680f70f829c76109fe7ed1d6547140b30c5222fdabb738d7c2934708e9075380dbf768a0160164ff0e8bfbd4a85a144aff42791111eec81bdf4199bde9747e3a619edd611ae995738d05d85f95e7034fa991163bf1043237380ca0d6f382dcbb984e1f95f1e70f4b46c9125f101a8982d187eb036fe303996ed2258a756e7e21742f1cbe4bd86a8e75c44c6d5e71d4bf5143018e1c987bfc8a304ed", 0x1000}, {&(0x7f00000001c0)="02dc3d88ed7bf539bf6d337599a50e8b4f6b8fc27bf5400f3d3acdffc81ea1a67a8dca31bf56e614454e099150b1685df1430f96eb4e8cb6087cf079581398ca789ab40c63e2471931a7c0a978170ac7f267edccfa55ffe5ad00f63ef917bde9523f053687cb7c76dfcce70a169c2c60876a5d0eb0f66453a8784646536c452a0a6a08f8f0e998181ca2a8fbaf69300284a37dcbe39a3faa869278d1706013feb0d6f02296ed83bb3e", 0xa9}, {&(0x7f0000001480)="00ed679aec95ef977a75a630129b3367c55900e4f4acfca24fc0ebdcd310154820c893a6788713da71ede43e0e0a911a7a9877c78f216557a1f220b55516e565794a6aedd9a9b57cfdd287627a483f30534fb31b34d3b1cf0e6d7dd508416ba5a55ba55456ae396f37c0497df72ed2d0962c5bb1e51e85e570209764431ad76c01b9e5af72e8fda14affdf4892bcd9a188eb1974ce6a4a590e4c715f016d34cd46d6b43f24bf002a28a9690773623c480d11eb58bdc8124b3188cfd87d42ba6ad09103df70844c7a6e43bfdc768c0fe4edb5", 0xd2}, {&(0x7f0000001580)="465dfad3b8342fc4a36c61adce75d35a33b1d3c8d47fc86501e2f9ceea2a51a16c743afcf48243a0930bf639c3eaa5800b17b8230250797f846317be27af0e106d8dff1916ecb7d0fa8950cd0d6e0b15b9ce2c7d0b347959fc4586d7b13dccb337fd9ddcd104342ef6c94e650039bc768349f669bfdea273492f814310924d93f2978c8eac6bde9b4ba6c52ab2bfe815cee4158f1eb1a149880b7815dd88700eda9033cf56303e3264c0f8c198d4f3defd9c361b6f50d0fa313d301357a1c7c6b4dac88508858730ee01a0766f09656ae29b633ad7d33127a47221917b7fb61b6148eea61de22974a6d7d5ee1c9d3bc44d8b8d4072980c134b41838872387e6c3bb60bd05558042a7f1e5f9655139c07e6dc4948606f3cabb41dc4744698ed6e0e4014b510eeb06f26aa5b10d8b21db98e396f8ffcda304497d2050ef7ac3ce586419e849f792f45678f7ab3eb8737796e7c3df67e6a95301741dcbd123778761db1bf151624501b01f7f4ef08b3c16f3103e1371b7c8ac6a7c739af79fee99366a5e0e4ec7b1cfc351c2f6eabaa7ee38289110235dc7e7aceb36c1e2a96b494127034d67afb84b25fd12c41a98401f821b50121b3943e48c47e3b90395f641444543d283c25a6e6e096b77a7e447a717c31d79a0c6b00d06f1f54ef2a8a3e381cb1a9d0b8addc72934a177c36d0d56554d180aef09bda5847776d0249cd82594932fbadd8d6db27ebb8423c6d21aa666adc010baf9debc10420a64bafcae107513feb95b9bf71aae082649a2885bcad6e3868bd1f176113ab6eb86dfc3170e5cbda6af75fd55872ff01a29611d61dc13100b0e2437cefbc554c7c305eae5e7ed6684ff62aad2e389c78efab32e691ac27f17a9394de8952fefbc6df1a5a552ee36b00d5ba5f1c1dd29e01fd9a1e7ff4aa1fc9e23465fba15f4cda571eb9bbec7081a328efedad79031f80798c36ac6e633eed400af45481f7e5a9dd7e753838f5be91d325e8c3351212e43cc9f6d6e75e3bbdfd07de98f01562dac70ccbd86d0808bf8306eb064b77344a07ae12a00c1d3141c88259f6647d0b60f505a7deb0f587a0d6df2ecd3e193f3905d73cab80f6804d6bfea9d10c651bcc99de35e85f403261099137cedac2a49715541434c4a2b579c268ebe6161c0113df1adfa01ef55ddf85a0488c08ea815dd50b37f5bd71591bdd8f6ce8a4b3828a15ce8f4358773dd1053a48a76fdab5e2d243fbb6445a1fb1af666759e35561ed35431f54a0ec3ba68b82454eb0fd5a0c9e913714e46853fbfcb0eaa3b4efd7acf8aad704053649a4695c64ab6330da00c5de56332a68ae782192841dc4bae0dc93b005adc920225403645a0f5679ecd5b19140e4693cd7f6ac4fafae6afd4cc25d3ab2893d8d3e1fa97924dbce0c45d185728bae5bf61a0bf5608566d4ffe353759d63a7b27d5107bbc3070b5536aa4d097906a0ff65f7a8546a1e7791bd54cf72653b51f0d533a98990a48fb1a31c954add58a6649018cd6e7492083df91793c29f924d50764c863270445d7961347d4ab0ef45f5f0750bcf207ba1d3805883a6a28d903fef6d07f3b36b93d35cf6bff83679f6ad35784981a32509ab908101929c2502088346b46b6ed7123966b9fc15ba00ccc3d854f9c5a2e458fa1fb5c708d0011de0bed34a5ad1085da2b6926ebecec7983506e72be7e64c2100afad0a5e743cd40993b8a4a2cfc1bcb93ca98b0e7942b2d5bb9ab6e8e2edad0e513fcbef0ce66ec8d43cacb10c6ccd8108fe495c7cbaa7345c5721540f74c63b1ae69cef3f2e781fdd9a42fae20dff69f37f5ce0ab4ad10bf16a9112af1888033bdf87cb7fb13f95bef6cace3c2d538aa4a19098683b23b02b9231b0682895a5137de4a216b6c5ae6d509bd4597ade7f72441e42d5409f6a82b714088b66a9db85c12983f28ea03a7d904cebfeeebaba13b95d5ae34e0e86bf3cd8069c8577f9ee298f9d2d1fd837e09681dab871ffcc4f279656a7d1eaa4bdfd081d5654ed2e3a799916f55b1fc221b8da9a0e2fed437b7c8ad23fc5bf8e39d9b0dac6b9ac112540a73d4e11201072d7ed66308dbbfcb692804e592a812f2944670a0a28a5121a29decf2ecee29e116125392e319daa685ede5c2720cad61bd0385c9bb020bd58b5f6f43380c0dd7d01c17db9bad7f7151aac7b457258e1cd55bcd47effd1b94acf120de55913f12e456ef66dbf6e02ef1091180b631a7b6cb5a31a7eeb9850d666ffcb4bf279b0ef4a3caad543f6a1ebe403572ec511bcc97845fb59c04fdd62c5b9bca57cf31cbc8973d80f97bcdf86d2cba289928e053226e5b709767f780fe22cc395353ee3ba68c568ab2c361b1584746df6d383684fad04f66cc1aff9e3e2e936e9f42260f0432f7962b4ce4e63b8c44a063a500f382d87fb15b0036d9bff232d60d005aefb41cd64455a8d0907e438deb644be5588bb58918b39384c7db7241c745b320475deafd6e11c620bcc163f99d0fa92bbf30b27c81d872cbc5f3067ae5e450089a9662a0965f853d64fc773c4bcccb5c6c4a8e9a7c9dabb87a41f7920b81a7ceb9972f78b963bb90e63d6de8c50982fcf8ce52e51e31acec041ba009dff7a2cefb71966b0864b6ca14e20c37b86f226d608109e4c1f9b7e118887d44385a6e4ee570b7227085929425cbfa565067788e4874e9c23f0989af8bf0d9d4a54c9284dfcfdf422e55d002419a07b95ffb8e56975eb192d9040d24a98fa278a23bc82f0b8eb815e704a41213d0225be76885fa417054bbadf0b90530f8c3cb6d9a675cda0841886e9d06a1626f959067b6e57c4ebd4476ae9bd547b32978166fe8e7c9eec0a9611028b058873140dccee5efff0017efb052bcf4b9d85662d35f4f0bdb374cda536f80acba739ea02a6741dd33a635a41f1c3110a7816f704c1d5dcdc289db10f193485d77119246ed24a3949a62f017c02b43b4ed33842a50c5b32374031b11e5d8381c4361e201727beca5148bff0760160a608c5564414f7fb46cfa4d7ca8e5706f792932c34021ab6de87b24313e0f026da1274126fcc8bbe1a68b629f64409e35f9a89085026a9ae6e4494029f17720d7dadd68a196bc6877869d4b4b296ee7187e1bd2e9c51555035784b68fde7db1ec027a4e7f7becb3b6aa41c2e8bde5b519ceb1626db2fc64867aca7f3853b21fc69487af952bcee3cba51112db13cf3961fd96900a604783a81f7cb4cf00103d3b285e96b5d4bf6c110bef03330f75ebaf91dae5649b0336f44fff5e0fbc9bae7fc7766a65c17637779cccf7c31be874c501a115c4fd6bb06943264e4f6429b536dd155293e41e22e7d3dbe84dfd85e1e17461aea78db7607eeee2a4b597a3be4af3e236685ce766cbe53fbaeeafadbfab37c588cca08d1c3b10c944dc0715732c27e36b3a554bb3432ca21243b9f762cdfe8764af0fc1c23ede9f49c58472823b11fdc4409ed2524da5efcae684f9ebd791efcf74e94f1b9ae4e72e552feb589ef99694503dfd7fb3423d057db25f035480284638c5cc442c44e2c6acaaecef3ec94aa23c425838f70b5a8a5e8a7207ffc8d611a74e8bba72124c7fd47decd33686a726427312834bd72b0b7ce4f724d14d4c3eb901cc27f20b5d6f57febd7694a4d2d3b92ff89dae412a079f982b28a51129e60006393d1ce3eb7a4c49ba745a0cc4da8deb6d44982331e6f7b08452659f5456a360a30412e6d3f3d80e4032e6ab4cb8118adcf66c4a263f8f08f7245b057780e692c429340f9b755efdcbeed052b9350918cdeae9fdaaa465cd9a6dd0934985b21789ef47dd9f923a13d53b17ab320b8f0fc574f5a2e1aa6bab5caaae7e83dfc5b31abef75221ded246ab045c63f75400c4590378952253c73aa05ad1b82c59d471d95b583e666e337cc4cca47bc15f32f181adfaa7b7822afd3912e8e759dfa4a6dd3f2d405b848bd5ab59e2cd3187b853b6f3310f6d87993354f551526990eb57c815ead08dbae9eaa6d3275b8bbbaaa5b582c233de462d3da3d73556073086a5847f1868c0626b51b7e1cd2cc0cf11cef9f4d22df6b68e0b731c71e0accf4ad56f056414e7f0f707edbf8ac4261a3b52dcb41ff1ea07034de9efd4b180a14324b1c1466b9835ec1ab766ebd16fed425cca3bb601075e81376280e081688e3264c9373e004bfa089f72c14af5f5dd69d04a61c323c5dd9fbff5c6af7959e98936603453e85797320f5997ae80b4fc3cbd19d6a4370d108e7006563c21ecc3f49dd0842441d9fe5adcbdcc82c52356bf10251c87fa50ba283adf82bb3bd0605ef4b3c08c99f17d069d7f7424d6bbaa6e86f92ae51d1b320975b182fbc28ca660f77f41d8282db2a7849bf3fee7e6b9cee8c78b6817d60b6d38edfb634f91b48166e9d1c7a4fa7ae10a2ce2907ff83372deee8b8a62e32eeced59a7aaa34e681d9d896c171e9ddb247adea9a31906ef425d68badc8f1054e5ee2ccf0cc6f2ef1bf77acecf6d614205c0b48e94a79539d14bb25012706337ce17436c8815c77fe38b89e71fa17b43983bbbbc9db55be6799fb9615a6ff743aa9cf1e8509f4c994e0cd45d5897179debefe2ec61fc316b64663cdc8e8a17d6a03933b4ad16019b8f00d65de64fac6c1e4a6ee6a8f556f5dcc288ba81cee63fcbf54a8e6fcc4ae57e390f7cfa179c8acdfd75e73dfd376f602479b9736e345d1853481de2b8b6815d7945f07d16ebed88b48a0de6e3269d7aca0af7d70a7bf4ed47ef6dbc1b41cb3b98342fc9de86197821f5927724aed4b60314e4898f2725782a1d05d9fa4facea501e1bcbd5e76ef488374c74ec3af6cbc490ca7b7496370e89702ffc1ca9f2471a63438b6a39fa4f8cc1441a8872ad84d18a3d029da38e7fa997f9d49be81bef65badac8e2d2ce9975f9109948e4d94edd706c051658095f0b583dad4a8496cbe8a51d764260ee4b885c7cac76b977fc1ac0e45f32ae2adbc5cfb79de2ad84902637833816b003f167a02f960cf353f8593c9c5efd9e2da380cb4f681173995aa5f9b6cacdc8fedf3eb685745599a4b5c8aad290bfe52c3ac3c4256087e6c095d068dd91daf5766c71fae6ae97a4f33e775ffa278a276a6d9f1ab62fd3b72b2b4b4e2f49b108d6c19b046232df71f0eb60b4cc2a1a88ae4447a4b0ce5794fdc979d3917e7afc2db2e79e41ec8594be33d37af328d717f0e4b60b231f0182abfe4b1678e2a9374dcbaa7d6f17e2c678db0ea5cb5b616597333d882493bc4cf4147eb351e20d189498ac9c3869dcdf5afadde1454dac01bfbbf32da3b3e7b0f266c839977aa2e18c742db50b56a429c6f42493719c96a756cc78575933af65c57f66e98051c074a3eb9044646f232c7ec0428649f3ab5e8e1b44d428455d8ce6df82305c3dda4136695f4d6904c407ed2914075426b201639bc1170714c0fee7a18a15f379b85dd10c2da02611a1f35b36d2ace757a9a1a5bf9036980cb03333f414c54639c3e635a4cc75c3ab86c993edb405cffe2ff0d4cc0c29742e7db4f039faddbed3b6a546abba3ed2be05b70522332346ffb2c804810b0570fa9316f23789c3f80a14c490b56ec3f216359efd660932fd736e9e1485ab18298a59be02111f3e6fa9e17addb928cfff493280f30729533cd1192280beb5b26632b989b9bb18e9bd1b351b0647e33f928feeee7cc70792a50c10e9f015e45db11800a660e167682eebd690e6e39dcc61e1b64ceaa6f9a3ec1df55ef45d838a28f0474f1bd47b2d4f3cc679f80404557d712a36cbb45fee457295d39", 0x1000}, {&(0x7f0000000280)="ceaa3896ac3d5de218d9697905cfbe83dc38dde38eb02627e7", 0x19}, {&(0x7f0000000340)="33996dbe53e18bf2683716e55e50e07ada31d5fcfdca4f0142b8d20a12433c7f189c6701bddd52f102439e76ad09db72ec0038281add9c8127ab8d4cd6e7ec8e2e00a6fdfaf6a94d65cd58b00b511f52924867bf1b418af8645698773eb72318f223fd024e3d5dd50ca48b4287cbe8c356fbf9a1d4b08fc5a9962d5db5", 0x7d}, {&(0x7f00000002c0)="fbf256dd99e46de304a7cdabac1a7cd46e5785cf79efbc777bd9d260c02942325ffbc53164e94128ae", 0x29}, {&(0x7f0000002580)="0855e335eb59a93537593ee79817f8722c380417dc4146bb2601e2eaa51595a5b85f92699e790e9bbf3f5cfa239e9c5c06aeb3e8625eb21b81955222cad83fde768f8642247cdf6bce39ecd505ee8694fce243dee6cd543317162f393a851ebf2c035bacbcec9eb305461453de6d5f7a859906c95c8e7e188152a21d6e3adcd8ceefe74fe5ae903d91091ed1c4938413b9182af2aba812a89a66ec8bfc404ded83716cc99ff1dba95f1415df00d3f8272586ec3aad8c4cd03fe744bd38a5a3ecdadbf687733fea5a3c07aaf614e7e5e7426acaf51017be", 0xd7}], 0x9, r1) r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@', @ANYPTR], 0x0, 0x0, 0x0}) 03:37:19 executing program 2: clone(0x10020002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket$inet(0x2, 0x3, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) fcntl$dupfd(r0, 0x0, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:37:19 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="00bae4ee0fcdf8af3d8c0b570e9154ae24e9005ae324e4f21eccf0236cc47c2b2409ac991c4232ac145e29c4bbb245831b10e3a7ad6c9232f62000faed34f46ae742807c7db1244f228a3bd17c000b4407c591deb2efe3a71be58862cc9314ce9b18bc9ca52fb80973b4ec4af566838bffaa241331d90181fdf2c3e40b5fe6aeea499ec39e5a26c84586aa215520df291304319052ee7a032a200a44c2020c18bc9d0248c4eac127b3108b29dd4df9c27cda6628a6"]], 0x0, 0x0, 0x0}) ioctl$FICLONE(r0, 0x40049409, r0) dup2(r0, r0) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_RESET_STATS(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x50, r1, 0x2, 0x70bd26, 0x25dfdbfc, {}, [@TIPC_NLA_MON={0x3c, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x9}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x8}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x1000}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xffffffffffff7f22}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x59a9}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xfffffffffffffffa}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x1}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x805) 03:37:19 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 03:37:19 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x0, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x48) socketpair(0x1, 0x80000, 0x7fffffff, &(0x7f0000000240)) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f00000005c0)={0x80000000000000, 0x7}, 0x4) syz_genetlink_get_family_id$team(&(0x7f0000000180)='team\x00') getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) getsockopt$inet_mreqn(r0, 0x0, 0x0, &(0x7f0000000300)={@initdev, @remote}, &(0x7f0000000480)=0xc) getpeername$packet(r1, &(0x7f00000004c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000500)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) getpeername$packet(r3, 0x0, &(0x7f0000004d80)) getsockopt$inet6_mreq(r2, 0x29, 0x1b, &(0x7f0000004dc0)={@local}, 0x0) ioctl$sock_ifreq(0xffffffffffffffff, 0x891d, 0x0) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000280)=0x32, 0x4) connect$inet(r0, &(0x7f0000000340)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) pipe2(0x0, 0x800) ioctl$EVIOCSABS3F(0xffffffffffffffff, 0x401845ff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_opaque(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='trusted.overlay.opaque\x00', &(0x7f00000001c0)='y\x00', 0x2, 0x2) r5 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x8000, 0x0) bind$unix(r5, &(0x7f0000000040)=@file={0x0, './file0\x00'}, 0x6e) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000600)=ANY=[@ANYBLOB="2b29d4ca3da11207f9e7ad7d6bcf629febde0a7d7aeb2ec2ca69f00ceb7652e180f249706db382fdee03025aab7e626adcf0ec5fe78d5302b08b25590eedb157fbe440e7c5fbab25051f0f19556679e9a2d789a528609afca507c3b12312e3313c28929d05ac0552606cd6afb296d36ebb12c7c9c4ae2f56827a93e9c3c8ce87c49fbdbfdf205fe203820b8ad27616c3199ea70483a9c3f67ac51e4676b3968c2e812846ec37cc0a62831b6926d5ca5bd6b129943604d127e4ed7cf914b9d0872b539d798c"]], 0x0, 0x0, 0x0}) [ 522.859840] binder: 26045:26050 ioctl c0306201 20000140 returned -14 [ 522.918696] binder: 26095:26099 ioctl c018620b 0 returned -14 [ 522.922594] binder: 26089:26096 unknown command 536870912 [ 522.926175] binder: release 26091:26097 transaction 1403 out, still active [ 522.937669] binder: 26094:26103 ioctl c018620b 0 returned -14 [ 522.937788] binder: undelivered TRANSACTION_COMPLETE [ 522.950729] binder: 26100:26100 ioctl c018620b 0 returned -14 [ 522.951676] binder: 26089:26096 ioctl c0306201 20000440 returned -22 03:37:19 executing program 5: r0 = socket$inet(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x4e23, @broadcast}, 0x10) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f00000002c0)=0x200, 0x4) connect$inet(r0, &(0x7f0000000780)={0x2, 0x4e23}, 0x10) sendto$inet(r0, &(0x7f0000000200)='\x00', 0x1, 0x0, 0x0, 0x0) recvfrom(r0, 0x0, 0xfffffffffffffe9b, 0x2000, 0x0, 0x85) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@', @ANYPTR], 0x0, 0x0, 0x0}) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='oom_adj\x00') r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_DISABLE(r2, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x42008040}, 0xc, &(0x7f00000000c0)={&(0x7f0000000140)={0x84, r3, 0x10, 0x70bd2c, 0x25dfdbfb, {}, [@TIPC_NLA_MEDIA={0x54, 0x5, [@TIPC_NLA_MEDIA_PROP={0x24, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5ed}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}]}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x800}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}]}]}, @TIPC_NLA_NODE={0x1c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xff60000000000000}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}]}, 0x84}}, 0x44010) [ 522.965206] binder: 26100:26100 ioctl 6611 0 returned -22 [ 522.971273] binder: release 26091:26102 transaction 1404 out, still active [ 522.993383] binder: undelivered TRANSACTION_COMPLETE [ 522.999761] binder: 26092:26112 ioctl c018620b 0 returned -14 [ 523.006156] binder: 26092:26114 ioctl 6611 0 returned -22 [ 523.008656] binder: 26089:26096 unknown command 536870912 03:37:19 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000000000000000000000000000000000000000b0000000000000000000000f3000000000000000000000000b85311ea3a46b7e0d789e7224d474fd7e3e736864d7517a492cfa8e5b39817e3c9923611ad48c65c0f"], 0x0, 0x0, 0x0}) [ 523.016508] binder: 26095:26117 unknown command 536871488 [ 523.026275] binder: 26094:26119 BC_ACQUIRE_DONE u0000000000000000 no match [ 523.030713] binder: 26089:26096 ioctl c0306201 20000440 returned -22 [ 523.038154] binder: 26095:26117 ioctl c0306201 20000440 returned -22 [ 523.051925] binder: 26090:26122 unknown command 536872448 [ 523.059578] binder: 26090:26122 ioctl c0306201 20000440 returned -22 [ 523.073076] binder: release 26100:26100 transaction 1405 out, still active [ 523.084605] binder: undelivered TRANSACTION_COMPLETE [ 523.097964] binder: 26126:26129 ioctl c018620b 0 returned -14 03:37:19 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="00af7415296a03c7bc8db1becd614a6e4e243c3ea3dca43001107e800837ef3b0caaef64da534502d3f895c56f2ef66dbbf4b04979e27e24e121017bcb83b3bfdf271b501f921a354666f05617"]], 0x0, 0x0, 0x0}) pread64(r0, &(0x7f0000000040)=""/54, 0x36, 0xb) 03:37:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@', @ANYPTR], 0x0, 0x0, 0x0}) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r0) [ 523.117716] binder_alloc: 3591: binder_alloc_buf size 792633534417207296 failed, no address space [ 523.134132] binder: release 26110:26118 transaction 1406 out, still active [ 523.141953] binder: undelivered TRANSACTION_COMPLETE [ 523.163004] binder_alloc: allocated: 9184 (num: 359 largest: 32), free: 3104 (num: 1 largest: 3104) [ 523.173112] binder: 26126:26129 transaction failed 29201/-28, size 792633534417207296-0 line 3155 [ 523.182524] binder: 26130:26134 unknown command 536871040 [ 523.188138] binder: 26130:26134 ioctl c0306201 20000440 returned -22 [ 523.198531] binder: 26130:26134 unknown command 536871040 [ 523.203669] binder: release 26133:26135 transaction 1408 out, still active [ 523.205589] binder: 26126:26129 ioctl c018620b 0 returned -14 [ 523.216173] binder: undelivered TRANSACTION_COMPLETE 03:37:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="006340400294c178e7dfdc5da19eb43507c0670ff34ba5494c682a1d9d2e99e8c457e3ef9e5f12fa594e25bb6253d06835ed6070ec5f5f1113", @ANYPTR], 0x0, 0x0, 0x0}) getgid() ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000000)=0x0) r2 = socket(0x1f, 0x4, 0x401) syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) setsockopt$inet6_tcp_TCP_REPAIR(r2, 0x6, 0x13, &(0x7f00000000c0)=0xffffffffffffffff, 0x4) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r2, 0x6, 0x21, &(0x7f0000000140)="83326bb4c9057a67b03cb83642b09d4f", 0x10) r3 = openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x400, 0x0) ioctl$TUNGETVNETHDRSZ(r3, 0x800454d7, &(0x7f0000000080)) ioprio_set$pid(0x2, r1, 0x3b55) [ 523.218222] binder: 26130:26134 ioctl c0306201 20000440 returned -22 03:37:20 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0x0, 0x7fe) uname(&(0x7f0000000000)=""/218) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="f6618ba4a8a60e3ef1e0b8d0ea5de3ef87dafe5e2a51a472ffe3c4"]], 0x0, 0x0, 0x0}) [ 523.246044] binder: undelivered TRANSACTION_ERROR: 29201 [ 523.258288] binder: 26140:26141 got transaction to invalid handle [ 523.265416] binder: 26140:26141 transaction failed 29201/-22, size -4961473266124169314-8097732943659684706 line 3018 [ 523.313213] binder: 26140:26141 got transaction to invalid handle [ 523.319813] binder: 26140:26141 transaction failed 29201/-22, size -4961473266124169314-8097732943659684706 line 3018 [ 523.346903] binder: undelivered TRANSACTION_ERROR: 29201 [ 523.360735] binder: undelivered TRANSACTION_ERROR: 29201 03:37:20 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040), 0x4) sched_rr_get_interval(0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') 03:37:20 executing program 2: r0 = accept4$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @dev}, &(0x7f0000000040)=0x10, 0x800) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000080)='/dev/zero\x00', 0x2, 0x0) ioctl$FICLONERANGE(r0, 0x4020940d, &(0x7f00000000c0)={r1, 0x0, 0x5, 0x10000, 0x7}) r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) r3 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f00000002c0)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) r4 = syz_genetlink_get_family_id$tipc(&(0x7f00000001c0)='TIPC\x00') setsockopt$IP_VS_SO_SET_FLUSH(r1, 0x0, 0x485, 0x0, 0x0) sendmsg$TIPC_CMD_GET_BEARER_NAMES(r1, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80008}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r4, 0x8, 0x70bd29, 0x25dfdbfb, {}, ["", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x4000000) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="00634040000000000000000000e0dd471b000000000000000000040000000000000300000000000000000000000000000000000000000000000000000000000000000000b29b2c593636ab19fda594f86e26ddf9ee"], 0x0, 0x0, 0x0}) getsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f0000000300)={{{@in=@loopback, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in6=@dev}}, &(0x7f0000000480)=0xe8) ioctl$sock_inet6_SIOCDIFADDR(r1, 0x8936, &(0x7f00000004c0)={@dev={0xfe, 0x80, [], 0x17}, 0x1b, r5}) 03:37:20 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x4000001) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) lstat(&(0x7f0000000040)='./file0\x00', &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0}) ioprio_set$uid(0x3, r1, 0x3) 03:37:20 executing program 5: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063400600000000000000b6c00000c0ff50b63a709d326c9698d49ea5b995b6727f300079fd179d000000000000000194379b91ab8c81c0b5769e3de5eb76913df07dd05d56e99b0a9b3dad56c152e37ea4186740bdb418d1b25660be41bec617ab1b10896008f1db2e5a0b38f3d743198c5c011f", @ANYPTR], 0x0, 0x0, 0x0}) 03:37:20 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x0, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x48) socketpair(0x1, 0x80000, 0x7fffffff, &(0x7f0000000240)) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f00000005c0)={0x80000000000000, 0x7}, 0x4) syz_genetlink_get_family_id$team(&(0x7f0000000180)='team\x00') getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) getsockopt$inet_mreqn(r0, 0x0, 0x0, &(0x7f0000000300)={@initdev, @remote}, &(0x7f0000000480)=0xc) getpeername$packet(r1, &(0x7f00000004c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000500)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) getpeername$packet(r3, 0x0, &(0x7f0000004d80)) getsockopt$inet6_mreq(r2, 0x29, 0x1b, &(0x7f0000004dc0)={@local}, 0x0) ioctl$sock_ifreq(0xffffffffffffffff, 0x891d, 0x0) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000280)=0x32, 0x4) connect$inet(r0, &(0x7f0000000340)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) pipe2(0x0, 0x800) ioctl$EVIOCSABS3F(0xffffffffffffffff, 0x401845ff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_opaque(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='trusted.overlay.opaque\x00', &(0x7f00000001c0)='y\x00', 0x2, 0x2) r5 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x8000, 0x0) bind$unix(r5, &(0x7f0000000040)=@file={0x0, './file0\x00'}, 0x6e) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000600)=ANY=[@ANYBLOB="2b29d4ca3da11207f9e7ad7d6bcf629febde0a7d7aeb2ec2ca69f00ceb7652e180f249706db382fdee03025aab7e626adcf0ec5fe78d5302b08b25590eedb157fbe440e7c5fbab25051f0f19556679e9a2d789a528609afca507c3b12312e3313c28929d05ac0552606cd6afb296d36ebb12c7c9c4ae2f56827a93e9c3c8ce87c49fbdbfdf205fe203820b8ad27616c3199ea70483a9c3f67ac51e4676b3968c2e812846ec37cc0a62831b6926d5ca5bd6b129943604d127e4ed7cf914b9d0872b539d798c"]], 0x0, 0x0, 0x0}) 03:37:20 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 523.715814] binder: 26095:26099 ioctl c0306201 20000140 returned -14 03:37:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xfffffd8e, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB, @ANYRES16=r0], 0x0, 0x0, 0x0}) r1 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000080)='/dev/keychord\x00', 0x0, 0x0) getsockopt$inet6_mtu(r1, 0x29, 0x17, &(0x7f00000000c0), &(0x7f0000000100)=0x4) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r0, 0x800c6613, &(0x7f0000000000)={0x0, @speck128, 0x0, "8b8a46263739bd42"}) [ 523.768703] binder: 26156:26162 unknown command 536872064 [ 523.781515] binder: 26159:26163 ioctl c018620b 0 returned -14 [ 523.790675] binder: 26156:26162 ioctl c0306201 20000440 returned -22 [ 523.803617] binder: 26161:26166 ioctl c018620b 0 returned -14 03:37:20 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) setsockopt$inet6_MCAST_MSFILTER(r1, 0x29, 0x30, &(0x7f0000000040)={0x3, {{0xa, 0x4e21, 0xffffffffffffffd2, @mcast2, 0x2}}, 0x0, 0x3, [{{0xa, 0x4e24, 0x401, @loopback, 0x7}}, {{0xa, 0x4e21, 0x885f, @rand_addr="c269bde08b7fd4b36babbcc9d41578ee", 0x1}}, {{0xa, 0x4e22, 0xf286, @rand_addr="82b3253524276fd84f944804a3e4651d", 0x400}}]}, 0x210) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) [ 523.816454] binder: 26156:26162 unknown command 536872064 [ 523.827916] binder: 26156:26162 ioctl c0306201 20000440 returned -22 [ 523.840386] binder: release 26155:26175 transaction 1412 out, still active 03:37:20 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) write$binfmt_elf64(r0, &(0x7f0000000000)={{0x7f, 0x45, 0x4c, 0x46, 0x80, 0x80000001, 0x4, 0x2, 0x9, 0x2, 0x6, 0x800, 0x253, 0x40, 0xa8, 0x401, 0x4, 0x38, 0x1, 0x1, 0x9, 0x4}, [{0x0, 0x80000000, 0x3, 0x400, 0x6aa, 0x7, 0x8df2, 0x3ff}, {0x7, 0x3f, 0x4, 0x4, 0x5, 0x3, 0x1f}], "c6902271fefa029164a017a342f0609d6e5adf083a89e1fdb1f6f6f775f11f72c8a3a71bf09ba2dd06add2368803acef2895732b4333058c7d42d6f821431457fdece0d8b4abfb7393c2a8ceeedcba340c262f5a2004252f9611d8937a14526c51c2d4311c4b853173d44c5cbf81af2fb9a9e80443d50284ef92fe09060ba423bdb956bd0c35e3d1ba9a29cbb3ec5c6a9e158ae46b113250c50cf5704a82a5c09e17e1df5a1acf82e58569ec682cedd3cbef1f", [[]]}, 0x263) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 523.865224] binder: undelivered TRANSACTION_COMPLETE [ 523.872097] binder: 26159:26177 unknown command 536871488 [ 523.879403] binder: 26161:26180 got transaction with invalid offset (0, min 0 max 0) or object. [ 523.888952] binder: 26173:26176 unknown command 3 [ 523.895429] binder: release 26155:26165 transaction 1411 out, still active [ 523.904441] binder: 26173:26176 ioctl c0306201 20000440 returned -22 [ 523.905893] binder: 26159:26177 ioctl c0306201 20000440 returned -22 [ 523.921618] binder: 26179:26183 unknown command 536872064 [ 523.923438] binder: 26161:26186 BC_ACQUIRE_DONE u0000000000000000 no match [ 523.932348] binder: 26154:26185 unknown command 536872448 [ 523.938651] binder: 26182:26188 ioctl c018620b 0 returned -14 [ 523.946035] binder: 26161:26180 transaction failed 29201/-22, size 0-8 line 3230 [ 523.946949] binder: 26154:26185 ioctl c0306201 20000440 returned -22 [ 523.954042] binder: 26173:26189 ioctl 800c6613 20000000 returned -22 [ 523.964574] binder: 26179:26183 ioctl c0306201 20000440 returned -22 [ 523.970665] binder: undelivered TRANSACTION_COMPLETE [ 523.995860] binder: 26182:26188 ioctl c018620b 0 returned -14 [ 524.002537] binder: 26179:26183 unknown command 536872064 [ 524.009056] binder: 26179:26183 ioctl c0306201 20000440 returned -22 03:37:20 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x2000, 0x0) flistxattr(r1, &(0x7f0000000040)=""/223, 0xdf) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:37:20 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$LOOP_SET_DIRECT_IO(r1, 0x4c08, 0xfffffffffffff83b) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) fcntl$F_SET_FILE_RW_HINT(r0, 0x40e, &(0x7f0000000040)=0x4) [ 524.020448] binder: 26173:26176 unknown command 5 [ 524.020741] binder: release 26182:26192 transaction 1415 out, still active [ 524.025344] binder: 26173:26176 ioctl c0306201 20000440 returned -22 [ 524.044636] binder: 26173:26193 ioctl 800c6613 20000000 returned -22 [ 524.050874] binder: undelivered TRANSACTION_COMPLETE [ 524.058419] binder: release 26182:26188 transaction 1414 out, still active 03:37:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f00000000c0)={0x0, 0x0}) pselect6(0x40, &(0x7f0000000000)={0x7f, 0x10001, 0x3c, 0x5, 0x7fffffff, 0x30e, 0xfffffffffffffff7, 0xc2}, &(0x7f0000000040)={0x1, 0x2, 0x80000001, 0xe1, 0x3, 0xd8, 0x3, 0x2}, &(0x7f0000000080)={0x9, 0x5, 0x4, 0x5, 0x1d30, 0x8000, 0x17, 0x9}, &(0x7f0000000100)={r1, r2+10000000}, &(0x7f0000000180)={&(0x7f0000000140)={0x3f}, 0x8}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR], 0x0, 0x0, 0x0}) r3 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/policy\x00', 0x0, 0x0) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000280)='TIPCv2\x00') sendmsg$TIPC_NL_MEDIA_SET(r3, &(0x7f0000000300)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000002c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="54020000", @ANYRES16=r4, @ANYBLOB="010025bd7000fddbdf250c0000000c0007000800010002000000600001005400020008000400040000000800030006000000080003000700000008000300010000000800010010000000080004000900000008000300040000000800010005000000080001000a0000000800040017080000080003000500000004010500140002000800010013000000080002003f00000024000200080004000100000008000400ff01000008000300050000000800010010000000080001006962000044000200080003007871000008000300000000000800020000000000080004000300000008000100040000000800010003000000080003005b000000080001001000000054000200080001000e00000008000300010000000800040000000100080003007dd700000800030008000000080001001a0000000800040000000000080004000000010008000400060000000800010018000000240002000800030001000100080004008000000008000400ffff000008000300fdffffff040002009c000500340002000800040009000000080002000900000008000400000400000800010008000000080003000500000008000100000000001c00020008000100100000000800020005000000080004000200000014000200080002000010000008000200ec06000008000100756470002c0002000800020005000000080002003f000000080001001a000000080004000100000008000400050000001c0002000400040008000200000000000400040008000200000100000c00050008000100756470000c0009000800010008000000"], 0x254}, 0x1, 0x0, 0x0, 0x20000800}, 0x0) [ 524.081404] binder: undelivered TRANSACTION_COMPLETE [ 524.094033] binder: 26195:26197 ioctl c018620b 0 returned -14 [ 524.126547] binder: 26195:26197 ioctl c018620b 0 returned -14 [ 524.134160] binder: release 26195:26197 transaction 1416 out, still active [ 524.138785] binder: 26200:26204 unknown command 0 [ 524.151110] binder: 26200:26204 ioctl c0306201 20000440 returned -22 [ 524.155840] binder: undelivered TRANSACTION_COMPLETE [ 524.210771] binder: 26200:26204 unknown command 0 [ 524.215687] binder: 26200:26204 ioctl c0306201 20000440 returned -22 03:37:21 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:37:21 executing program 0: syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x806) 03:37:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340e6444d17803af02e8b72ce5d40", @ANYPTR], 0x0, 0x0, 0x0}) 03:37:21 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040), 0x4) sched_rr_get_interval(0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') 03:37:21 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x0, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x48) socketpair(0x1, 0x80000, 0x7fffffff, &(0x7f0000000240)) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f00000005c0)={0x80000000000000, 0x7}, 0x4) syz_genetlink_get_family_id$team(&(0x7f0000000180)='team\x00') getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) getsockopt$inet_mreqn(r0, 0x0, 0x0, &(0x7f0000000300)={@initdev, @remote}, &(0x7f0000000480)=0xc) getpeername$packet(r1, &(0x7f00000004c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000500)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) getpeername$packet(r3, 0x0, &(0x7f0000004d80)) getsockopt$inet6_mreq(r2, 0x29, 0x1b, &(0x7f0000004dc0)={@local}, 0x0) ioctl$sock_ifreq(0xffffffffffffffff, 0x891d, 0x0) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000280)=0x32, 0x4) connect$inet(r0, &(0x7f0000000340)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) pipe2(0x0, 0x800) ioctl$EVIOCSABS3F(0xffffffffffffffff, 0x401845ff, 0x0) syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_opaque(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='trusted.overlay.opaque\x00', &(0x7f00000001c0)='y\x00', 0x2, 0x2) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x8000, 0x0) bind$unix(r4, &(0x7f0000000040)=@file={0x0, './file0\x00'}, 0x6e) 03:37:21 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 524.576890] binder: 26159:26163 ioctl c0306201 20000140 returned -14 [ 524.587459] binder: undelivered TRANSACTION_ERROR: 29201 03:37:21 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x80080, 0x0) setsockopt$IP_VS_SO_SET_ZERO(r1, 0x0, 0x48f, &(0x7f0000000100)={0xc, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e23, 0x4, 'sh\x00', 0x8, 0x7, 0x6e}, 0x2c) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r1, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x30, r2, 0x8, 0x70bd25, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x8}, @IPVS_CMD_ATTR_SERVICE={0x14, 0x1, [@IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'ovf\x00'}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x4}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x80}, 0x40800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) [ 524.638627] binder: 26214:26222 ioctl c018620b 0 returned -14 [ 524.642154] binder: 26217:26224 unknown command -431987968 [ 524.646446] binder: 26218:26223 ioctl c018620b 0 returned -14 [ 524.660516] binder: 26221:26226 ioctl c018620b 0 returned -14 [ 524.666997] binder: 26217:26224 ioctl c0306201 20000440 returned -22 [ 524.670462] binder: release 26214:26227 transaction 1418 out, still active 03:37:21 executing program 2: r0 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) fsetxattr$trusted_overlay_opaque(r0, &(0x7f0000000040)='trusted.overlay.opaque\x00', &(0x7f0000000080)='y\x00', 0xffffffffffffffd7, 0x5) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:37:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x113) ioctl$sock_inet_SIOCGIFBRDADDR(r1, 0x8919, &(0x7f0000000040)={'tunl0\x00', {0x2, 0x4e22, @remote}}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@', @ANYPTR], 0x0, 0x0, 0x0}) [ 524.696201] binder: undelivered TRANSACTION_COMPLETE [ 524.705753] binder: 26218:26232 got transaction with invalid offset (0, min 0 max 0) or object. [ 524.715155] binder: release 26214:26222 transaction 1417 out, still active [ 524.727487] binder: undelivered TRANSACTION_COMPLETE [ 524.732991] binder: 26218:26232 transaction failed 29201/-22, size 0-8 line 3230 [ 524.743807] binder: 26221:26238 unknown command 536871488 [ 524.759022] binder: 26218:26242 BC_ACQUIRE_DONE u0000000000000000 no match [ 524.766478] binder: 26234:26241 ioctl c018620b 0 returned -14 [ 524.774858] binder: 26230:26235 unknown command 536872064 [ 524.778407] binder: 26221:26238 ioctl c0306201 20000440 returned -22 [ 524.780841] binder: 26230:26235 ioctl c0306201 20000440 returned -22 03:37:21 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/policy\x00', 0x0, 0x0) ioctl$TIOCGPGRP(r1, 0x540f, &(0x7f0000000040)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) [ 524.804310] binder: release 26234:26241 transaction 1420 out, still active [ 524.815054] binder: 26230:26246 unknown command 536872064 [ 524.821547] binder: undelivered TRANSACTION_COMPLETE [ 524.835045] binder: 26230:26246 ioctl c0306201 20000440 returned -22 03:37:21 executing program 0: syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x2000000, 0x6012, r0, 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040)='/dev/zero\x00', 0x240000, 0x0) ioctl$BLKGETSIZE64(r1, 0x80081272, &(0x7f0000000080)) 03:37:21 executing program 5: r0 = inotify_init1(0x80000) fcntl$getownex(0xffffffffffffff9c, 0x10, &(0x7f0000000040)={0x0, 0x0}) fcntl$lock(r0, 0x27, &(0x7f0000000080)={0x2, 0x0, 0x6, 0x1, r1}) r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@', @ANYPTR], 0x0, 0x0, 0x0}) openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x8001, 0x80) [ 524.859586] binder: release 26236:26243 transaction 1422 out, still active [ 524.881821] binder: undelivered TRANSACTION_COMPLETE [ 524.892915] binder: release 26236:26243 transaction 1421 out, still active [ 524.912217] binder: 26250:26256 ioctl c018620b 0 returned -14 [ 524.913849] binder: undelivered TRANSACTION_COMPLETE [ 524.918635] binder: 26251:26255 unknown command 536872064 [ 524.933872] binder: 26251:26255 ioctl c0306201 20000440 returned -22 [ 524.944419] binder: release 26254:26257 transaction 1423 out, still active [ 524.954017] audit: type=1400 audit(2000000241.800:53): avc: denied { map } for pid=26251 comm="syz-executor.0" path="/dev/binder0" dev="devtmpfs" ino=5423 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:auditd_unit_file_t:s0 tclass=chr_file permissive=1 [ 524.955985] binder: undelivered TRANSACTION_COMPLETE [ 524.985529] binder: 26250:26256 ioctl c018620b 0 returned -14 [ 524.988825] binder: 26251:26259 unknown command 536872064 03:37:21 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x0, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x48) socketpair(0x1, 0x80000, 0x7fffffff, &(0x7f0000000240)) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f00000005c0)={0x80000000000000, 0x7}, 0x4) syz_genetlink_get_family_id$team(&(0x7f0000000180)='team\x00') getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) getsockopt$inet_mreqn(r0, 0x0, 0x0, &(0x7f0000000300)={@initdev, @remote}, &(0x7f0000000480)=0xc) getpeername$packet(r1, &(0x7f00000004c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000500)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) getpeername$packet(r3, 0x0, &(0x7f0000004d80)) getsockopt$inet6_mreq(r2, 0x29, 0x1b, &(0x7f0000004dc0)={@local}, 0x0) ioctl$sock_ifreq(0xffffffffffffffff, 0x891d, 0x0) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000280)=0x32, 0x4) connect$inet(r0, &(0x7f0000000340)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) pipe2(0x0, 0x800) ioctl$EVIOCSABS3F(0xffffffffffffffff, 0x401845ff, 0x0) syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_opaque(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='trusted.overlay.opaque\x00', &(0x7f00000001c0)='y\x00', 0x2, 0x2) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x8000, 0x0) 03:37:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00630200", @ANYPTR], 0x0, 0x0, 0x0}) 03:37:21 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xffffffffffffff29, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl(r0, 0x1, &(0x7f0000000000)="ea2df3b600e0ed02cc2d1a4e3c2c085ef6d4c525c66935184dae01e769bb1b598fbe89e77bf92496e602d2") [ 525.007064] binder: 26251:26259 ioctl c0306201 20000440 returned -22 [ 525.008671] binder: release 26254:26258 transaction 1424 out, still active [ 525.049868] binder: undelivered TRANSACTION_COMPLETE [ 525.056313] binder: 26265:26269 unknown command 156416 [ 525.063331] binder: 26268:26270 ioctl c018620b 0 returned -14 [ 525.069659] binder: release 26250:26256 transaction 1425 out, still active [ 525.080226] binder: 26265:26269 ioctl c0306201 20000440 returned -22 [ 525.088250] binder: 26268:26270 ioctl 1 20000000 returned -22 [ 525.094491] binder: undelivered TRANSACTION_COMPLETE [ 525.101103] binder: 26265:26269 unknown command 156416 [ 525.107358] binder: 26268:26270 ioctl c018620b 0 returned -14 [ 525.114306] binder: 26265:26269 ioctl c0306201 20000440 returned -22 [ 525.119295] binder: 26268:26275 ioctl 1 20000000 returned -22 03:37:22 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040), 0x4) sched_rr_get_interval(0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') 03:37:22 executing program 0: r0 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000000)='/dev/keychord\x00', 0x22a00, 0x0) getpeername$unix(r0, &(0x7f0000000040), &(0x7f00000000c0)=0x6e) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0xff05, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x198, 0x0, 0x0}) 03:37:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@', @ANYPTR], 0x0, 0x0, 0x0}) r1 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x101000, 0x0) ioctl$EXT4_IOC_MIGRATE(r1, 0x6609) 03:37:22 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080)='TIPC\x00') sendmsg$TIPC_CMD_GET_NETID(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80100029}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r2, 0x20, 0x70bd26, 0x25dfdbfc, {}, ["", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20044000}, 0x1) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000002000000"], 0x0, 0x0, 0x0}) 03:37:22 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 525.438588] binder: 26221:26226 ioctl c0306201 20000140 returned -14 [ 525.445296] binder: undelivered TRANSACTION_ERROR: 29201 [ 525.501002] binder: 26281:26287 unknown command 536872064 [ 525.507026] binder: 26282:26288 ioctl c018620b 0 returned -14 [ 525.509073] binder: 26285:26290 ioctl c018620b 0 returned -14 [ 525.514305] binder: 26284:26289 ioctl c018620b 0 returned -14 [ 525.525454] binder: 26281:26287 ioctl c0306201 20000440 returned -22 [ 525.536882] binder: release 26283:26286 transaction 1427 out, still active 03:37:22 executing program 0: setxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=@random={'trusted.', '/dev/binder#\x00'}, &(0x7f0000000080)='/dev/binder#\x00', 0xd, 0x1) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="06af"]], 0x0, 0x0, 0x0}) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x109140, 0x89) ioctl$PIO_UNIMAP(r1, 0x4b67, &(0x7f0000000140)={0x7, &(0x7f0000000100)=[{0xfffffffffffffff8, 0x100000001}, {0x7fffffff, 0x2}, {0x401, 0x3}, {0x100000001, 0xeb15}, {0xec, 0x4}, {0xc8d3, 0x9}, {0x3, 0x100}]}) 03:37:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYPTR], 0x0, 0x0, 0x0}) [ 525.553892] binder: undelivered TRANSACTION_COMPLETE [ 525.585346] binder: 26285:26295 unknown command 536871488 [ 525.586637] binder: 26284:26297 got transaction with invalid offset (0, min 0 max 0) or object. [ 525.593665] binder: release 26283:26286 transaction 1426 out, still active [ 525.603616] binder: 26282:26288 got transaction with invalid offsets ptr [ 525.617597] binder: 26294:26301 unknown command 536872064 [ 525.625471] binder: 26285:26295 ioctl c0306201 20000440 returned -14 [ 525.625988] binder: 26282:26288 transaction failed 29201/-14, size 0-512 line 3195 [ 525.640525] binder: 26294:26301 ioctl c0306201 20000440 returned -22 [ 525.641225] binder: 26296:26303 unknown command 0 [ 525.647169] binder: 26284:26305 BC_ACQUIRE_DONE u0000000000000000 no match [ 525.659736] binder: undelivered TRANSACTION_COMPLETE [ 525.659822] binder: 26284:26297 transaction failed 29201/-22, size 0-8 line 3230 [ 525.674153] binder: 26294:26306 unknown command 536872064 03:37:22 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x0, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x48) socketpair(0x1, 0x80000, 0x7fffffff, &(0x7f0000000240)) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f00000005c0)={0x80000000000000, 0x7}, 0x4) syz_genetlink_get_family_id$team(&(0x7f0000000180)='team\x00') getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) getsockopt$inet_mreqn(r0, 0x0, 0x0, &(0x7f0000000300)={@initdev, @remote}, &(0x7f0000000480)=0xc) getpeername$packet(r1, &(0x7f00000004c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000500)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) getpeername$packet(r3, 0x0, &(0x7f0000004d80)) getsockopt$inet6_mreq(r2, 0x29, 0x1b, &(0x7f0000004dc0)={@local}, 0x0) ioctl$sock_ifreq(0xffffffffffffffff, 0x891d, 0x0) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000280)=0x32, 0x4) connect$inet(r0, &(0x7f0000000340)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) pipe2(0x0, 0x800) ioctl$EVIOCSABS3F(0xffffffffffffffff, 0x401845ff, 0x0) syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_opaque(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='trusted.overlay.opaque\x00', &(0x7f00000001c0)='y\x00', 0x2, 0x2) 03:37:22 executing program 0: pipe2(&(0x7f0000000000), 0x84800) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) [ 525.680240] binder: 26282:26288 ioctl c018620b 0 returned -14 [ 525.680345] binder: 26294:26306 ioctl c0306201 20000440 returned -22 [ 525.690446] binder: 26296:26303 ioctl c0306201 20000440 returned -22 [ 525.694323] binder: 26282:26307 got transaction with invalid offsets ptr [ 525.711188] binder: 26296:26303 unknown command 0 [ 525.719606] binder: 26296:26303 ioctl c0306201 20000440 returned -22 [ 525.722641] binder: 26282:26307 transaction failed 29201/-14, size 0-512 line 3195 03:37:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0xc, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="004d1a00", @ANYPTR], 0x0, 0x0, 0x0}) [ 525.739947] binder: undelivered TRANSACTION_ERROR: 29201 [ 525.766841] binder: undelivered TRANSACTION_ERROR: 29201 [ 525.778181] binder: 26311:26313 unknown command 536872064 03:37:22 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x2) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 525.789213] binder: 26311:26313 ioctl c0306201 20000440 returned -22 [ 525.818666] binder: 26315:26320 unknown command 1723648 [ 525.824467] binder: 26315:26320 ioctl c0306201 20000000 returned -22 [ 525.831958] binder: 26311:26321 unknown command 536872064 03:37:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@', @ANYPTR], 0x0, 0x0, 0x0}) ioctl$VT_DISALLOCATE(r0, 0x5608) [ 525.844025] binder: 26311:26321 ioctl c0306201 20000440 returned -22 [ 525.845287] binder: 26319:26322 ioctl c018620b 0 returned -14 [ 525.867605] binder: 26319:26322 ioctl c018620b 0 returned -14 [ 525.873203] binder: release 26319:26322 transaction 1431 out, still active [ 525.885042] binder: undelivered TRANSACTION_COMPLETE [ 525.901170] binder: 26326:26327 ioctl 5608 0 returned -22 [ 525.912215] binder: 26326:26329 ioctl 5608 0 returned -22 [ 525.929705] binder: release 26326:26327 transaction 1433 out, still active [ 525.939568] binder: undelivered TRANSACTION_COMPLETE [ 525.955068] binder: release 26326:26327 transaction 1432 out, still active [ 525.964564] binder: undelivered TRANSACTION_COMPLETE 03:37:23 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040), 0x4) sched_rr_get_interval(0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') 03:37:23 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) fremovexattr(r0, &(0x7f0000000000)=@known='trusted.overlay.upper\x00') ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) 03:37:23 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) setxattr$security_evm(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='security.evm\x00', &(0x7f00000000c0)=@ng={0x4, 0xc, "77eb59508388583f3e4fb22486"}, 0xf, 0x3) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) sendfile(r0, r0, &(0x7f0000000100), 0x7) r1 = dup2(r0, r0) ioctl$BLKDISCARD(r1, 0x1277, &(0x7f0000000000)=0x3) 03:37:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@', @ANYPTR], 0x0, 0x0, 0x0}) r1 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/checkreqprot\x00', 0x0, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000200)={r1, 0x7, 0x1, 0x8, &(0x7f00000001c0)=[0x0], 0x1}, 0x20) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) ioctl$SNDRV_TIMER_IOCTL_STATUS(r2, 0x80605414, &(0x7f0000000100)=""/66) sendmsg$nl_route_sched(r2, &(0x7f00000000c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000480)=@newtaction={0x580, 0x30, 0x8, 0x70bd2b, 0x25dfdbfc, {}, [{0xe4, 0x1, @m_simple={0xe0, 0xd, {{0xc, 0x1, 'simple\x00'}, {0x64, 0x2, [@TCA_DEF_DATA={0x8, 0x3, '\x00'}, @TCA_DEF_DATA={0x8, 0x3, '\x81%\x00'}, @TCA_DEF_PARMS={0x18, 0x2, {0x6, 0xda, 0x10000000, 0x1000200000, 0x10001}}, @TCA_DEF_DATA={0x14, 0x3, '/dev/binder#\x00'}, @TCA_DEF_PARMS={0x18, 0x2, {0x5, 0x1b2, 0x2, 0xf4, 0x800000000000000}}, @TCA_DEF_DATA={0xc, 0x3, 'self$\x00'}]}, {0x68, 0x6, "f7a5b43a222ca2e12d16e61c37bde5b7787d993253b9ef911521f51fc46702eaa2fef2fcfe8bf45aa763f65376378bd0577d0f666d05c8351bccb1c3235fd16be8a7180051e6bec4ac2bb147b02eaab54af819fb40147f2aa83d029eb9fd01f6b96c75"}}}}, {0x70, 0x1, @m_simple={0x6c, 0x1c, {{0xc, 0x1, 'simple\x00'}, {0x40, 0x2, [@TCA_DEF_PARMS={0x18, 0x2, {0x7f, 0x8001, 0x4, 0x6, 0x2}}, @TCA_DEF_DATA={0x24, 0x3, '\x0fkeyring[&user#vmnet0vmnet0$*.\x00'}]}, {0x18, 0x6, "c4dfbf5c7c5bfb81223b5048be57e90b383f"}}}}, {0xe8, 0x1, @m_simple={0xe4, 0x1a, {{0xc, 0x1, 'simple\x00'}, {0x2c, 0x2, [@TCA_DEF_DATA={0x14, 0x3, '/dev/binder#\x00'}, @TCA_DEF_DATA={0x14, 0x3, '/dev/binder#\x00'}]}, {0xa4, 0x6, "6f6b7e39d500502d511c264e2765143fa977d0bfe2cde445a89a83d0c845ae1a226612295a5bac6e289b2466fda3ceba984b2c3260a3843252244d9ee7fd45f3742ad61535964e6296c24948d86ba917396ee48b38db6c900df48dd7e675f26727808f46236affcf5574b82be48bcde07bc105bdf7bf50321139f5ff186385d08bc5442e4123eb4bea466401c57bd46718a61002690a5ad524096329656a"}}}}, {0x158, 0x1, @m_tunnel_key={0x154, 0x1c, {{0x10, 0x1, 'tunnel_key\x00'}, {0x38, 0x2, [@TCA_TUNNEL_KEY_ENC_IPV4_SRC={0x8, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, @TCA_TUNNEL_KEY_PARMS={0x1c, 0x2, {{0x40f2, 0x4, 0x1, 0x9, 0x3}, 0x1}}, @TCA_TUNNEL_KEY_ENC_KEY_ID={0x8, 0x7, 0x4}, @TCA_TUNNEL_KEY_ENC_IPV4_DST={0x8, 0x4, @multicast1}]}, {0x104, 0x6, "501ed76392fe404e960472362d0385ceef12b266744638167b5501a8454b418f632f540d4ffbe4788d20135f40f172c539298799249e5dd429e0ba7618dba1cbf45ed00ba72c590e223e49c10ab132fbf9151537cde600dfcbdd6c2d398f6cd105346b984bd560851dc4f418e3f22c48bfb8994a69848cef97886d85e8d752cdf2ff1f114e62684e2e2804bab5e331858df040853f47a1343baa245c9714c798dbc6cb4cb087799f6d86d2b329b6ed3022440567fea1ac6166fe08a3c467df96557e6b657d399b30c6d10c447722fc6028f05eb839835927f650fbbf4c2ed981ec614eed0f0f69c253df4f72ca25ee7e1fd684bd2461d84cdacd05b4b200"}}}}, {0x74, 0x1, @m_tunnel_key={0x70, 0x13, {{0x10, 0x1, 'tunnel_key\x00'}, {0x18, 0x2, [@TCA_TUNNEL_KEY_ENC_IPV6_DST={0x14, 0x6, @dev={0xfe, 0x80, [], 0x27}}]}, {0x40, 0x6, "4742a992fb43ca7f69b3f71923755f2fbc01fd6d772b4720e79e695d9100a55e6d1cbf66e848e00043ae45c3edd7ce55b6d24a330c1d3c6ed1d1f930"}}}}, {0x164, 0x1, @m_vlan={0x160, 0x9, {{0xc, 0x1, 'vlan\x00'}, {0x80, 0x2, [@TCA_VLAN_PUSH_VLAN_PRIORITY={0x8, 0x6, 0x1}, @TCA_VLAN_PUSH_VLAN_PRIORITY={0x8}, @TCA_VLAN_PARMS={0x1c, 0x2, {{0x4, 0x692, 0x0, 0x7}, 0x2}}, @TCA_VLAN_PUSH_VLAN_ID={0x8, 0x3, 0x15d}, @TCA_VLAN_PUSH_VLAN_PRIORITY={0x8, 0x6, 0x1}, @TCA_VLAN_PUSH_VLAN_ID={0x8, 0x3, 0x723}, @TCA_VLAN_PARMS={0x1c, 0x2, {{0x7, 0xffffffffffff8000, 0x7, 0x0, 0x6}, 0x1}}, @TCA_VLAN_PARMS={0x1c, 0x2, {{0x8, 0x4, 0x20000000, 0x5, 0x400}, 0x3}}]}, {0xcc, 0x6, "c97d92f6205034055abe0dba41c9ae14cc6182a41261abbf2507e1a5a710836990196fc519effa16013351438bad1464f0ce5e81a21c7a45f1bd0ca5cc02ea74bc60b29887ac0de5ffc539af0e662d5e603c7f054ff602c6eed76562d5c726a9870b77becdf09dba2f53c3896f9d3b84c285cac35c67ff426d21f0d09441bf33db9415d287e7ae68ea64236dbb06b76c66849132bde10f58d42ada71073002a0d76b20bdae5b19bdcec1f2d1537aa713bde742aa5fce9a44da1ad70213e6f5e32d448965d5785e86"}}}}]}, 0x580}, 0x1, 0x0, 0x0, 0x20000001}, 0x4000) unlinkat(r3, &(0x7f0000000240)='./file0\x00', 0x200) 03:37:23 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x0, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x48) socketpair(0x1, 0x80000, 0x7fffffff, &(0x7f0000000240)) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f00000005c0)={0x80000000000000, 0x7}, 0x4) syz_genetlink_get_family_id$team(&(0x7f0000000180)='team\x00') getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) getsockopt$inet_mreqn(r0, 0x0, 0x0, &(0x7f0000000300)={@initdev, @remote}, &(0x7f0000000480)=0xc) getpeername$packet(r1, &(0x7f00000004c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000500)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) getpeername$packet(r3, 0x0, &(0x7f0000004d80)) getsockopt$inet6_mreq(r2, 0x29, 0x1b, &(0x7f0000004dc0)={@local}, 0x0) ioctl$sock_ifreq(0xffffffffffffffff, 0x891d, 0x0) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000280)=0x32, 0x4) connect$inet(r0, &(0x7f0000000340)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) pipe2(0x0, 0x800) ioctl$EVIOCSABS3F(0xffffffffffffffff, 0x401845ff, 0x0) syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 03:37:23 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 526.302455] binder: undelivered TRANSACTION_ERROR: 29201 [ 526.310741] binder: 26285:26290 ioctl c0306201 20000140 returned -14 [ 526.367376] binder: 26335:26342 ioctl c018620b 0 returned -14 [ 526.370805] binder: 26340:26344 ioctl c018620b 0 returned -14 [ 526.379774] binder: 26338:26343 ioctl c018620b 0 returned -14 [ 526.386250] binder: 26334:26345 unknown command 536872064 [ 526.388417] binder: release 26337:26341 transaction 1435 out, still active [ 526.392504] binder: 26335:26342 ioctl 1277 20000000 returned -22 [ 526.399298] binder: undelivered TRANSACTION_COMPLETE [ 526.405579] binder: 26334:26345 ioctl c0306201 20000440 returned -22 03:37:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c\x00\x00', @ANYPTR], 0x0, 0x0, 0x0}) ioctl$PPPIOCSNPMODE(r0, 0x4008744b, &(0x7f0000000000)={0x80fd, 0x3}) [ 526.418092] binder: 26335:26342 ioctl c018620b 0 returned -14 [ 526.428819] binder: release 26337:26341 transaction 1434 out, still active [ 526.434563] binder: 26334:26351 unknown command 536872064 [ 526.452508] binder: 26335:26349 ioctl 1277 20000000 returned -22 03:37:23 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000)={0x0}, &(0x7f0000000040)=0xc) getresuid(&(0x7f0000000080), &(0x7f00000000c0)=0x0, &(0x7f0000000100)) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000140)={0x0, 0x0, 0x0}, &(0x7f0000000180)=0xc) setsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000001c0)={r2, r3, r4}, 0xc) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000009c00000000ebffffff000000000000000000000000000000000000002eb986318f9c7edf35b2889de30000000000000000000000000000"], 0x0, 0x0, 0x0}) [ 526.466414] binder: 26340:26352 got transaction with invalid offset (0, min 0 max 0) or object. [ 526.467690] binder: 26338:26355 unknown command 536871488 [ 526.489959] binder: 26334:26351 ioctl c0306201 20000440 returned -22 [ 526.502223] binder: 26340:26358 BC_ACQUIRE_DONE u0000000000000000 no match [ 526.508801] binder: 26340:26352 transaction failed 29201/-22, size 0-8 line 3230 [ 526.509903] binder: 26354:26357 unknown command 25344 [ 526.518591] binder: undelivered TRANSACTION_COMPLETE [ 526.532111] binder: release 26335:26350 transaction 1437 out, still active [ 526.541874] binder: 26360:26362 ioctl c018620b 0 returned -14 [ 526.542531] binder: 26338:26355 ioctl c0306201 20000440 returned -14 [ 526.549795] binder: undelivered TRANSACTION_COMPLETE [ 526.564187] binder: 26360:26362 transaction failed 29201/-22, size -8738903024400859136--8596749504678686927 line 3155 [ 526.566408] binder: 26354:26357 ioctl c0306201 20000440 returned -22 [ 526.575511] binder: 26354:26364 ioctl 4008744b 20000000 returned -22 [ 526.589079] binder: release 26335:26342 transaction 1436 out, still active [ 526.600671] binder: 26360:26362 ioctl c018620b 0 returned -14 [ 526.606758] binder: 26354:26364 ioctl 4008744b 20000000 returned -22 [ 526.607253] binder: 26354:26357 unknown command 25344 03:37:23 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000000)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='memory.current\x00', 0x0, 0x0) ioctl$BLKFRASET(r1, 0x1264, &(0x7f0000000080)=0x5) [ 526.613783] binder: undelivered TRANSACTION_COMPLETE [ 526.624363] binder: 26360:26366 transaction failed 29201/-22, size -8738903024400859136--8596749504678686927 line 3155 [ 526.638164] binder: 26354:26357 ioctl c0306201 20000440 returned -22 [ 526.657486] binder: undelivered TRANSACTION_ERROR: 29201 [ 526.663367] binder: undelivered TRANSACTION_ERROR: 29201 03:37:23 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) r1 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x400, 0x0) ioctl$sock_inet6_tcp_SIOCOUTQ(r1, 0x5411, &(0x7f0000000040)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:37:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="7f0000fc", @ANYPTR], 0x0, 0x0, 0x0}) 03:37:23 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) [ 526.667910] binder: 26368:26369 unknown command 536872064 [ 526.675025] binder: 26368:26369 ioctl c0306201 20000440 returned -22 [ 526.684973] binder: 26368:26369 unknown command 536872064 [ 526.691855] binder: 26368:26369 ioctl c0306201 20000440 returned -22 [ 526.753090] binder: 26373:26375 unknown command -67108737 [ 526.766001] binder: 26374:26378 ioctl c018620b 0 returned -14 [ 526.771875] binder: 26373:26375 ioctl c0306201 20000440 returned -22 [ 526.783001] binder: 26374:26378 ioctl c018620b 0 returned -14 [ 526.794638] binder: 26377:26379 unknown command 536872064 [ 526.797420] binder: release 26374:26378 transaction 1441 out, still active [ 526.807431] binder: 26377:26379 ioctl c0306201 20000440 returned -22 [ 526.847176] binder: undelivered TRANSACTION_COMPLETE [ 526.873635] binder: release 26374:26378 transaction 1442 out, still active [ 526.886511] binder: undelivered TRANSACTION_COMPLETE 03:37:24 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040), 0x4) sched_rr_get_interval(0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') 03:37:24 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x7, 0x0) ioctl$LOOP_SET_STATUS64(r0, 0x4c04, &(0x7f0000000040)={0x0, 0x0, 0x0, 0xffffffffffffff80, 0x6, 0x0, 0x3, 0xb, 0x5, "85080c29a02ca6603cfe4f5362512b633ed86792b87c5fa563bb75e72940cd9f3865bd4c5a43eff7522060d66479ece7d5ff475e06d00bddcf7e2f7697afab26", "9e59c8a3b2742cd2d601035f59fd3cf9832acecdf80b8252695f1db8d1c52dca0816fc6d6db9d15649c0cbee1cbddd779cad8d50562455a639f62e354fe01354", "dbfa15359d93360f15d887e7a34d962d7b8a98b23e6c275f2db23f01ca23dcf0", [0x6, 0x3]}) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) r2 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/avc/hash_stats\x00', 0x0, 0x0) write$P9_RFSYNC(r2, &(0x7f0000000180)={0x7, 0x33, 0x1}, 0x7) 03:37:24 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@', @ANYPTR], 0x0, 0x0, 0x0}) 03:37:24 executing program 2: ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f00000001c0)={0x0, 0x0}) sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x2) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) r2 = getuid() sendmsg$nl_generic(r1, &(0x7f00000002c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2248}, 0xc, &(0x7f0000000380)={&(0x7f0000000080)={0x30, 0x14, 0x302, 0x70bd2d, 0x25dfdbfc, {0x1b}, [@typed={0x8, 0x57, @u32=0x81}, @nested={0x14, 0x84, [@typed={0x8, 0x46, @uid=r2}, @typed={0x8, 0x48, @u32=0x2}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x4000004}, 0x4000010) setsockopt$inet_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000240)='tls\x00', 0x4) 03:37:24 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x0, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x48) socketpair(0x1, 0x80000, 0x7fffffff, &(0x7f0000000240)) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f00000005c0)={0x80000000000000, 0x7}, 0x4) syz_genetlink_get_family_id$team(&(0x7f0000000180)='team\x00') getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) getsockopt$inet_mreqn(r0, 0x0, 0x0, &(0x7f0000000300)={@initdev, @remote}, &(0x7f0000000480)=0xc) getpeername$packet(r1, &(0x7f00000004c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000500)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) getpeername$packet(r3, 0x0, &(0x7f0000004d80)) getsockopt$inet6_mreq(r2, 0x29, 0x1b, &(0x7f0000004dc0)={@local}, 0x0) ioctl$sock_ifreq(0xffffffffffffffff, 0x891d, 0x0) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000280)=0x32, 0x4) connect$inet(r0, &(0x7f0000000340)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) pipe2(0x0, 0x800) ioctl$EVIOCSABS3F(0xffffffffffffffff, 0x401845ff, 0x0) 03:37:24 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 527.167163] binder: 26338:26343 ioctl c0306201 20000140 returned -14 [ 527.170425] binder: undelivered TRANSACTION_ERROR: 29201 03:37:24 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f00000000c0)=0x0) r2 = syz_open_procfs(r1, &(0x7f0000000100)='sc\xcded\x00') getsockopt$IP6T_SO_GET_REVISION_TARGET(r2, 0x29, 0x45, &(0x7f0000000040)={'IDLETIMER\x00'}, &(0x7f0000000080)=0x1e) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r2) 03:37:24 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0xd30) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00cP@', @ANYPTR], 0x0, 0x0, 0x0}) r1 = socket$key(0xf, 0x3, 0x2) r2 = mmap$binder(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x10, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x24, 0x0, &(0x7f0000000080)=[@request_death={0x400c630e, 0x3, 0x2}, @increfs_done={0x40106308, r2, 0x1}], 0x1000, 0x0, &(0x7f0000000480)="579c310da9f7eb99032a87cc086bbc424fb16355c3df788dea3dd68ced40034a73e0c1dae0063c9fcf0b01f72ba0792fb36b6e1eae85619e7b6912c3ab7916ceea0693af5548617b69ac84a0ea0284ff1f38597b3507f196cd4fc12eaad0fe8cda35a573a668514b3243f8a3582f2f24d941f825b354faa463b9196527f16c6d96f23fe0e102050c287d6f366bf4dfae832014f15a29d542a83b67281caebd233866dc55918cad107996b0ec6941ff5fcbf0cd5ba15e329756157b34559ffaa3498aaf2e9ef37de4a693e3b0cb76b6c7deab8d06a4e0c8833a4e8709601d2abf217e38ba5bbfa707148ed6bb940e56ce836bcee91b820ab09f048419c9d61378117460beda215d777c48a3c35f96efbe2032b7090fbcdee07c306f1032dde31ac8835e723537b8c17a1c7aaf880292dfae0060ba8122d3769732e29f2f353c9133737ffbe5602760bd40b97d29e5c38c86c5a94bd1662d6ab71aa081b0d819816aaac02d91d69fbf71ca54e9e4fd876388796b2a4cad5ba274e67ddff7b06b47bdca88440dc0faacd42eaf31dc90cfc3484448f19d890aebbcbd340fa1320e1e24293bc25db82f5b8744ee17d57583990a9f5203dd2eaa23a69a4acdbbe15b1b500ffe7b45c1585b964c7754b0c81feaaed929268696b709847e7c3473ffb4e51fc360eadafc14478ab0d2ad1a767091d73d60b6013edade7b81f3c8c4f21358c57aaa56558c2f98205c9b5623cf656fd57d88e49e83432dd5624fbd1328322c2a36060290d3c351d470be0553439677ee6071621485dfe014a47ecb25482e2983bdaadb952f21008e903e0a588f8ae130007c4ddeb5c8b21c3ef5f09d4dc21b29b7d25243bcff30943fe6a8ec6d1a6933cd00830c0a638afc47574129e747fa4349534b30894c2aad75dea87f71e01eb32be836ca6e5e7516e7f25babf35ebacadbf49e3aff057498415e1f1126322d577ea570c94f4efdab487298e7d4025eceaf12f86c2e7add679e3da3fceb05355c4935b2cf4066bc15afb19e461d36b5dceeba0a288ba3df87f4b5e82953ad370633b4ba14b03fbd82f1d9ef5cd899a8f7b493f243af4e54742b6e5c0ac451de4993d64bb5882486ae9b91f0f61d72affa85ac26d81b68e9c0b8131b34c9f010d7b73dabe35856fe9f5b791e237e02b8f6261acd21bc8cf36feb5f13d97b16b29551a7c55ea0e0c00412a908e06c089c5690bf576f3b2d44fbbf0255878c0ce24de0c0e20f219d7c61044f1886cf88e2ec924035bbc4ccdda776f7e044bcc7f6faa404d56e04ffe35c90150ddebc0213923227cd97f1ce1bb5cf641b416f80e5807327c5046869bd8e38c20ef72ba89cd818ab3746690ec0c8003157956f378ad73ada5fa5c7d0eec3e47e35536732c3ffe58e4272caec3aebc4e18e2e15e07efa25e0579433775f9dbc03571b3772d26141f61172430bc6027008af64df71a44749b77020eed3f5efbff92a3e65e0a2ed480e1c0d0de4bbd225f042b81508218823ac33bd8f24ec683ded861ae8af0fd338a217a8f89fe0af720894949410daf557dd1c0bfc9a087562b42405ecd4dc2c3fa8fd518e38001d9f68ccd845dbdd19de755ddbb36902a74a7d157db9b9361954e351b5d37271ec1f0aa35b1d4776425ef454ba9aa5e08126421c2872e54ab4a48099058f048d739b9a6d9c699e32140e80068360a4eb59aabf0168038aaa9c52c66b820399fefc74e1af7b1194db69d89bb741aaf40b071f425b3edd697bd32b860ae8f2f27d63a18cfea73486e5efe71c58b1d0400221dd208d818dd0ab5aeec41b569aa710a1fbdb157d4d64ca5006b2c060c141b70f7509f083663d40535a42239e9acb3a942d63f515449a3deb23fade5c73c9f96b83c3365fefcbe510432ed4bf606face11d2616d9c820b54288f2b7c7e7b521d28861656c2e3c078e894921cc59510f34e3bfbee957ca1e6f038a5d857514e79caf905eea4bf4d563c6054d78439d29bbba65b1de6dca91ee56ffc7a90cd212cc663d2d225ed53e9d5d2c1610478e14cbe1391b983f247a9c5c6adf39e550099f1da37ad9a405f4c3d466ef42b0a49faa5b00478e75e6d78b5d35d68c2080fa024c8d687f03f4816eaa0d577b0d889c82ff00861806d36420d801f40fe7d64e0e79af6bbaa948181816b5b34980ecf5d285f861fc0272501e82b4c883bf5736496309d34026e93de2fb3df82a6f8209b741cc9e5fbbf1157a2dbae8eb6f898f1e1263b75d480899227a666ca848adb4bd4c11f24c406dc50af09ac30736c00c68e574414d4c9a82f6399965fbd3aeb892db37c644ddd2845145f9690f9f4f41ce2d0dfe24c9fab8667d1f986b6930e60c8cf14974f26c7df90ff9c2dc9d300567a94180998d7c9dc9916ea7bf49ec8184d5fbd2c13238cb957a7a3713aa5003777f053f076d1c50ba4459bb6d72e66ea908ea7cc0b4821fd2383142a3abb34cea27717d0147abff2b6eaeeaa9ff926c190cf0e985c67936e062fec8f120ed0ac2c41b29f8fd508809a171068413754aeaa8e64bd458dc5c26981c3813ee6b46a09287616486ac0fa3e5ed37cc1cbd54ab2a1385e4d40253157eb37ea31f7a8929fa9c0b7cc937c5410138a2daddeced31ab100aebe32df7813ed2173de84bcf92deda937f1cebc8b4cf0bf15daf47610843faf28eb216eb88a8f9fa273c8abe2d9bccbb2d821e26df93699804dbd9e36e32232343be07e6dc605c7b0b34629b6ad0c3503840d77cc128e4b8234b4911238dbf1b48ba43bf25bc48358f756bbf0ae63a6701fe3ac654de9c469164b984e7373eee96d28b8b5345a2de318159831d3967d4c7b58ae6e6d885aa8540d56e0750d94feacbd89a562b3658f67b115fd3573a12475b0417940c790e107f35b9ebfcdfb4691d78ece47381abecd41c14678e22bff0da4ca0308d885ee9b88e16a2a0d916d64a5e376dd8bb79584c16c0a038939288d95670fd23d52e8c2bbbfc882980b411502e579d42f6478ab02cfa66e016cbb433fb460e36f21b9729de1d558b3fd795f26c0a4a69978fb1b5e590c512163b1978f0f8e7c6a12469a94542fff93a2b761e989853997b54078d6af8f5d1e9806b4b58296042cd04c4b9e920e87cc20f90a606e26d5cebecefe458b1f798ce0d67e33c3af8bf2244093d2dfe9a42ac7f45d3828b0c4e48abe5e0a588b1f53662b8908bf10973dd0d476268660f0e82dbc6343284f5df9b6248b6463c1849d173dd6769a22bc4d2f5a2e3fd9535ce2afc4480269a910e438cb96083ac38f13be721856d33303d2fee1ed242c51d520ae37473fa1fd862cf2c0a9c04793d131eda5e82498aa61cc36478eab930cd91211959021036d3fcebc74f79357ec0a45379b261d837f90f497a5bfffa16a34c2ceb23919022df2b6e050a03707fafddeda35e42020fef37a064ab6e0a90bbd897fb0f1ccc05769b454543e4336f3c9c04b6f5ade4d99a8c3c5632f47a9ba306dcd4639942d96832590aed10887cfec30f412b7b6ebab1794d499b364560f5f18b5dc07dcfc5e2f2ba4a8093fb5a9a66fdda0263f9621f76e64d87bfc314bbd4187920bf76675265eee842aafed236d25ebb1c9eb1f4acda97beae92c86ac9d7641a2d21268f5e74f9616a0ea3077b70362bfb7e477b792d55d5f173e46ae476dfd2baad11c178d21b607078565fff8426d298fe59e0f75e0d556ddf0b0cc9166308a6371c9fb5dc75b9e0894a8d8807a369755d19a4424d0bfc478433217aa058bc962b4ebcab7aba354f781462a4c60b1dc57031c1af688a58bd9919121f89f3c3eebc796fe7aab0f8b1c22fabc94e6b1fd5668dc9284bc9d170fee0bc98bd5115072405811c90d4c6065eefe07cbad191085edf500f5a4ef134cb2ddd073d9aa5349785b8234908fefe81c60b730c2ca4d5b076b78c841624f3c6d6fb54d49273f99afc4dfb9bcbeddbf1b7b9e6a45483c479e9d6aa1f6ab2a12ccae64ef8e2ef6122801e5097c687a20744bf0298e5ccfd6a5b1f4f80b8029f970c3e4928ef7bff7e0a54c9c2d93ab697fc965f1ad99862469e1a3455e063c2d8de666d8160ed06cb824fbf92c1550bb31b23559b89416f10d9476488d1189ddd1f7f5bb304e7ea9cf8abb386dac45cca316b12b6877a41045f7ffada69d808913d31b4aea98090c08f0a237f9494f4c21257253d6451463847208cab0f29e36bf3fc3ceb68c422e59c61c61413194ba67da061eb370377df5cfe90650b2fc60074922da8a5f4229880bf7b7e5f58f4a44addbaf4e1f8e836a775efc4aeb46d081281e40a083cc0a1b6ec52d2ca590827351397598b8821dd7497da37f1fde1558d5abfc379b81d06525108032957c22aa8c9aa5e3a0d6bcfdc31989de062bde86839b18df5a64acd303e1109ca39969bf2a6a44702f1dff8e02acaaf0f60fa7aacb76a7893f957d9aef180233e220ec1ab1439cc3c7c8cb7bf2e2a575170e8d31de5fbbab5b762969f37bc5de93c2640e59bef91deff66311771d9085ccb38413416e2f288422752c6d752163bd9515ef13db6db80417feaa0876931d4017400cedc6e89460b8863d7fdfc0164efb32df87c04df55dd223b89deaed1105a9e7ec8f741baa7cd2fc59c07794b9b5aa7da63185838c56b655459302705d61df10db76a67aeb8cfb561a68f1fa0bd5f769cb3dcd0502adda24e6bdf381ca43a58e8e4ced0e86f92ad265e9028aefef85bd036091491548216fd5761ac56f55e23f008af0744046ea5f187007ba19cdfe484f4db46de32cb57c084bcc2282ebe006d96477b37bbfc8cdb46dbc5959cea52b134925cbffb587240af5810ead6e04ed9a7f90d1bbb9e9e0cd60fc6f0def4772c92207de186b321bdb5efb8746088d3337e2fc4df0dde7d7085e133b243126334d79430bc8aeb88c66dfb2d3279feb22fc55ebf17c9870c013a601a2a86dfb58f242477f7cab61b61aa3c85ce1902cdd3ad532f08c73f791ae63d6588966d24d0eadaaec834e9d28e4496e2e224a4ece50c17c702b9562bf55e7dafbb9acbdf0364dda8cbfffe07fd82323a2ecaa0ca6a99f0c738144cc23faf31f34b35efe1d58945ba07ece6720925eff633ddc4f9d06263b1ba86761a97bcd3e00cafe9026ecec2a4e83deca54d6677c5295509e8f605d9e54f1af36d0dadd78e8c8236e636802da007c0dcd900722013b7927e40e00cf455d677195fc592b85c3a41980af6a251584728276d7b3e6fada7539cdddf6644ad7287d08052fbc6f983aef724c6da2376c7d1ecd65d9a4f9042133d8d0fec420cc4b5e2c436b7ed1e6c5487bf5d44fe2bfb94553ecc3064b86c9b6eb3d3751fde2caf2c4cbb99679a6f0a4043b26e9ce50e082d70918bbf46c154ceae59e6cdcd370b5c3c986696ac1dbc7503dd22c3f348433840cc7dc8ae83bd0ecbaee0d266eed68761dffa7e349f1e7dcec3e69dcf1d1537884c1e5d0303a6d46ea9cdcaff62d51cac0e109f3a928e849f5ce8bb9c7725ebcb74c7e3d9b629a1f7bad835705cb8f24e4bdc86188289cca69cd3d529102dbd41d9ece6f332c7da1fca0451160f996d0338919ace11afee4e76ea2085aa588e16b6273e0f5198648912a6a9965cb6ce18f57cb91049873720d1baac22e03dde91050ebeee2742ae64ba0d565b31c35dc71d3960e52d2d66efc1a24801081c2823748ec8d7f44ca36067565219e79a326115dbf7559660129b46f3f20164dfd1e901aa51dbfaf8de74c2e1327cf2ec869ef672bf7289d4b80385ed178958229322a99393"}) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000000)=0x20, 0x4) socket$inet6(0xa, 0x5, 0x324b8441) [ 527.230834] binder: 26387:26394 unknown command 536872064 [ 527.235723] binder: release 26388:26396 transaction 1443 out, still active [ 527.239377] binder: 26392:26398 ioctl c018620b 0 returned -14 [ 527.249547] binder: undelivered TRANSACTION_COMPLETE [ 527.253812] binder: 26387:26394 ioctl c0306201 20000440 returned -22 [ 527.255081] binder: 26393:26397 ioctl c018620b 0 returned -14 [ 527.298367] binder: 26387:26400 unknown command 536872064 [ 527.301397] binder: 26401:26406 ioctl c018620b 0 returned -14 [ 527.304478] binder: 26387:26400 ioctl c0306201 20000440 returned -22 [ 527.313358] binder: 26401:26406 ioctl c018620b 0 returned -14 [ 527.328164] binder: 26392:26410 got transaction with invalid offset (0, min 0 max 0) or object. [ 527.330680] binder: release 26401:26406 transaction 1444 out, still active [ 527.338040] binder: 26404:26409 ioctl 40046205 d30 returned -22 [ 527.344754] binder: 26393:26412 unknown command 536871488 [ 527.355403] binder: 26392:26410 transaction failed 29201/-22, size 0-8 line 3230 [ 527.359004] binder: 26393:26412 ioctl c0306201 20000440 returned -22 [ 527.373115] binder: undelivered TRANSACTION_COMPLETE [ 527.379317] binder: 26404:26409 unknown command 1079010048 [ 527.381002] binder: 26392:26414 BC_ACQUIRE_DONE u0000000000000000 no match [ 527.392092] binder: 26404:26409 ioctl c0306201 20000440 returned -22 03:37:24 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xffffffffffffff59, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="00afba4791b58564121037b21969c392c2df3fd7b772988e54239dbd5203ddad823003c0be454dbf5c87e5d5f98dbce46cfc7f5b75f100df57185da45ca282d127326f42a42faf7cc89a9e13885a7e000000"]], 0x0, 0x0, 0x0}) 03:37:24 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0x0, 0x2) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xff3b, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000e1ffffffffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000008cef9b69fc6c4b63cfb91a3c0809b469efe8dd0ca520d705580b74aabea1c160d9a40013262b320b0560059fb08dd505dac5a6b9905c5a01830139fa521752616c8c0efe4126440ca63b62739c654c6285125f08928c104c57cf5276cbafc5dbfe38d5f82bae1c9ebedebacde08dbe38a5476e5a16467be692230982bc26dd82"], 0x0, 0x0, 0x0}) [ 527.394545] audit: type=1400 audit(2000000244.240:54): avc: denied { map } for pid=26404 comm="syz-executor.5" path="socket:[81383]" dev="sockfs" ino=81383 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=key_socket permissive=1 [ 527.410193] binder: release 26401:26411 transaction 1446 out, still active [ 527.427081] binder: 26404:26409 BC_REQUEST_DEATH_NOTIFICATION invalid ref 3 [ 527.435842] binder: undelivered TRANSACTION_COMPLETE [ 527.460864] binder: 26404:26409 BC_INCREFS_DONE u0000000000000000 no match [ 527.495066] binder: 26420:26423 ioctl c018620b 0 returned -14 03:37:24 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x20000, 0x0) ioctl$EVIOCSCLOCKID(r1, 0x400445a0, &(0x7f0000000100)=0x9) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x14, 0x0, &(0x7f0000000040)=ANY=[@ANYRESDEC=r0], 0x0, 0x0, 0x0}) ioctl$EXT4_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000080)=0x2) io_setup(0x1, &(0x7f0000000140)=0x0) io_destroy(r2) 03:37:24 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$EXT4_IOC_PRECACHE_EXTENTS(r0, 0x6612) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 527.504580] binder: 26420:26423 transaction failed 29189/-22, size 0-0 line 3018 [ 527.524733] binder: 26420:26423 ioctl c018620b 0 returned -14 [ 527.531689] binder: undelivered TRANSACTION_ERROR: 29189 [ 527.541594] binder: 26425:26427 unknown command 808464432 [ 527.547693] binder: 26425:26427 ioctl c0306201 20000000 returned -22 [ 527.570755] binder: 26428:26429 ioctl c018620b 0 returned -14 [ 527.574944] binder: 26425:26427 ioctl 40086602 20000080 returned -22 [ 527.585860] binder: 26428:26429 ioctl 6612 0 returned -22 [ 527.595864] binder: 26428:26429 ioctl c018620b 0 returned -14 [ 527.603030] binder: 26428:26432 ioctl 6612 0 returned -22 [ 527.609597] binder: release 26428:26429 transaction 1449 out, still active [ 527.617148] binder: undelivered TRANSACTION_COMPLETE [ 527.628180] binder: release 26428:26429 transaction 1448 out, still active [ 527.635827] binder: undelivered TRANSACTION_COMPLETE [ 527.651377] binder: 26425:26434 ioctl 40086602 20000080 returned -22 [ 527.651382] binder: 26425:26427 unknown command 808464432 [ 527.651393] binder: 26425:26427 ioctl c0306201 20000000 returned -22 03:37:24 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f00000003c0)}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040), 0x4) sched_rr_get_interval(0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') 03:37:24 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x0, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x48) socketpair(0x1, 0x80000, 0x7fffffff, &(0x7f0000000240)) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f00000005c0)={0x80000000000000, 0x7}, 0x4) syz_genetlink_get_family_id$team(&(0x7f0000000180)='team\x00') getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) getsockopt$inet_mreqn(r0, 0x0, 0x0, &(0x7f0000000300)={@initdev, @remote}, &(0x7f0000000480)=0xc) getpeername$packet(r1, &(0x7f00000004c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000500)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) getpeername$packet(r3, 0x0, &(0x7f0000004d80)) getsockopt$inet6_mreq(r2, 0x29, 0x1b, &(0x7f0000004dc0)={@local}, 0x0) ioctl$sock_ifreq(0xffffffffffffffff, 0x891d, 0x0) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000280)=0x32, 0x4) connect$inet(r0, &(0x7f0000000340)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) pipe2(0x0, 0x800) 03:37:24 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) openat$cgroup_ro(r1, &(0x7f0000000040)='memory.current\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:37:24 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x881) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0xc, 0x0, &(0x7f0000000140)=ANY=[@ANYPTR64=&(0x7f0000000180)=ANY=[@ANYRES32, @ANYRES16=r0]], 0xfffffffffffffe2c, 0x0, 0x0}) creat(&(0x7f0000000000)='./file0\x00', 0x98) 03:37:24 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 528.024377] binder: 26393:26397 ioctl c0306201 20000140 returned -14 [ 528.024615] binder: undelivered TRANSACTION_ERROR: 29201 [ 528.087479] binder: 26439:26444 ioctl c018620b 0 returned -14 [ 528.091054] binder: 26440:26445 unknown command 536871296 [ 528.099903] binder: 26443:26446 ioctl c018620b 0 returned -14 [ 528.101599] binder: 26441:26448 ioctl c018620b 0 returned -14 [ 528.107049] binder: 26440:26445 ioctl c0306201 20000080 returned -22 [ 528.113698] binder: 26439:26444 ioctl c018620b 0 returned -14 [ 528.125392] binder: 26440:26445 unknown command 536871296 [ 528.131601] binder: 26404:26422 ioctl 40046205 d30 returned -22 03:37:25 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/mls\x00', 0x0, 0x0) ioctl$TUNSETSNDBUF(r1, 0x400454d4, &(0x7f0000000140)=0x3) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="00005bda96c02189bda8537b5aabdb50a9a19480792999f11387b3e87fb310ec6f313bac4de95a21fa990b2b8483fa9aed6ca186d24e88372c615c88eff3c55208234050ae6782103518cc474cb2e22fa4c05c2b17a190cc2baac4f0ff096f17c2b185a4c3f33231e08dd518214b004112384a3de26b2e0c2883587bbb4434537e70041dd167fce2c0ccf9eb8ff4d14ba5dbdc5a1012d3439ff780bb22c718c736d972e68af85750fa627c350bcc28d676377c76de522143fd255fe7df19227701b880c0bff10fc292997721aba228bc998f0771b7b571f3c62f9d1f1cd05963e2941c80bf50254028b683"]], 0xffffff94, 0x0, 0x0}) [ 528.135349] binder: release 26439:26444 transaction 1450 out, still active [ 528.138763] binder: 26404:26452 unknown command 1079010048 [ 528.151002] binder: 26440:26445 ioctl c0306201 20000080 returned -22 [ 528.165354] binder: 26404:26452 ioctl c0306201 20000440 returned -22 [ 528.170907] binder: undelivered TRANSACTION_COMPLETE [ 528.175544] binder: 26443:26454 unknown command 536871488 03:37:25 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) r1 = dup(r0) r2 = inotify_add_watch(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x400) inotify_rm_watch(r1, r2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) fstat(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) r4 = getuid() getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000140)={0x0, 0x0}, &(0x7f0000000180)=0xc) r6 = getuid() r7 = getuid() getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f00000001c0)={{{@in=@dev, @in=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in6=@local}}, &(0x7f00000002c0)=0xe8) r9 = geteuid() r10 = geteuid() getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000480)={{{@in, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}, 0x0, @in6=@remote}}, &(0x7f0000000380)=0xe8) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000580)={{{@in6=@initdev, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in6=@dev}}, &(0x7f00000003c0)=0xe8) getresgid(&(0x7f0000000680), &(0x7f00000006c0)=0x0, &(0x7f0000000700)) getgroups(0x8, &(0x7f0000000740)=[0xee01, 0xee01, 0x0, 0xffffffffffffffff, 0xee00, 0xee01, 0xffffffffffffffff, 0xee01]) stat(&(0x7f0000000780)='./file0\x00', &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r0, &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f00000008c0)='./file0\x00', &(0x7f0000000900)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) lsetxattr$system_posix_acl(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='system.posix_acl_default\x00', &(0x7f0000000980)={{}, {0x1, 0x4}, [{0x2, 0x1, r3}, {0x2, 0x1, r4}, {0x2, 0x3, r5}, {0x2, 0x4, r6}, {0x2, 0x4, r7}, {0x2, 0x1, r8}, {0x2, 0x1, r9}, {0x2, 0x4, r10}, {0x2, 0x2, r11}, {0x2, 0x7, r12}], {0x4, 0x1}, [{0x8, 0x1, r13}, {0x8, 0x2, r14}, {0x8, 0x1, r15}, {0x8, 0x7, r16}, {0x8, 0x2, r17}], {0x10, 0x6}, {0x20, 0x1}}, 0x9c, 0x3) [ 528.180687] binder: 26404:26422 BC_REQUEST_DEATH_NOTIFICATION invalid ref 3 [ 528.192472] binder: 26441:26455 got transaction with invalid offset (0, min 0 max 0) or object. [ 528.200257] binder: 26404:26422 BC_INCREFS_DONE u0000000000000000 no match [ 528.221736] binder: 26443:26454 ioctl c0306201 20000440 returned -14 [ 528.225186] binder: 26457:26462 unknown command 536870912 03:37:25 executing program 5: r0 = socket$inet6(0xa, 0x80003, 0xff) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @dev, 0x5}, 0x1c) io_setup(0x3, &(0x7f0000000040)=0x0) io_submit(r1, 0x1, &(0x7f0000356ff0)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000040), 0x354}]) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xf, 0x0, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0}) [ 528.231611] binder: 26441:26465 BC_ACQUIRE_DONE u0000000000000000 no match [ 528.249212] binder: 26441:26455 transaction failed 29201/-22, size 0-8 line 3230 [ 528.256186] binder: 26457:26462 ioctl c0306201 20000440 returned -22 [ 528.262394] binder: 26463:26466 ioctl c018620b 0 returned -14 [ 528.270717] binder: 26463:26466 ioctl c0306201 0 returned -14 03:37:25 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00a0"]], 0x0, 0x0, 0x0}) [ 528.294965] binder: 26457:26462 unknown command 536870912 [ 528.301074] binder: 26457:26462 ioctl c0306201 20000440 returned -22 [ 528.311875] binder: 26463:26466 ioctl c018620b 0 returned -14 [ 528.315647] binder: 26463:26471 ioctl c0306201 0 returned -14 03:37:25 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 03:37:25 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) fcntl$F_SET_RW_HINT(r0, 0x40c, &(0x7f0000000000)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@', @ANYPTR], 0x0, 0x0, 0x0}) 03:37:25 executing program 0: r0 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/status\x00', 0x0, 0x0) write$P9_RLOCK(r0, &(0x7f0000000340)={0x8, 0x35, 0x1}, 0x8) write$P9_RWALK(r0, &(0x7f0000000280)={0x64, 0x6f, 0x1, {0x7, [{0x8, 0x2, 0x5}, {0x0, 0x3, 0x5}, {0x2, 0x0, 0x3}, {0x10, 0x4, 0x5}, {0x8e, 0x4, 0x1}, {0x8, 0x3}, {0x80, 0x2, 0x7}]}}, 0x64) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f00000005c0)=ANY=[@ANYBLOB="1800e773a3b132fe3e6ab300aee1e5c366bcdfcba8f897e3a1dc7bf904543f00000000000000000000c594163eda8f1e1a0f6b2c6047e04da582fcc653e1517fc24959163f66b8435715c51b11032e4168f8d2b87b505adfa4fe1e3cfb9291c487d47fdfea8142a9e2858bb198867c1bac2e6aef38bfdbe9f66a608a6b0b4440bf204475bfc0cbe7bd2761ba41694d1591d502e41ec9023d9b2e79a3560f2bc35dadd6b47990364372e2e946d5cee8aa03084a5ddcd0dd44f12c0eb98a6b59f7468d1828eb988352eda92d446d0fb29f60cdd511851b1579ca87f95e966ecdb4fc4da8ef8e35d6320a237c275ab86d758c39f0c504d155b87321e84a2329a87648dab09719bb0057593d8a74a7d76bbcf55ab05b7724d89fab4ebdd3eba11f73727348fbf78b1eff50715dce47cb2eafee846d4d60"]], 0x0, 0x0, 0x0}) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='attr/current\x00') accept4$inet6(r0, &(0x7f0000000380)={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000004c0)=0x1c, 0x800) setsockopt$inet_udp_int(r0, 0x11, 0x3, &(0x7f00000003c0), 0x4) sendmsg$unix(r2, &(0x7f0000000200)={&(0x7f0000000040)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f00000001c0)=[{&(0x7f00000000c0)="200de5be12365516abd7314f887eb641af46b4261d70e5a4f00e84b176e88f9a5a46bf7c8a91e76cc7a30d2b4b0c04aedcc6265cc02a4db7dc895ed16588f4ece965666b9d5fc89922f633884d8bd30b7290fdd9c45ac5153a90867e29c6d78ba03f2eb42da55ec7fcb162ba22200672591c6f3ee94393ee021a14c3ba53f86dc5d54b598d78d4c35bd24ae81526bb06f25cbefa5699c96b93e5350093e0e5427a154d6652af6f2f81af51e383ebc87d6247690f0f6fd148befa10b448c6e1dfbda57df333d48d3333ba89f6", 0xcc}], 0x1, 0x0, 0x0, 0x4}, 0x10) [ 528.347222] binder: release 26463:26471 transaction 1453 out, still active [ 528.361516] binder: undelivered TRANSACTION_COMPLETE [ 528.364873] binder: 26473:26475 unknown command 536872064 [ 528.381074] binder: 26473:26475 ioctl c0306201 20000440 returned -22 [ 528.381807] binder: release 26463:26466 transaction 1452 out, still active [ 528.451654] binder: undelivered TRANSACTION_COMPLETE [ 528.457509] binder: 26480:26483 ioctl c018620b 0 returned -14 [ 528.463909] binder: 26478:26481 unknown command 536872384 [ 528.469522] binder: 26478:26481 ioctl c0306201 20000440 returned -22 [ 528.469537] binder: 26480:26483 ioctl c018620b 0 returned -14 [ 528.484552] binder: 26478:26486 unknown command 536872384 [ 528.490273] binder: 26478:26486 ioctl c0306201 20000440 returned -22 [ 528.491710] binder: release 26479:26484 transaction 1455 out, still active [ 528.507008] binder: undelivered TRANSACTION_COMPLETE [ 528.538159] binder: release 26480:26485 transaction 1457 out, still active [ 528.564932] binder: undelivered TRANSACTION_COMPLETE [ 528.574932] binder: release 26480:26483 transaction 1456 out, still active [ 528.582769] binder: undelivered TRANSACTION_COMPLETE [ 528.588288] binder: release 26479:26482 transaction 1454 out, still active [ 528.597673] binder: undelivered TRANSACTION_COMPLETE 03:37:25 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040), 0x4) sched_rr_get_interval(0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') 03:37:25 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_PRECACHE_EXTENTS(r0, 0x6612) r1 = gettid() fcntl$setown(r0, 0x8, r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x128, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\x00c@@', @ANYPTR], 0x0, 0x0, 0x0}) 03:37:25 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000040)=ANY=[@ANYBLOB="00af4c77af7fd3196feae9f64323859e23b0b41d31d93da260a290232484192319697bfb081f1e84a7b679327fbe818a4fa8d6336bb7e018887d3145593f5bca05c27d3503cb0e81003d80fbccec791654ee8c304ecc85093802b42e94fda11cebff8dae0ce25cbf44d02e57815bda41052e739879b0864454854e8c879eb3615d65be035a4d00ce3488f03104bec9221dd34d51c5d93c98e6a3f38b77f2314e5ea20053a0e3a26785d984988498be518905ad7a3b79588345204f1c0cc9e73d236b4bd9da1431f50aff407999bb6a9dda3b7cbf03bcdd2feecc089c948c6c74e4b3ea0bdd5baf91a0a4b683ba8da2ad4ffd38cd1ffd6e21d5105efcf1de4fe33ad6d234f9c52e1a9f07d9251a44bb8ec90bf8aa8ed0b8e3db6264b7c6f3f7c0f858b1cccff06b04d2bea5152fcedd599ee1cd01cdb9993701d9a015"]], 0x0, 0x0, 0x0}) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/enforce\x00', 0x2000, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000001c0)={0x0}, &(0x7f0000000200)=0xc) ioctl$sock_SIOCSPGRP(r1, 0x8902, &(0x7f0000000240)=r2) 03:37:25 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000b0000000000000000000000000000000d88487394a08bb3efc9ff1"], 0x0, 0x0, 0x0}) 03:37:25 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 03:37:25 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x0, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x48) socketpair(0x1, 0x80000, 0x7fffffff, &(0x7f0000000240)) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f00000005c0)={0x80000000000000, 0x7}, 0x4) syz_genetlink_get_family_id$team(&(0x7f0000000180)='team\x00') getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) getsockopt$inet_mreqn(r0, 0x0, 0x0, &(0x7f0000000300)={@initdev, @remote}, &(0x7f0000000480)=0xc) getpeername$packet(r1, &(0x7f00000004c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000500)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) getpeername$packet(r3, 0x0, &(0x7f0000004d80)) getsockopt$inet6_mreq(r2, 0x29, 0x1b, &(0x7f0000004dc0)={@local}, 0x0) ioctl$sock_ifreq(0xffffffffffffffff, 0x891d, 0x0) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000280)=0x32, 0x4) connect$inet(r0, &(0x7f0000000340)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) [ 528.890535] binder: 26443:26446 ioctl c0306201 20000140 returned -14 [ 528.897858] binder: undelivered TRANSACTION_ERROR: 29201 [ 528.928036] binder: 26492:26495 unknown command 536870976 [ 528.953631] binder: 26492:26495 ioctl c0306201 20000440 returned -22 [ 528.955175] binder: 26493:26500 ioctl c018620b 0 returned -14 [ 528.968866] binder: 26491:26501 ioctl 6612 0 returned -22 [ 528.975903] binder: 26496:26502 ioctl c018620b 0 returned -14 [ 528.982771] binder: 26498:26503 ioctl c018620b 0 returned -14 [ 528.982784] binder: 26491:26501 unknown command 0 [ 528.989226] binder: 26492:26495 unknown command 536870976 03:37:25 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x10000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) [ 528.996855] binder: 26493:26500 ioctl c018620b 0 returned -14 [ 529.005656] binder: 26492:26495 ioctl c0306201 20000440 returned -22 [ 529.006331] binder: release 26493:26500 transaction 1459 out, still active [ 529.019938] binder: undelivered TRANSACTION_COMPLETE [ 529.034355] binder: 26491:26501 ioctl c0306201 20000440 returned -22 03:37:25 executing program 2: r0 = dup3(0xffffffffffffff9c, 0xffffffffffffffff, 0x80000) setsockopt$inet6_MRT6_DEL_MFC(r0, 0x29, 0xcd, &(0x7f0000000000)={{0xa, 0x4e21, 0x80000000, @mcast2, 0xff}, {0xa, 0x4e22, 0x0, @rand_addr="0691113dc317c6ae38a19118d722f291", 0x4}, 0x5, [0x1, 0x8, 0x3, 0x755b, 0x2, 0x80000000, 0x2, 0xfffffffffffffff7]}, 0x5c) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000008000000e0aca6e26cbed71123fef4bcbaf08c0000000000000000ea06c768d1910010a838fc233acdc9b8f246331ca8996be271b5f1cb096ed5daf74d4017c1cc14a378683946d6517374b57f1a5bd86dfbd7880f10dbc6f766614f642e97102eee"], 0x0, 0x0, 0x0}) [ 529.054999] binder: 26496:26511 got transaction with invalid offset (0, min 0 max 24) or object. [ 529.067719] binder: 26491:26501 ioctl 6612 0 returned -22 [ 529.069775] binder: 26498:26512 unknown command 536871488 [ 529.081490] binder: 26491:26516 unknown command 0 [ 529.091472] binder: 26498:26512 ioctl c0306201 20000440 returned -22 [ 529.098945] binder: 26491:26516 ioctl c0306201 20000440 returned -22 03:37:25 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) r1 = socket$netlink(0x10, 0x3, 0x2) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'team0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)=@delqdisc={0x84, 0x25, 0x800, 0x70bd26, 0x25dfdbfd, {0x0, r2, {0x1, 0xe}, {0x5, 0xfff7}, {0xfffb, 0xfff3}}, [@qdisc_kind_options=@q_hfsc={{0xc, 0x1, 'hfsc\x00'}, {0x8, 0x2, 0x7619}}, @qdisc_kind_options=@q_codel={{0xc, 0x1, 'codel\x00'}, {0x4}}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x65}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x9}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x8}, @qdisc_kind_options=@q_pfifo_head_drop={{0x14, 0x1, 'pfifo_head_drop\x00'}, {0x8, 0x2, 0x1f}}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x7}]}, 0x84}, 0x1, 0x0, 0x0, 0x40000}, 0x0) [ 529.102962] binder: 26496:26519 BC_ACQUIRE_DONE u0000000000000000 no match [ 529.107555] binder: 26513:26518 ioctl c018620b 0 returned -14 [ 529.118799] binder: 26496:26511 transaction failed 29201/-22, size 24-8 line 3230 [ 529.122892] binder: release 26491:26501 transaction 1458 out, still active [ 529.142388] binder_alloc: 3591: binder_alloc_buf size 8796093677568 failed, no address space 03:37:26 executing program 5: r0 = openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x10000, 0x0) ioctl$BLKRRPART(r0, 0x125f, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@', @ANYPTR], 0x0, 0x0, 0x0}) [ 529.158657] binder: undelivered TRANSACTION_COMPLETE [ 529.170922] binder_alloc: allocated: 9504 (num: 399 largest: 32), free: 2784 (num: 2 largest: 2752) [ 529.188266] binder: release 26491:26516 transaction 1461 out, still active [ 529.196895] binder: 26523:26524 unknown command 536872064 03:37:26 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$GIO_UNISCRNMAP(r1, 0x4b69, &(0x7f0000000040)=""/69) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000007b36ced04851f1b729c0b349531cf07800000000000000000000000000000000000000000000000000ce0000000000000000000000000000"], 0x0, 0x0, 0x0}) [ 529.208462] binder: undelivered TRANSACTION_COMPLETE [ 529.216565] binder: 26513:26518 transaction failed 29201/-28, size 655360-8796093022208 line 3155 [ 529.221129] binder: 26523:26524 ioctl c0306201 20000440 returned -22 [ 529.232586] binder: 26513:26518 ioctl c018620b 0 returned -14 [ 529.233042] binder: release 26526:26527 transaction 1464 out, still active 03:37:26 executing program 5: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) r1 = dup(r0) setsockopt$IP_VS_SO_SET_ZERO(r1, 0x0, 0x48f, &(0x7f0000000000)={0x2e, @dev={0xac, 0x14, 0x14, 0x23}, 0x4e22, 0x2, 'nq\x00', 0x20, 0x9, 0x5}, 0x2c) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="d8c6cada96b2001daedacbe9c64040", @ANYPTR], 0x0, 0x0, 0x0}) io_setup(0x6, &(0x7f0000000040)) [ 529.265259] binder: undelivered TRANSACTION_COMPLETE [ 529.277539] binder: 26523:26524 unknown command 536872064 [ 529.284736] binder: undelivered TRANSACTION_ERROR: 29201 [ 529.288926] binder: 26523:26524 ioctl c0306201 20000440 returned -22 [ 529.305428] binder: release 26526:26527 transaction 1463 out, still active [ 529.317937] binder: 26533:26536 unknown command -624245032 [ 529.321885] binder: undelivered TRANSACTION_COMPLETE [ 529.326279] binder: 26535:26537 ioctl c018620b 0 returned -14 [ 529.336485] binder: 26533:26536 ioctl c0306201 20000440 returned -22 [ 529.353559] binder: 26533:26536 unknown command -624245032 [ 529.360293] binder_alloc: 3591: binder_alloc_buf size 519424463696 failed, no address space [ 529.363431] binder: 26533:26536 ioctl c0306201 20000440 returned -22 [ 529.375766] binder_alloc: allocated: 9520 (num: 401 largest: 32), free: 2768 (num: 2 largest: 2752) [ 529.391326] binder: 26535:26537 transaction failed 29201/-28, size 519424463689-0 line 3155 [ 529.402570] binder: 26535:26537 ioctl c018620b 0 returned -14 [ 529.409740] binder: undelivered TRANSACTION_ERROR: 29201 03:37:26 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040), 0x4) sched_rr_get_interval(0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') 03:37:26 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="00af32a95fa6b04e769a2d91b969fdb0c9b2159badf79bae00803f75608e02adb90c50fdd1fff46c48d4c8c615710793f70002489219d8d5cad259bbc5ac"]], 0x0, 0x0, 0x0}) 03:37:26 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) setxattr$trusted_overlay_opaque(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='trusted.overlay.opaque\x00', &(0x7f00000000c0)='y\x00', 0x2, 0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x8, 0x0, &(0x7f0000000300)=[@decrefs={0x40046307, 0x3}], 0x46a, 0x0, 0x0}) 03:37:26 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0}) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r0, 0x400c6615, &(0x7f0000000040)) 03:37:26 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x0, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x48) socketpair(0x1, 0x80000, 0x7fffffff, &(0x7f0000000240)) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f00000005c0)={0x80000000000000, 0x7}, 0x4) syz_genetlink_get_family_id$team(&(0x7f0000000180)='team\x00') getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) getsockopt$inet_mreqn(r0, 0x0, 0x0, &(0x7f0000000300)={@initdev, @remote}, &(0x7f0000000480)=0xc) getpeername$packet(r1, &(0x7f00000004c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000500)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) getpeername$packet(r3, 0x0, &(0x7f0000004d80)) getsockopt$inet6_mreq(r2, 0x29, 0x1b, &(0x7f0000004dc0)={@local}, 0x0) ioctl$sock_ifreq(0xffffffffffffffff, 0x891d, 0x0) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000280)=0x32, 0x4) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) 03:37:26 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 529.770202] binder: 26498:26503 ioctl c0306201 20000140 returned -14 [ 529.819844] binder: 26547:26552 ioctl c018620b 0 returned -14 [ 529.837818] binder: 26553:26556 ioctl c018620b 0 returned -14 [ 529.838590] binder: 26547:26552 DecRefs 0 refcount change on invalid ref 3 ret -22 [ 529.850896] binder: 26548:26557 ioctl 400c6615 20000040 returned -22 [ 529.852764] binder: 26546:26558 ioctl 8903 20000000 returned -22 03:37:26 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB, @ANYPTR], 0x0, 0x0, 0x0}) [ 529.859205] binder: 26551:26554 ioctl c018620b 0 returned -14 [ 529.867300] binder: 26546:26558 unknown command 536871040 [ 529.876472] binder: 26547:26552 ioctl c0306201 20000000 returned -14 [ 529.883305] binder: 26548:26560 ioctl 400c6615 20000040 returned -22 [ 529.883642] binder: 26546:26558 ioctl c0306201 20000440 returned -22 [ 529.897342] binder: 26553:26561 got transaction with invalid offset (0, min 0 max 24) or object. [ 529.907759] binder: 26547:26552 ioctl c018620b 0 returned -14 [ 529.911926] binder: 26546:26558 ioctl 8903 20000000 returned -22 03:37:26 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x0, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x48) socketpair(0x1, 0x80000, 0x7fffffff, &(0x7f0000000240)) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f00000005c0)={0x80000000000000, 0x7}, 0x4) syz_genetlink_get_family_id$team(&(0x7f0000000180)='team\x00') getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) getsockopt$inet_mreqn(r0, 0x0, 0x0, &(0x7f0000000300)={@initdev, @remote}, &(0x7f0000000480)=0xc) getpeername$packet(r1, &(0x7f00000004c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000500)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) getpeername$packet(r3, 0x0, &(0x7f0000004d80)) getsockopt$inet6_mreq(r2, 0x29, 0x1b, &(0x7f0000004dc0)={@local}, 0x0) ioctl$sock_ifreq(0xffffffffffffffff, 0x891d, 0x0) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000280)=0x32, 0x4) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) [ 529.921009] binder: 26546:26564 unknown command 536871040 [ 529.926775] binder: 26547:26566 DecRefs 0 refcount change on invalid ref 3 ret -22 [ 529.932587] binder: 26546:26564 ioctl c0306201 20000440 returned -22 [ 529.941335] binder: 26565:26567 unknown command 0 [ 529.944210] binder: 26553:26561 transaction failed 29201/-22, size 24-8 line 3230 [ 529.946417] binder: 26551:26568 unknown command 536871488 [ 529.959248] binder: 26547:26566 ioctl c0306201 20000000 returned -14 03:37:26 executing program 2: r0 = socket$inet6(0xa, 0x5, 0x800000000000000) getsockopt$inet6_tcp_buf(r0, 0x6, 0x1f, &(0x7f0000000480)=""/4096, &(0x7f0000000040)=0x1000) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) fcntl$getownex(r1, 0x10, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 03:37:26 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) 03:37:26 executing program 5: openat$rtc(0xffffffffffffff9c, &(0x7f0000000180)='/dev/rtc0\x00', 0x10000, 0x0) setxattr$security_evm(&(0x7f0000000000)='./file0\x00', &(0x7f0000000200)='security.evm\x00', &(0x7f0000000440)=@md5={0x1, "8fb6020ab567250fba69e8c16737989b"}, 0xfffffee3, 0x1) syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x802) [ 529.967256] binder: 26553:26569 BC_ACQUIRE_DONE u0000000000000000 no match [ 529.974998] binder: 26565:26567 ioctl c0306201 20000440 returned -22 [ 529.997559] binder: 26551:26568 ioctl c0306201 20000440 returned -14 03:37:26 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x0, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x48) socketpair(0x1, 0x80000, 0x7fffffff, &(0x7f0000000240)) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f00000005c0)={0x80000000000000, 0x7}, 0x4) syz_genetlink_get_family_id$team(&(0x7f0000000180)='team\x00') getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) getsockopt$inet_mreqn(r0, 0x0, 0x0, &(0x7f0000000300)={@initdev, @remote}, &(0x7f0000000480)=0xc) getpeername$packet(r1, &(0x7f00000004c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000500)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) getpeername$packet(r3, 0x0, &(0x7f0000004d80)) getsockopt$inet6_mreq(r2, 0x29, 0x1b, &(0x7f0000004dc0)={@local}, 0x0) ioctl$sock_ifreq(0xffffffffffffffff, 0x891d, 0x0) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000280)=0x32, 0x4) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) [ 530.059266] binder: 26578:26584 unknown command 536872064 [ 530.074870] binder: 26578:26584 ioctl c0306201 20000440 returned -22 [ 530.077403] binder: 26576:26580 ioctl c018620b 0 returned -14 [ 530.131812] binder: 26576:26580 ioctl c018620b 0 returned -14 [ 530.143186] binder: release 26576:26596 transaction 1468 out, still active [ 530.154212] binder: undelivered TRANSACTION_COMPLETE [ 530.163607] binder: release 26576:26580 transaction 1467 out, still active [ 530.171032] binder: undelivered TRANSACTION_COMPLETE 03:37:27 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040), 0x4) sched_rr_get_interval(0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') 03:37:27 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) munlock(&(0x7f0000ffb000/0x2000)=nil, 0x2000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@', @ANYPTR], 0x0, 0x0, 0x0}) 03:37:27 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FIGETBSZ(r0, 0x2, &(0x7f0000000080)) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x40000, 0x0) sendto$inet6(r1, &(0x7f00000000c0)="6bd0e6796720085dc7c7e01118233265e95bf43c742ec601304119e4dd981659835b9bb9f66b8855fd7e527ddf854089cac7859497634bc30fcd88d3e31a448c4655b0d1418d7e947f4373149592fe06345376be0c23c00f48c9887c2c82a3004081cae7c86d56303513fc1f553de8e9f03e84bc4ad470eb264d17a959b323e32012e25c05d36dbe8582da68f3d10be8dafa942348d0486a408f55d000900f", 0x9f, 0x10, &(0x7f0000000180)={0xa, 0x4e23, 0x8, @rand_addr="097344bfc7aec12ab7e0257ae448256c", 0x7}, 0x1c) getsockopt$IP6T_SO_GET_ENTRIES(r1, 0x29, 0x41, &(0x7f00000004c0)={'nat\x00', 0x1000, "50bd4a27be04516cefe613ffa20c482c189700923d5e7bf307eac26d6841488da22fca864c94db799b6bba0b0af7fcf10f90e7e55baf7e5b1bbce355d9e474647d52f12c1e872c43968e9a4e4d82e4c00b35e83349ec9c80de8bac91b1546f82311507291ad244fad827a1186d77256f6143dd13a8cd06675e687b593e6b7dfb57b07f49dd833ce955bf6b07055a9988a35add8d203bf9fdc913f5f6dbef1500226d05ab5b040d8718ab828d9a7d83826ff2c0d309048aefcc59573cc0a6a6aa0e102d4369651270d344f592f74d1e15a3b8321a43c6391631d025ebb8baa2cb9f1254fcad7277a70426d0ef662aefa9cbf83478cbb11dd1de4515ee14116974fc8d851bbbbd3ad3a19b5f393a23d886f23dabba0f558b9df6e8a06422bdecd07206af4dd5d5c7e2dcbcec8933805ba0f70f85542e69e3f4d053d74c01ac990930487870846f98f67ba1297a00d8800319a66fd8928be8654ab3d4e752aa6d243f439905a90e7feec99b6da985b9a811c64cdf7b66e00c524f252f3ec75eb881ce576d88d33ac5a57766f19bf3664fe84991438e84f0cb6ce1a3b94d0823fe4997520c4592e2c8faa4ad4a0eec059de5e6fc6bcb266e9fe02be2f58d662f05b12e8d918e99f7c9370088bd863cfdfa9a4d28fee477b626456f65659b4175141d42a037c95dbdd5bf687a5c17c8ebbc1362299848ab389944daad8677a0b4a01c3a846131299464326c8c3db19c1591a9ea5c1b88c874ca8bd1729b54a583f7a14d07aeb34d0f578de689027839ec8f458c38b249246715067c3128ce688216a53dbbbb37a8db49b04229d8535ff68cbb123d6dd90f77700f9feaf31b1ae3d8d0c063ce2ddde3f8d74b5eb276f49ad786bc40d5d764250186d88c09d6ebcd464a4090d32b104159a7bd0a313935c450c712b63dc9375296e0615bbbca7f68cbcc3b3abd6115b13362fa7bf107d0ede30a7f7f8555312e63a686513efb625c88cffbee26859e6b687708ccfb63058b9f66f40ba0395b9f5f289f7ce1fbf1b9f9514bcc71dc68b4a07b04da6c6bf6dafeb778202e570556bb9fd25e713806deebdf8067d4f34db8bfb2f05c3a20f52336100ffa586b36b384318cc3c8fe5743c09fb918a085eddae49dcfc60492a2c4999b597f22f2798725885e0b75ba32dcb72f58e13460bb9c0f1a2d4c208ff9572be19d713487e9c6ac28f55818ec64c86b8848985829974a4b11aaff232e3ef36aca0e6b1edd836881efc0ecc2d534e06b4a8d6b8dabac2b07dd42c5163d56466d3e59c6e50195f43529fb955632e6cfcd80108a27c138d04911818ad5bca3ff6be573aa134fedfe167e15ce6343b23d12224e18852f63b01d2d42f3fac3b40a6e4f1cdb698c65aabeb79d370ac3c2bd0d6ebe619373742144d78f9017d56241a242e28f5bf5cc3320821ebe27758ff52495098465c03acd51604d1c6c5e3ea4c3d2dbec33fb61ec98ea95e6e9a150fad5659da088f26200ea84b9494905fb51de0dc7b8fd183b141f530335624608b6e1dc3b90497faf4f468e02ba223da5efef1958f02ae09855e0e9c7b3c4c14399736566ffa25d1c4df818b53309b401f67256e46320219d61d51c844554c9b23694b7d2bc1f6beddbf56778c265fcc1c425f78240b4b213c231830e6b937fbf6decaaf915fd8edcdfa47853d3e8b528728ae0be7d643638a8dfe8fc75a5f0a07bd02b4942d8f032e5d562dcc84558dd89c4ce6224efe9546537f6ba4ccae591fa54aedfef0779cdbe517bc1ce70408712851f24fb2acbc50a01a6324b5b963d2e0dde7ca0f071a600961bfe0fc6f86272ffa3158fd996ef9e74d7b18b18cebac673bfc00171d167c964a0b79049ee2cef60ca703ed9e491c1288a009b453bbff4a329d9399465ccdc8f242e6fa15820066e59fc69e84ed66bee19ec73f3291b90ce70812de477995808d04502d3b9e57aaa8260bf6bd810a07e85db7e3161f8c1952b6e85e80efb82ffa5e388d8f78d4bd1ed37f4ae99f213635473ed7c97d879f47ed9b7a0704e22dc5ecf2ffa8cd6ea4e8a1c2d9ce65489089ad06bc04d7e94fad27916a6fc8084ba8ae820a4e4e40a46de9767205c59b4d4954e9f9d7a3848d3513af0cf9b145b427abbd089212cff38ae75c5f09d6d03e84d111701570f559395aa4bbd639b0e1c83300807fe96a81381888ff0dd6fbd7fabea6153783574944ebc9bbf3d470ccbb7cbac4fccd828158f9a2a8ed77b258001d8c2530bac395d1f2c04b24d05d698b71b1770a87c623786b8342f6199ed5eaee356e4304d459c78dd6129231c27cb3b3658d131cddf62aa5cb529456331439db62fa324b3badf4722e9b1cdd8fb2438ce25832cb2d6cf5de36c9d24221bd602da45cfe1ae6f270c7e80745ee839a1660f962b2287c8924c6e039739c62f0ca31193f03e264a50b589bf8ab8344da1bdcdd920c243f0eadf369a37445e56a13ed03de9571a78c1189ab6d30d374f1b4d57b39b5f3e5e405591efa2e25e45df51e54e4f498e18aa32c37353cc7c127b3b21facd2ac99a3551130e82f60c7af718f9d6f9a77a66d45cc3618023c3441f5b742fba3002f943f772ab8414a27f0285039592e1c62dd7f57ea1a35b95cda042d04903da1e3159821a56cf7757067ccb0277aeaed68a40b327a9a5d6622f095cbea94e47a24de8b108b7f819c190ff7dc74e278cf8419e23accd86900fc7d2fa2d001ecf1314845086fccd428f018625d31460432156ffa89778d26a01b24004727b9df0e71cc9237667ce4acad7528eda02bf47b25638147a527a3091ce0051a5e54dd5b8d0cdb074f4979b58b3d27d3bfe3a1884d91c59641fa833c75dfb84c7a83577a2eb66f90d494fc5209ba38e3bd44b73d832dd1a0c3260f1053aa4af80e0da2634dda2c6605f5aa75685ad4ca7e1474bbec46dae68ba0a027ac604e0389ebaddb1c0446bc4e3bdd9d797da6efb12aaf379d54b7ee74147996fe5f9be568db6bee0ffdb4cbb6f3f115f7e1bb159d1a01330b1c703ced7ba6b86738aadd40a754557e90bc94317861493e1dbf3be112183bc379ba54cc7f53f258d48ca29171a00b50ed1394d3aa402b590c9aabd810cca097133b054384ad21928b9a13d44bcdda559ddb8dcc6da6b586060235a57acea358394a785a08aea71961388e7ac338d27150194c9a398de62d46bb781480900909818f09925c270977deba1a3bf2bedef533700c50244cb4f9d60d6c9968ae3e7caf8e57981a838ffc201b22566f6d23c6b7f4b1da46c262111ddb643701e017184922c85eb188ef5f7427a26c7a48b3ca9a4a349a0ff68581b05d41e22f5d45673d9df2297f1f528f3e532219671e852ba2bdd6d8a24a5df4e36df0ca6d644d68a319fbf0e3cbb24dbba3cac26fb6aad6603da1250cdc6e57e8c8483ceb1f0ab2b46cf2ac43a4959b33d50237842237d002e0d50d1db97bf28134b5fbbf8e02d8c0450dbf1963ad056d299f3c05c2afc62f34d0724b0a1d996f4bb19ebf39268e60d0561829c3c9b61bd1ecca89f4e371e359d5e7db94c7b7013dbd60e392bcfc538ad625034a8a635cf99b89f181d1415e89eec676852721da2bfb603024d44eefbce78976c457e90a2d251678671ffb0ee6e4c47cc720f5151dcb4e4aea929747ffa9e98d5fdf42163839c9046d7d13e3507211d867142c7757e7960e02865580209c3f1d3c6c6549fcd7d539998c0bd6ce728715d1290cb8120076d0a4a1b2fd4380fce7b2ae083fdb6bfe7cc0a21785191fe19b69241d127611ef372ba2e1a156b941c53478cea5fc4223eab63b1f0970ab3e89d12e134213862cd6cbcf9c97e164f986a4b7cb8e769d81679d9e009d9bfbf1a03f6b9eb072c6b94d38cdcc365c225c18f36156444c8c58e304a7c73b0501ce897301d77547b30ee2c5b86d2c3826454bddfd9c33b3cf2f00eee3aa0ff86e80752e9386fe08c1ac46a218e47c53dd63639827a2bbfdf0472e1a8a722a7d8945203c4a6dfb4fd2afe52bcf59457730ed7323e0822d93889e872d5be2a09499e377637d260d9e4cca590d66fea2ecf2ce38e1dee2d69183ea54ecf7b9d58c70c08bd2363272a696307368163b8a2e669d1a95cd5927ea787fd4046b59b7af1dc7bf49c3bbd3a4127dee93d8fb4a4d77d17a8ab8a834b4d29c37faf63d3be5e0b9385ab6392be7de7171302d78acfb9a1a5dec505c76643ced4b6be7624a6eca0733e499ab397f30faf5a4f6411a899cdfbd627d17328b35367fe81f2df9e7712f38875b5a1e8c896777fdc76c243da145732f1e35bc777f47212aa5cb5e0135440ec7c08ec0f9af7ebd13c7a3ef1da777f42233f0b09d44d76ef67838295cd6186d813186ee7d8cbf705498fb427095b318f9e2663fe81a6c94d8ada2a31b6f1c823adae1bfdaf47c214419bf7d76b99d2df1d6da1f99184e4c3a4eb58881b369535003b91ed1f1c40f393be776bd15f784e3cb406fa7cd1ea7936315126ef2d3543b9ad266f328b35a669ba3596198ab179e9be9e41d6d16db5ba7cc5bcc5f40488ea73ff02c5ae09ebe50865dc8250df5a4cff035f3cd181b0d3bf4472f82bfeb76e9186e76db0d91fd2ed4b5cb5ba1c9d1ecd986957dbdcba7cc8b5a3a7b3838d17f8f8d447a7c6222d9b074a3394653b145f14660a0642da30cc0dccf7c3b269142505932a45602f0b74dacb2facbe8b6934ef55e7b070c4b14654fdb0f47a75fb0e473875682003cb2ae944bb8ff0bdee775d37ac67fc4181bd3f0444f1f262ac157adf2e6fd325d35d9dad960aaea7fc71e958f0a056b04ee29a7ec073ecbb188d4d2e1456ee0651ecb1955f527017b02bfa71f192fee99ab665500024623df41b6803247a23a66ecb88c535c760734bdb865ef81bfe0b6593c47f345101e94b4a97830e7b614425a4aa94e9a982217718dc18406bfdd96782612de88a0d02be732a6cc3440702138c622adbc9d55a8c010f2e6e6bf01fd56e683d3931afb9d9dc07d99035c41949316d8c20be5b2f189b4445fd0a277585005a6555c61a119ea71e924d221a45b1bb9bc76e9ca1776edb8c4862fffb1ea5301ac66ca2ea08261ccce365970bc029c3efedcbaccba2476e37fb8bdd66a2f5aac96157ae176573905f25cd24e6d9b843001a199b24e44508dcf2d4a1817d81883db101d6f62aafe880844fdc72922b8dd375f63fb50ffb2496217b8b45558ad4817ff7e62b83301e12d23ce89747794ede6fab32b300645719e9a9eec7ae8199fd3fb6feea0e2267d936a5ba3040a65d6b301806301e56ed442907f33f05307d2dc6cb7edf835d0905fc34815e9097dfed328c61d849b7c46da63eadbd3e3365b35258100c8e08b27042b9a41259da0b0481c7eaaa9878781dddaafeea7f950fed3381254746a2179d0af407f60c7debdddcb635216611a1065a63ced2ed04f62d94f26c531009f5c3f9f83b1ece0cf18dcf81884008d6be8523bf41518889de6796a14e3ae29a3f437ea252ff943dfdf5fcf5bce92cc588f6692c10fe16a5c510f7ddcb0539094a9b073834d08df15c546c5dc0625f5f9f3e6835c0a123d97f8a846a70b5b01e425c0c899c8e118073193d0ee7a419fa8e55bf3a392a1805b85322619e946016de3747587c139a0b1e46934965a5e77f0cbfcad7fb6a7e2241db2ba305c249aba31c587ff6f991f2e2128c193b968fae577af78e326bf947fd2fee57ee9fcd641fc7912061542b09bb2ae819b884586a8f11695eb8af78ed9e8a38d2c8d3f6e30ffb2c590b420f2440a3d6dc"}, &(0x7f0000000040)=0x1024) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) 03:37:27 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) sendmsg(r1, &(0x7f0000000300)={&(0x7f0000000100)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x1, 0x0, 0x0, 0x3, {0xa, 0x4e22, 0x2, @ipv4={[], [], @broadcast}, 0x200}}}, 0x80, &(0x7f00000002c0)=[{&(0x7f0000000180)="46120f0e0d425896dc94427350bb71c35cfd4be1bb", 0x15}, {&(0x7f00000001c0)="47b452beb593a5209e677926a1d3f096244076152a81004fd41b76efdeb843b97ac75712f08bf132a34d42628655917c98a8edbb9db733c12f4acff5c750fc33c8c160b20cbabb19dd241a15efad3425a0ab3fc8879a9b931b1d7fbb9c65a03dbcfc3735aa0e287bd06ff92810ed96fbd0749ae5c7e17524dbd7076b78753ef4303ad92d3e498a1be70dbbc55c0a7351", 0x90}, {&(0x7f0000000280)="81e5b88e4abc2fde70f6db1633a23536", 0x10}], 0x3, &(0x7f0000000440)=[{0xb8, 0x1, 0x8b, "8c560fa4c875b2fbbd9a1254196d9e23811ce3b9651be9926a39ee5fe14ded46564a80b0993b0e512d16934a477b5c6a982b755caadb90d44f1a644434fb427a352d012d6d6267701e7f0ae596526972a38ba8d4a020a05b6d2b39d172f1868d9d4fe740e266ae92174ab8afe7e72b76905ac2151f4b9f39a1115ffc92af779d480ac0050ecdf2b40d4dcedebc2361c4e999a5e55e6a7c144c3b48cb2eb4f89ac99740b6a28b"}, {0x40, 0x88, 0xffffffff, "9d76c01b30ba6a199eae45aa221cee147d41a6180f3d92315606bc16c145ac6ee5bb94934f9df6d7ff096b16bf02"}, {0x88, 0x10e, 0x0, "f21be75e9ffaa802585a7a5640b360f8745f3d7f225a4f5211310cb7b31e4aab8d869a69925ddbb70e1d1df1e6a284e120229e4f1e4eea3f23db2e5ce1426d6b4919ac5fd7bda5b5f00d58e266a21ec5f294e584b06564bde010c8ba5d2236297d286189f3b688a4cd1f06ea0fa43c4d3d51a1"}], 0x180}, 0x80) getsockopt$inet_tcp_int(r1, 0x6, 0x1b, &(0x7f0000000340), &(0x7f0000000380)=0x4) ioctl$sock_inet6_udp_SIOCOUTQ(r1, 0x5411, &(0x7f00000003c0)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x40, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0063404000000000000004000000000000000000000000000000000000000000040000000000000000000000004501775a98a8d800000000000006000000000000"], 0x0, 0x0, 0x0}) sync_file_range(r0, 0x5, 0xbbc, 0x2) epoll_ctl$EPOLL_CTL_DEL(r0, 0x2, r1) 03:37:27 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x0, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x48) socketpair(0x1, 0x80000, 0x7fffffff, &(0x7f0000000240)) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f00000005c0)={0x80000000000000, 0x7}, 0x4) syz_genetlink_get_family_id$team(&(0x7f0000000180)='team\x00') getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) getsockopt$inet_mreqn(r0, 0x0, 0x0, &(0x7f0000000300)={@initdev, @remote}, &(0x7f0000000480)=0xc) getpeername$packet(r1, &(0x7f00000004c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000500)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) getpeername$packet(r3, 0x0, &(0x7f0000004d80)) getsockopt$inet6_mreq(r2, 0x29, 0x1b, &(0x7f0000004dc0)={@local}, 0x0) ioctl$sock_ifreq(0xffffffffffffffff, 0x891d, 0x0) connect$inet(r0, &(0x7f0000000340)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) 03:37:27 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 530.634286] binder: 26551:26554 ioctl c0306201 20000140 returned -14 [ 530.691566] binder: 26602:26609 unknown command 536872064 [ 530.694367] binder: 26604:26611 ioctl c018620b 0 returned -14 [ 530.701631] binder: 26606:26613 ioctl c018620b 0 returned -14 [ 530.704552] binder: release 26601:26610 transaction 1470 out, still active [ 530.719256] binder: 26602:26609 ioctl c0306201 20000440 returned -22 [ 530.719520] binder: 26607:26614 ioctl c018620b 0 returned -14 03:37:27 executing program 5: r0 = accept(0xffffffffffffff9c, &(0x7f0000000080)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, &(0x7f0000000100)=0x80) sendmsg$unix(r0, &(0x7f00000003c0)={&(0x7f0000000140)=@abs={0x1, 0x0, 0x4e22}, 0x6e, &(0x7f0000000640)=[{&(0x7f00000001c0)="a39141e7da6b9a4bc36f2cbbfbaad9a305da528dd6ece2cdd3199d09959e28217abb5b6c0b7eefe4bcfc8dc885a56e26057762c9fb4cb935d76f326a2ef9737a7413344c3b60748c0678643e705bf48f3d5b71852a5631b7e1d4a58396e36f0e74c72d1028ada6d2f516dc1c128987928c2f2891e0512d59ef6e3508795daf598c368abdea9d68aebfa9a0b7d7c68ccbdad88414f4532e87f25512549d9b31f6830e7b9a10cabf21581d87015d93ff", 0xaf}, {&(0x7f0000000280)="cc1933e0f83dafd118be20dab55aa98afdfe843089e9eb5425abf132aa2b1ca20e758ffcd3e36ad22b2d119f0174a6320773be1ef9e6a72ffab62bc9790ad78064cf1405cf495aa76a09c3803e064c0c99be4adc2732847c7c6e3d5228bc02b33def935b0f011228a1cf72c6c112fadc8df8ce5f", 0x74}, {&(0x7f0000000340)="b4363735c6cd14d89e2594360d775742175530362cf22e3547999ea84ac35ba9fb68959faa5e14b9d14c3a5e50c4c0d3f9d0398e21432a92e5da641a1866671aa5664225f0fc637a19d8d0c1d282d88527e9816d8ab5330b8ec496db041980217ab82bed4ebb7d7ac9c167b718b2339089640b54", 0x74}, {&(0x7f0000000480)="7d4706b697e767e24e461cb18844f0d4986de575a1533795eceddd014a1ce6d785cced2445ffc14a15c5aa7c12f819336038762a8e3b33939f537a34655b1a6b93543aa97fa109ecdb70", 0x4a}, {&(0x7f0000000500)="0a92bd71cc34af03c0d3fce7e12b7359e4fee92f833d31c75bc8b97664648649bef77457bc4b23fe6d30d45f2ae7e9ab3776beca7c6e89997cb15d55196a70be9aee012f369cedfb2cf6059755d3a1e9d9a26a488a7788ec7830ecad569f99d5be61958947426a74caa743abbda4e8977c5902a5fab926a6f89b872f00b4cbe368c44905e5", 0x85}, {&(0x7f00000005c0)="fce63a80b8affce14d12771ed585e34fb0b63ed513ef6f27dbb1bbaa6d58bfe2953af1f054e4e72561c93091ae16fcc82ca5b9abf4c8d56648675da6efcd300dc89e49b7f3c9b394f853649bc67e0e2247", 0x51}], 0x6, 0x0, 0x0, 0x8000}, 0x8804) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c,\t', @ANYPTR], 0x0, 0x0, 0x0}) fsetxattr$security_ima(r1, &(0x7f0000000000)='security.ima\x00', &(0x7f0000000040)=@md5={0x1, "24950d79bb4caae9554e530641cfee28"}, 0x11, 0x3) 03:37:27 executing program 0: r0 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) r1 = inotify_add_watch(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x8) inotify_rm_watch(r0, r1) r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) [ 530.738337] binder: undelivered TRANSACTION_COMPLETE [ 530.744313] binder: release 26601:26608 transaction 1469 out, still active [ 530.758304] binder_alloc: 3591: binder_alloc_buf size -2834848451118676736 failed, no address space [ 530.774306] binder: 26606:26620 unknown command 536871488 [ 530.777450] binder: undelivered TRANSACTION_COMPLETE 03:37:27 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x0, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x48) socketpair(0x1, 0x80000, 0x7fffffff, &(0x7f0000000240)) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f00000005c0)={0x80000000000000, 0x7}, 0x4) syz_genetlink_get_family_id$team(&(0x7f0000000180)='team\x00') getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) getsockopt$inet_mreqn(r0, 0x0, 0x0, &(0x7f0000000300)={@initdev, @remote}, &(0x7f0000000480)=0xc) getpeername$packet(r1, &(0x7f00000004c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000500)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) getpeername$packet(r3, 0x0, &(0x7f0000004d80)) getsockopt$inet6_mreq(r2, 0x29, 0x1b, &(0x7f0000004dc0)={@local}, 0x0) ioctl$sock_ifreq(0xffffffffffffffff, 0x891d, 0x0) connect$inet(r0, &(0x7f0000000340)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) [ 530.786487] binder_alloc: allocated: 9552 (num: 405 largest: 32), free: 2736 (num: 1 largest: 2736) [ 530.810183] binder: 26622:26626 unknown command 536872064 [ 530.815498] binder: 26619:26628 unknown command 153903872 [ 530.815809] binder: 26622:26626 ioctl c0306201 20000440 returned -22 [ 530.823973] binder: 26606:26620 ioctl c0306201 20000440 returned -22 [ 530.836456] binder: 26607:26625 got transaction with invalid offset (0, min 0 max 24) or object. [ 530.844170] binder: 26619:26628 ioctl c0306201 20000440 returned -22 [ 530.846002] binder: 26604:26611 transaction failed 29201/-28, size 0--2834848451118676736 line 3155 [ 530.863949] binder: 26607:26632 BC_ACQUIRE_DONE u0000000000000000 no match [ 530.867299] binder: 26607:26625 transaction failed 29201/-22, size 24-8 line 3230 [ 530.875250] binder: 26619:26628 unknown command 153903872 [ 530.882732] binder: 26622:26633 unknown command 536872064 03:37:27 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) r1 = dup(r0) ioctl$EVIOCGPHYS(r1, 0x80404507, &(0x7f00000000c0)=""/140) ioctl$TIOCGPGRP(r1, 0x540f, &(0x7f0000000040)=0x0) sendmsg$nl_generic(r1, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20500}, 0xc, &(0x7f0000000080)={&(0x7f00000004c0)={0x48c, 0x11, 0x0, 0x70bd2b, 0x25dfdbfd, {0x1e}, [@typed={0x8, 0x19, @fd=r1}, @nested={0x1c8, 0x7f, [@generic="125f335aa6ffd580ebe88f4d69d88f8b39250260674bdca4484f509f47015041e552c80aa94e5f0ea56b17ad3c62d4e03be9847c82b146ca2cd552139fa0c3df34e237b8a86dfdb039c3be8c2404fa0940b968ecf177b52e09cda0eff50e69c6cf486d6815967b2042200a3300ca4e4f3472d6ccf77eb170f1175eba5504", @generic="0b3e7f9d9b47cd79b46a05e25cc561ee93831bf40c9a44468ceb46b27f0e9db28e0c1b97b18572a8014c92cd0080b8f8182904559fde20abeb4b36fc425c0997cbcec9766c6b6894c70c720e6bd802aecc88b3c07615d2309dc3c05fa4ecb99586ef30d48979c8be84a2acc98c2e154e575327314e7d06f1f45ca29e9afa5f6b29dd65248938daddb8c34f1a38a3ddeae345adc1c7073348b3c8a1668c0af47495193ed49511ddd58a69357ddf17a9c540ee820014d6b50b23be958dc1a35dab026f1914e5fc0ad9fa5d26f6bae45025899309f936ec912f7c37d321b702003d932f26f81437c476d2561c1b77b26906", @generic="3082ecac56551d29893eb3383f73f79217ccef9c963f2e07130828648503ee9b8570090653fb8ed3f8b467ae3be828a663c5540585d6e2bb46438eb5e6412418124e82f0cbbebfbad49298647d459c8f78b6a952"]}, @nested={0x1a0, 0x35, [@typed={0xc, 0x42, @u64=0x1}, @generic="58eabda24dbabb58fcd6f7448304255b0f478eddc489a32db8cca5ae86d3038f4dad60cae07938bed2c27898240719ff5933eda21ae2362f601aeba76795fc841b3994e790da7b40219d9e835c24c169e16cb7ca187fca8bc2899e44fa3738222cecc83199282a0183524f4328b1763becdc8248df8b88ff7dee4fd987003539f7af59e43a08cfb6d77abfcaa0abb1433c2540f49671d4b88014c7719d1e6bb998bbcf5bbba28f9191176e03598c5d1eee22c4f079435d961b72e952cea8d7e85c47bcbb9608832142ca1288b3d7f2bda767a4d4191d19f35ed225c5", @typed={0xb4, 0x50, @binary="8d6fc511d6f1bf8523e1cdd65312940e29269b69c32408fe788bea486d914db236b1c141de89ad8eb677cbeb6dd9975955ff9f89c23df70213c20e9e54a975760f16d6ba19377b8653bb8866d764207f585969bd0eae94676323962501b619874e9fc328265db6d26efe32e7c248a707ef4d70bf615ee301107bff685be89fa2f89249462b4a0e87664d718340f062e8a630f377aff1e2c2abd5a715bae86d69c462dd35b29ef4bfa41223daf406a6"}]}, @nested={0x4c, 0x1f, [@typed={0x14, 0x13, @ipv6=@mcast1}, @typed={0x8, 0x8f, @pid=r2}, @typed={0x14, 0x4e, @ipv6=@remote}, @generic="cf0f49898c280de6dac5b5cdf41551bf01e5a96bdaf3"]}, @generic="cacc2d55dd6a302842e14f7d1910af10a8d9bb9c39c51b2eff7afd395c2141cde62961fdc6bddb98cb381126dd10ed360916bdbb3c05bdd0b18161f664b3b313143c5cae5a84756b7e843a91c8a94fc26dbcc3f9ffe29479d40c0d1fb739cd0367dcd729aabed47007a6ba60a052a8d418a5fdceda1246f3594eccafc6e9f0890f03625fec246804e462085c20c28d45207243cfb05eef", @typed={0x24, 0x16, @binary="6a9ba678f36b0fd4f8fcc1050994b8d4cba398257cc8dd1934f044bf4cb8c285"}]}, 0x48c}, 0x1, 0x0, 0x0, 0x20044880}, 0x4000040) 03:37:27 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x0, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x48) socketpair(0x1, 0x80000, 0x7fffffff, &(0x7f0000000240)) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f00000005c0)={0x80000000000000, 0x7}, 0x4) syz_genetlink_get_family_id$team(&(0x7f0000000180)='team\x00') getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) getsockopt$inet_mreqn(r0, 0x0, 0x0, &(0x7f0000000300)={@initdev, @remote}, &(0x7f0000000480)=0xc) getpeername$packet(r1, &(0x7f00000004c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000500)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) getpeername$packet(r3, 0x0, &(0x7f0000004d80)) getsockopt$inet6_mreq(r2, 0x29, 0x1b, &(0x7f0000004dc0)={@local}, 0x0) ioctl$sock_ifreq(0xffffffffffffffff, 0x891d, 0x0) connect$inet(r0, &(0x7f0000000340)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) 03:37:27 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@', @ANYPTR], 0x0, 0x0, 0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000000c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000340)={r3}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x80, 0x0, &(0x7f00000001c0)=[@dead_binder_done={0x40086310, 0x3}, @acquire_done={0x40106309, r1, 0x3}, @exit_looper, @register_looper, @increfs_done={0x40106308, r2, 0x1}, @transaction={0x40406300, {0x2, 0x0, 0x2, 0x0, 0x11, 0x0, 0x0, 0x58, 0x10, &(0x7f0000000100)=[@ptr={0x70742a85, 0x1, &(0x7f0000000080), 0x1, 0x3, 0x39}, @fd={0x66642a85, 0x0, r0, 0x0, 0x3}, @flat={0x776a2a85, 0x10a, r3}], &(0x7f0000000180)=[0x38, 0x18]}}], 0x43, 0x0, &(0x7f0000000240)="0b000aa6f0e3ec58e9839284758302dde9754d8cec79b37c2d56f7aa72fa428054e7497430b9ee1d35eea4915bcd7d74963fe0a520ab549549777a4005ba01ca443ad2"}) [ 530.890785] binder: 26604:26617 ioctl c018620b 0 returned -14 [ 530.895734] binder: 26622:26633 ioctl c0306201 20000440 returned -22 [ 530.899940] binder_alloc: 3591: binder_alloc_buf size -2834848451118676736 failed, no address space [ 530.914369] binder: undelivered TRANSACTION_ERROR: 29201 [ 530.931632] binder: 26619:26628 ioctl c0306201 20000440 returned -22 [ 530.962122] binder: 26638:26640 unknown command 536872064 [ 530.968192] binder: 26638:26640 ioctl c0306201 20000440 returned -22 [ 530.973472] binder_alloc: allocated: 9552 (num: 405 largest: 32), free: 2736 (num: 1 largest: 2736) [ 530.985267] binder: 26604:26617 transaction failed 29201/-28, size 0--2834848451118676736 line 3155 [ 530.987624] binder: 26638:26640 ioctl 80404507 200000c0 returned -22 [ 530.995626] binder: undelivered TRANSACTION_ERROR: 29201 [ 531.012359] binder: 26641:26644 BC_DEAD_BINDER_DONE 0000000000000003 not found [ 531.027694] binder: 26641:26644 BC_ACQUIRE_DONE u0000000000000000 no match [ 531.038648] binder: 26638:26647 ioctl 540f 20000040 returned -22 [ 531.039843] binder: 26641:26644 ERROR: BC_REGISTER_LOOPER called without request [ 531.053649] binder: 26641:26644 BC_INCREFS_DONE u0000000000000000 no match [ 531.053945] binder: 26638:26640 unknown command 536872064 [ 531.061212] binder: 26641:26644 got transaction to invalid handle [ 531.069319] binder: 26638:26647 ioctl 80404507 200000c0 returned -22 [ 531.073452] binder: 26638:26648 ioctl 540f 20000040 returned -22 [ 531.080666] binder: 26638:26640 ioctl c0306201 20000440 returned -22 [ 531.086118] binder: 26641:26644 transaction failed 29201/-22, size 88-16 line 3018 [ 531.104677] binder: 26641:26649 BC_DEAD_BINDER_DONE 0000000000000003 not found [ 531.115692] binder: 26641:26649 BC_ACQUIRE_DONE u0000000000000000 no match [ 531.123588] binder: 26641:26649 ERROR: BC_REGISTER_LOOPER called without request [ 531.131515] binder: 26641:26649 BC_INCREFS_DONE u0000000000000000 no match [ 531.143734] binder: 26641:26649 got transaction to invalid handle [ 531.150905] binder: release 26641:26644 transaction 1474 out, still active [ 531.158087] binder: 26641:26649 transaction failed 29201/-22, size 88-16 line 3018 [ 531.166355] binder: undelivered TRANSACTION_COMPLETE [ 531.171885] binder: undelivered TRANSACTION_ERROR: 29201 [ 531.177603] binder: release 26641:26644 transaction 1476 out, still active [ 531.188223] binder: undelivered TRANSACTION_COMPLETE [ 531.193641] binder: undelivered TRANSACTION_ERROR: 29201 03:37:28 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040), 0x4) sched_rr_get_interval(0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') 03:37:28 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000040)={{{@in6, @in6=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in=@multicast2}}, &(0x7f0000000140)=0xe8) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000180)={0x0, 0x0, 0x0}, &(0x7f00000001c0)=0xc) chown(&(0x7f0000000000)='./file0\x00', r1, r2) 03:37:28 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x0, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x48) socketpair(0x1, 0x80000, 0x7fffffff, &(0x7f0000000240)) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f00000005c0)={0x80000000000000, 0x7}, 0x4) syz_genetlink_get_family_id$team(&(0x7f0000000180)='team\x00') getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) getsockopt$inet_mreqn(r0, 0x0, 0x0, &(0x7f0000000300)={@initdev, @remote}, &(0x7f0000000480)=0xc) getpeername$packet(r1, &(0x7f00000004c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000500)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) getpeername$packet(r3, 0x0, &(0x7f0000004d80)) getsockopt$inet6_mreq(r2, 0x29, 0x1b, &(0x7f0000004dc0)={@local}, 0x0) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000280)=0x32, 0x4) connect$inet(r0, &(0x7f0000000340)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) 03:37:28 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@', @ANYPTR], 0x0, 0x0, 0x0}) pipe2(&(0x7f0000000080)={0xffffffffffffffff}, 0x84000) getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x27, &(0x7f00000000c0)={@multicast1, @empty, 0x0}, &(0x7f0000000100)=0xc) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000140)={'irlan0\x00', r2}) nanosleep(&(0x7f0000000000)={0x0, 0x989680}, &(0x7f0000000040)) 03:37:28 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB]], 0x0, 0x0, 0x0}) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000080)='/dev/null\x00', 0x1a801, 0x0) ioctl$PPPIOCSDEBUG(r1, 0x40047440, &(0x7f00000000c0)=0x9) creat(&(0x7f0000000000)='./file0\x00', 0x0) 03:37:28 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 531.489233] binder: 26606:26613 ioctl c0306201 20000140 returned -14 [ 531.543572] binder: 26659:26665 ioctl c018620b 0 returned -14 [ 531.546798] binder: 26658:26664 unknown command 536872064 [ 531.551259] binder: 26660:26666 ioctl c018620b 0 returned -14 [ 531.556197] binder: 26655:26663 ioctl c018620b 0 returned -14 [ 531.574309] binder: 26658:26664 ioctl c0306201 20000440 returned -22 [ 531.583935] binder: 26655:26663 ioctl c018620b 0 returned -14 03:37:28 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) r2 = mmap$binder(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x0, 0x61030, r0, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={r2}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r3) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000040)={'team0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'veth0\x00', r4}) [ 531.589439] binder: release 26657:26662 transaction 1479 out, still active [ 531.593106] binder: 26658:26664 unknown command 536872064 [ 531.602374] binder: undelivered TRANSACTION_COMPLETE [ 531.612637] binder: 26659:26672 BC_ACQUIRE_DONE u0000000000000000 no match [ 531.620607] binder: 26660:26673 unknown command 536871488 [ 531.630879] binder: 26658:26664 ioctl c0306201 20000440 returned -22 03:37:28 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) arch_prctl$ARCH_MAP_VDSO_X32(0x2001, 0x9) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@', @ANYPTR], 0x0, 0x0, 0x0}) [ 531.631379] binder: release 26655:26663 transaction 1481 out, still active [ 531.642413] binder: 26660:26673 ioctl c0306201 20000440 returned -22 [ 531.675892] binder: 26674:26680 ioctl c018620b 0 returned -14 [ 531.693043] binder: undelivered TRANSACTION_COMPLETE [ 531.705905] binder: release 26655:26663 transaction 1480 out, still active [ 531.708642] binder: 26674:26680 ioctl c018620b 0 returned -14 [ 531.722579] binder: undelivered TRANSACTION_COMPLETE 03:37:28 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) [ 531.740214] binder: release 26657:26662 transaction 1478 out, still active [ 531.755483] binder: undelivered TRANSACTION_COMPLETE 03:37:28 executing program 5: r0 = syz_open_pts(0xffffffffffffffff, 0x0) ioctl$TIOCSWINSZ(r0, 0x5414, &(0x7f0000000200)={0x9, 0x5d51, 0x400, 0x5}) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="007a407f", @ANYPTR], 0x0, 0x0, 0x0}) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100)='/dev/zero\x00', 0x201, 0x0) ioctl$PIO_SCRNMAP(r2, 0x4b41, &(0x7f0000000140)="1a163bb60979a30357e6f097e4f6bf440470522bfbaf28598a27cf0c80e3cd0f599c1c3bc5d17b87281ada1e34d66f4478b1a79278e393097cdbc8b4ae486a0b13334697d5276003c0854fbedf039623e6fbff555f3701d4199655c985c2fa0b58e5f9cf219b64d0d4463ef67a59367af5b42f5a2a070d51c97f20c78b9c285291e48386b9486dc7ad6171fd0d0c6861e90bbeb112a90e9b9af1e180cd") setsockopt$inet6_tcp_TCP_MD5SIG(r1, 0x6, 0xe, &(0x7f0000000000)={@in={{0x2, 0x4e21, @rand_addr=0x2}}, 0x0, 0x4, 0x0, "28df21e6557539f0f79fa92111881c6aed4704fb77705d56a711d718b27d03d8246d83c834134fc71a418ec180a6aaf5c280d96d050120b0c258d9bd6519aa758dcc563421b3b650f4c419e5fdae932e"}, 0xd8) 03:37:28 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000de1f000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) 03:37:28 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB='\x00k']], 0x0, 0x0, 0x0}) openat$keychord(0xffffffffffffff9c, &(0x7f0000000000)='/dev/keychord\x00', 0x2, 0x0) ioctl$sock_inet_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, &(0x7f0000000100)) fallocate(r0, 0x0, 0x6, 0x8) execve(&(0x7f0000000080)='./file0\x00', &(0x7f00000003c0)=[&(0x7f00000000c0)='u+@\x00', &(0x7f0000000140)='/dev/keychord\x00', &(0x7f0000000180)='\x00', &(0x7f00000001c0)='/dev/keychord\x00', &(0x7f0000000200)='\x00', &(0x7f0000000240)='/dev/keychord\x00', &(0x7f0000000280)='/dev/binder#\x00', &(0x7f00000002c0)='/dev/keychord\x00', &(0x7f0000000340)='/dev/keychord\x00', &(0x7f0000000380)='system\x00'], &(0x7f0000000600)=[&(0x7f00000004c0)='cgroup\x00', &(0x7f0000000500)='\x00', &(0x7f0000000540)='/dev/keychord\x00', &(0x7f0000000580)='/dev/keychord\x00', &(0x7f00000005c0)=',@md5sum[^\x00']) [ 531.790680] binder: release 26676:26683 transaction 1485 out, still active [ 531.798469] binder: undelivered TRANSACTION_COMPLETE [ 531.851362] binder: release 26674:26689 transaction 1486 out, still active [ 531.865891] binder: 26698:26702 unknown command 2134931968 [ 531.876243] binder: undelivered TRANSACTION_COMPLETE [ 531.885174] binder: 26698:26702 ioctl c0306201 20000440 returned -22 [ 531.892861] binder: 26700:26705 ioctl c018620b 0 returned -14 [ 531.893199] binder: 26703:26704 unknown command 536872064 [ 531.899107] binder: release 26674:26680 transaction 1483 out, still active [ 531.912790] binder: 26700:26705 got transaction with invalid data ptr [ 531.919654] binder: 26700:26705 transaction failed 29201/-14, size 31-0 line 3186 [ 531.922135] binder: 26703:26704 ioctl c0306201 20000440 returned -22 [ 531.927865] binder: undelivered TRANSACTION_COMPLETE [ 531.939798] binder: 26698:26706 unknown command 2134931968 [ 531.940565] binder: 26700:26705 ioctl c018620b 0 returned -14 [ 531.946122] binder: 26698:26706 ioctl c0306201 20000440 returned -22 [ 531.951784] binder: release 26676:26681 transaction 1484 out, still active [ 531.966033] binder: 26700:26709 got transaction with invalid data ptr [ 531.972885] binder: 26700:26709 transaction failed 29201/-14, size 31-0 line 3186 [ 531.975274] binder: 26703:26704 unknown command 536872064 [ 531.980782] binder: undelivered TRANSACTION_COMPLETE [ 531.993066] binder: undelivered TRANSACTION_ERROR: 29201 [ 531.994028] binder: 26703:26704 ioctl c0306201 20000440 returned -22 [ 532.007513] binder: undelivered TRANSACTION_ERROR: 29201 03:37:29 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040), 0x4) sched_rr_get_interval(0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') 03:37:29 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) ioctl$PPPIOCSCOMPRESS(r1, 0x4010744d) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x3c2, 0x0, 0x0}) shutdown(r1, 0x0) 03:37:29 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="00634040a1895d12fef3345a95cdbff06c3bb793eb2092bec8af64fc76a6c798e7529c9b6f5c1a8cbb64e8f1c550f86e9d66a0fab7c4a264539bf643a12a706a3499df9a603b05106002450eec264843b13471c6ca7a399b91c7b67f4ec06870f7fcc7a0d5550f203efacfcf4613c9cb2600000000000000000000000000000000f52f7d0bc5eb2f0b35d44af97ad9b48cfaf06cc923a749033c9a69b463f0702e785e3cc2834a63ddd635da1cf5ca517741c84e396ec17a2295b621a42c89b3dd2c36f100af86309d3e6d5979efb5c6153efd3ace6c8d263450d5a28a2fbe3e21616cebd0ba58b65fdf2fd8515b5b8e3a60c03b4042df4815ac8a63f46a60afe12ee61c4f9e38f14144a2b5000000000000000093d7a6ad3c83b3f4695fbae3114f9aad592b4f926d6f958dd5f6ffa9df3a80b7366ecd1c0857f3dd33390e6629789e50ed8c37b538b98d6cdef9a62c11c08d0de305400b1719efd1596df43edf3b743381b248509270ceb7199493faa9d90ffae76c2b368041bb541f05f3cd6249ead38ee45727065d0fc5d3d44aad29168db943c89b75195dcf37abbf9e01807e314f980e8ef77d8041dd5c890fe78c2f681a5da3", @ANYPTR], 0x0, 0x0, 0x0}) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000000040)={{{@in=@multicast2, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in6=@loopback}}, &(0x7f0000000140)=0xe8) ioctl$sock_inet6_SIOCADDRT(r1, 0x890b, &(0x7f0000000180)={@local, @local, @mcast2, 0x5, 0xf91c, 0x100000100, 0x500, 0x2d41, 0x1, r2}) 03:37:29 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) 03:37:29 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x0, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x48) socketpair(0x1, 0x80000, 0x7fffffff, &(0x7f0000000240)) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x1000000000002, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f00000005c0)={0x80000000000000, 0x7}, 0x4) syz_genetlink_get_family_id$team(&(0x7f0000000180)='team\x00') getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) getsockopt$inet_mreqn(r0, 0x0, 0x0, &(0x7f0000000300)={@initdev, @remote}, &(0x7f0000000480)=0xc) getpeername$packet(r1, &(0x7f00000004c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000500)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) getpeername$packet(r2, 0x0, &(0x7f0000004d80)) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000280)=0x32, 0x4) connect$inet(r0, &(0x7f0000000340)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) 03:37:29 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 532.347253] binder: 26660:26666 ioctl c0306201 20000140 returned -14 [ 532.353974] binder: release 26659:26672 transaction 1482 out, still active [ 532.367432] binder: undelivered TRANSACTION_COMPLETE [ 532.413416] binder: 26717:26722 ioctl c018620b 0 returned -14 [ 532.419609] binder: 26720:26723 got transaction to invalid handle [ 532.422138] binder: 26718:26724 ioctl c018620b 0 returned -14 [ 532.427693] binder: 26721:26726 ioctl c018620b 0 returned -14 [ 532.440728] binder: 26715:26725 unknown command 536872064 [ 532.441376] binder: 26717:26722 ioctl c0306201 20000440 returned -14 [ 532.450703] binder: 26715:26725 ioctl c0306201 20000440 returned -22 03:37:29 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000180)=ANY=[@ANYBLOB="00afef3bf4095ee417b491e65ecb6d7016dd888258d271b9cf470167e858bbf859bf5374e06f2e9043966186ee7e31669cc5aeeae32637b0a3bc92e61910c436a66aef683008b577f000380771fe915e9a06af3033ba3d55ec1c92c64d549fd6a5d2b7ba83f8da40b80037938c102d5c7308f973cdbba0ac4d328a2cfb56391fc950df8618b44deba25103de69f82ec56b067d17b3e774e1652936793e74ba8084f37e90803b00000000000000000000000000005e9cfc7101ff23f1ce2af355a241fd73609c68d868301e03ccecbc931af5e6946f164d70e43461a207d198a931831ad6d68267e593eb26ff4b84ae74536c03d12292d45b73de9e20514e91570f291f6771f6ab67de13d684b0ba8a11058ea030e762b8e4f862cef8c1abec6ec146d6dc24ecb7fbd92a3253822ac304284528205fc6f6b383106e33125fe31ed33e4147ab8f4a9e7a815709915ff6415d25ecdf1c4c699bdc2134a9a1f13c04e8d42cf9c844d853bb0bf75fa3"]], 0x0, 0x0, 0x0}) [ 532.455407] binder: 26720:26723 transaction failed 29201/-22, size -1015450959299847057--387196741596196667 line 3018 [ 532.477027] binder: 26717:26722 ioctl c018620b 0 returned -14 [ 532.485595] binder: 26717:26730 ioctl c0306201 20000440 returned -14 [ 532.495046] binder: 26718:26732 BC_ACQUIRE_DONE u0000000000000000 no match [ 532.502549] binder: 26720:26723 got transaction to invalid handle 03:37:29 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000040)={&(0x7f0000000000)='./file0\x00'}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000023a600000000000000000000000000000000000000000000000000008495724dafe480100000000000000000000000000000"], 0x0, 0x0, 0x0}) [ 532.510648] binder: 26720:26723 transaction failed 29201/-22, size -1015450959299847057--387196741596196667 line 3018 [ 532.523074] binder: undelivered TRANSACTION_ERROR: 29201 [ 532.529515] binder: 26721:26736 unknown command 536871488 [ 532.540458] binder: undelivered TRANSACTION_ERROR: 29201 [ 532.552186] binder: 26721:26736 ioctl c0306201 20000440 returned -22 03:37:29 executing program 5: r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/checkreqprot\x00', 0x4a400, 0x0) r1 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) ioctl$LOOP_CTL_ADD(r0, 0x4c80, r1) r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000480)={{{@in=@multicast1, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in=@initdev}}, &(0x7f0000000280)=0xe8) lsetxattr$security_capability(&(0x7f0000000200)='./file0/file0\x00', &(0x7f0000000240)='security.capability\x00', &(0x7f00000002c0)=@v3={0x3000000, [{0x9, 0x40}, {0x8, 0x7fffffff}], r3}, 0x18, 0x1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@', @ANYPTR], 0x0, 0x0, 0x0}) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_inet_SIOCGIFNETMASK(r4, 0x891b, &(0x7f0000000080)={'ipddp0\x00', {0x2, 0x4e22, @multicast1}}) r5 = creat(&(0x7f0000000000)='./file0\x00', 0x5) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r2, &(0x7f0000000040)={0x80000002}) mount$bpf(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x80000, &(0x7f0000000180)=ANY=[@ANYBLOB="61756469742c7375626a5f747970653d7d2c6d61736b3d5e4d41595f415050454e442c66736e616d653d2f73656c696e75782f636865636b726580000000000000006d61636b66737472616e736d7574653d697064647030002c00"]) [ 532.564079] binder: 26735:26737 unknown command 536871296 [ 532.595238] binder: 26735:26737 ioctl c0306201 20000440 returned -22 [ 532.602801] binder: 26739:26744 ioctl c018620b 0 returned -14 03:37:29 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="ffe0"]], 0x0, 0x0, 0x0}) [ 532.619439] audit: type=1400 audit(2000000249.460:55): avc: denied { ioctl } for pid=26742 comm="syz-executor.5" path="socket:[81840]" dev="sockfs" ino=81840 ioctlcmd=0x891b scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 [ 532.648967] binder_alloc: 3591: binder_alloc_buf size -1968269357607550976 failed, no address space [ 532.672729] binder_alloc: allocated: 9688 (num: 418 largest: 32), free: 2600 (num: 1 largest: 2600) [ 532.682873] binder: 26747:26750 unknown command 536872064 [ 532.692272] binder: 26739:26746 transaction failed 29201/-28, size 0--1968269357607550976 line 3155 [ 532.702404] binder: 26747:26750 ioctl c0306201 20000440 returned -22 [ 532.703359] binder: release 26742:26749 transaction 1494 out, still active 03:37:29 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x10000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='mountinfo\x00') ioctl$UI_SET_SWBIT(r1, 0x4004556d, 0x2) 03:37:29 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) write$P9_RREAD(r0, &(0x7f0000000340)={0x67, 0x75, 0x2, {0x5c, "1c259964780ba6ebdcab776d4933dd133cdf7b4b223a69f1f97a10e502e751d423008c6d707fc53305172c2b2a300edf2eac734a08378a07bbe26be2000a358da5d9d5c654b8958df59aa00492d1d647482d72b7b84af4924829bc70"}}, 0x67) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f0000000140)=0x0) get_robust_list(r1, &(0x7f00000002c0)=&(0x7f0000000280)={&(0x7f00000001c0)={&(0x7f0000000180)}, 0x0, &(0x7f0000000240)={&(0x7f0000000200)}}, &(0x7f0000000300)=0x18) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="337c642d3ccfdc1ef8143095fc0254d03d6f6cc4ed0d8e0f363d8902a1d0bb130dbad05bc828f1f6d2edbdaf88bccdfbb3e8da682f3628a6c6bd6e6a0462a2cb8466c075a414782846e3275de873bc489276f073e8", @ANYPTR], 0x0, 0x0, 0x0}) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r2, 0x6, 0x1, &(0x7f0000000100), 0x4) [ 532.720406] binder: 26739:26744 ioctl c018620b 0 returned -14 [ 532.728375] binder_alloc: 3591: binder_alloc_buf size -1968269357607550976 failed, no address space [ 532.744653] binder: undelivered TRANSACTION_COMPLETE [ 532.764386] binder: release 26742:26745 transaction 1492 out, still active [ 532.768205] binder_alloc: allocated: 9696 (num: 419 largest: 32), free: 2592 (num: 1 largest: 2592) [ 532.779832] binder: 26753:26756 unknown command 761560115 [ 532.789371] binder: 26753:26756 ioctl c0306201 20000440 returned -22 [ 532.793280] binder: 26752:26757 unknown command 536872064 [ 532.797342] binder: undelivered TRANSACTION_COMPLETE [ 532.801690] binder: 26752:26757 ioctl c0306201 20000440 returned -22 [ 532.813816] binder: 26739:26751 transaction failed 29201/-28, size 0--1968269357607550976 line 3155 [ 532.822845] binder: undelivered TRANSACTION_ERROR: 29201 [ 532.829219] binder: 26753:26758 unknown command 761560115 [ 532.836169] binder: 26753:26758 ioctl c0306201 20000440 returned -22 [ 532.836264] binder: undelivered TRANSACTION_ERROR: 29201 [ 532.852117] binder: 26752:26759 unknown command 536872064 [ 532.866398] binder: 26752:26759 ioctl c0306201 20000440 returned -22 03:37:30 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040), 0x4) sched_rr_get_interval(0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') 03:37:30 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) fcntl$notify(r0, 0x402, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000300)={0x48, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b63000000634040020000000000000003000000000000000000000010000000000000000000000018000000000000002000000000000000", @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="852a646600000000", @ANYRES32=r0, @ANYBLOB="0000549a0400000000000000"], @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00']], 0xfc, 0x0, &(0x7f0000000200)="06ab4d9945a1bec31b4e2de8b3330ad524542ce7b0a87f9fad8fc3dc33b3aaec7fa45fa071a06503a5bfcafb1bb664b30a0dcfd9a97c92420f02b900bc0d46f6600e6c0dbaaea3694b811ef2988cfe0a621f93523698863fdca795b4ed06c041a333d5c5b88050ccceecc623224d5efa5b5484cdd313054c7a47fe23a1a400dc4ccf6c76ee55ba08944f2202ab83010c3336c061a61ba7bc3d7381be5b8c718ef2b1bc5f161733b6f0418d4bb7992ed8880e36fb165f782d59f6a9c4870f971d01f42b3e65b6165e918594c039e86b5cd6f828e3f80cb4fc549f8836bfcffc2e138de7ea27567800733bef212ae05e1cdc24f44988f7b074d104185a"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040000000000000001c000000000000000000000000000000000000000000000000000000000000000000000000000090302f7b82b61059c4f304436500000000000000d4060000000000000000000ee1de4569cc240d99f50e60e3515ba83680e5a972252e64ae356830ddc9f1b7e1fd45ab3ec91c2675a7c53b4d2cc9cbedf4291cc12010ab72ae49453b9c350d88784e0401565bf3f7b1d3901b4cf5b94da60aa77019960f6c16b07b2b550c40c833c4d1aad3aee1e2ad1cea3619cb00c88d4eb8dc08c3037200c4"], 0x0, 0x0, 0x0}) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000340)='/dev/full\x00', 0x2, 0x0) write$apparmor_exec(r1, &(0x7f0000000380)={'stack ', '/dev/binder#\x00'}, 0x13) 03:37:30 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000280)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f0000000200)=ANY=[@ANYPTR64=&(0x7f0000000100)=ANY=[@ANYRESDEC=r0, @ANYRESHEX=r0, @ANYPTR64=&(0x7f0000000080)=ANY=[@ANYRES64=r0, @ANYPTR64, @ANYRES64=r0], @ANYRES64=r0, @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYPTR64, @ANYPTR64], @ANYRES64=r0, @ANYRESOCT, @ANYBLOB="6feb8294f26493f5b7f324565685d0f30eea18dbd6a6362602322867b81e6b02f54090edb8f81cef355678d7ffa94610821666a059ebb3563bf99ac53f780705851ebb82f8cffe9fd4262cc9796d55ff2e0dc5d481595240f43c26", @ANYPTR, @ANYRES16=r0], @ANYPTR], 0x0, 0x0, 0x0}) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4800) ioctl$TCGETA(r1, 0x5405, &(0x7f0000000240)) socket$packet(0x11, 0x3, 0x300) write$smack_current(r2, &(0x7f0000000040)='/dev/binder#\x00', 0xd) 03:37:30 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) ioctl$FITRIM(r0, 0xc0185879, &(0x7f0000000000)={0x7, 0x1f, 0xff}) 03:37:30 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x0, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x48) socketpair(0x1, 0x80000, 0x7fffffff, &(0x7f0000000240)) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x1000000000002, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f00000005c0)={0x80000000000000, 0x7}, 0x4) syz_genetlink_get_family_id$team(&(0x7f0000000180)='team\x00') getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) getsockopt$inet_mreqn(r0, 0x0, 0x0, &(0x7f0000000300)={@initdev, @remote}, &(0x7f0000000480)=0xc) getpeername$packet(r1, &(0x7f00000004c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000500)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000280)=0x32, 0x4) connect$inet(r0, &(0x7f0000000340)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) 03:37:30 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 533.214415] binder: 26721:26726 ioctl c0306201 20000140 returned -14 [ 533.214530] binder: release 26718:26732 transaction 1490 out, still active [ 533.228375] binder: undelivered TRANSACTION_COMPLETE [ 533.256821] binder: 26767:26769 ioctl c018620b 0 returned -14 [ 533.264233] binder: 26768:26771 unknown command 536871168 [ 533.267181] binder: 26773:26775 ioctl c018620b 0 returned -14 [ 533.270322] binder: 26770:26774 unknown command 536872064 [ 533.276835] binder: 26772:26776 ioctl c018620b 0 returned -14 [ 533.288017] binder: 26767:26769 ERROR: BC_REGISTER_LOOPER called without request [ 533.291439] binder: 26768:26771 ioctl c0306201 20000440 returned -22 [ 533.303206] binder: 26767:26769 got transaction to invalid handle [ 533.304178] binder: 26770:26774 ioctl c0306201 20000440 returned -22 [ 533.317120] binder: 26770:26779 ioctl c0185879 20000000 returned -22 [ 533.317256] binder: 26767:26769 transaction failed 29201/-22, size 24-32 line 3018 [ 533.326714] binder: 26770:26774 unknown command 536872064 [ 533.334739] binder_alloc: 3591: binder_alloc_buf size 3499296910466875392 failed, no address space [ 533.337622] binder: 26770:26779 ioctl c0185879 20000000 returned -22 03:37:30 executing program 0: pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x84000) chmod(&(0x7f0000000040)='./file0\x00', 0x8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040), 0xa4, 0x0, &(0x7f0000000080)="0165fbe1ceaa4c275632f6db91f0dfbd82188ed0a11029650f34c4d31aec9e8add1e010a002c1a5a118c18fddd812ec0aab2af1291f5178ee7fc2cf6dea40664eccca234358db3b6e54e93f90c7c66fb5d5db3401c4f8605767a8799e2dbdba4293d6ca02b11b2007bd64b0563da1301eb1f49b63e941a705fe2cb21caa065103eb6ebeeccfa63a96c016b3ad51cbb9549087f5abc0e184603c17c8c171eb44087e19aef"}) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) [ 533.347883] binder: 26772:26781 unknown command 536871488 [ 533.357513] binder: 26770:26774 ioctl c0306201 20000440 returned -22 [ 533.360663] binder: 26768:26771 unknown command 536871168 [ 533.371338] binder_alloc: allocated: 9696 (num: 419 largest: 32), free: 2592 (num: 1 largest: 2592) [ 533.383974] binder: 26772:26781 ioctl c0306201 20000440 returned -22 [ 533.391993] binder: 26768:26771 ioctl c0306201 20000440 returned -22 [ 533.395064] binder: 26786:26787 unknown command 536872064 [ 533.405748] binder: 26767:26780 transaction failed 29201/-28, size 0-3499296910466875392 line 3155 [ 533.414599] binder: 26773:26789 BC_ACQUIRE_DONE u0000000000000000 no match [ 533.422843] binder: 26786:26787 ioctl c0306201 20000440 returned -22 [ 533.425096] binder: 26767:26769 ioctl c018620b 0 returned -14 [ 533.432874] binder: 26786:26790 unknown command 536872064 [ 533.441482] binder: 26767:26792 ERROR: BC_REGISTER_LOOPER called without request [ 533.445890] binder: 26786:26790 ioctl c0306201 20000440 returned -22 03:37:30 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@', @ANYPTR], 0x0, 0x0, 0x0}) 03:37:30 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="b7747e731406562f2d8211030000002005fb830174c3e19d45de9b39cf9f0f165e13dfeade6c3717"]], 0x0, 0x0, 0x0}) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) ioctl$BLKTRACESTART(r1, 0x1274, 0x0) write$P9_RLCREATE(r2, &(0x7f0000000080)={0x18, 0xf, 0x2, {{0x8, 0x2, 0x7}, 0x5}}, 0x18) [ 533.458812] binder: 26767:26792 got transaction to invalid handle [ 533.480266] binder: 26767:26792 transaction failed 29201/-22, size 24-32 line 3018 [ 533.488412] binder_alloc: 3591: binder_alloc_buf size 3499296910466875392 failed, no address space [ 533.500359] binder: undelivered TRANSACTION_ERROR: 29201 [ 533.512421] binder: 26796:26798 unknown command 536870912 [ 533.515466] binder_alloc: allocated: 9720 (num: 420 largest: 32), free: 2568 (num: 1 largest: 2568) [ 533.518270] binder: 26796:26798 ioctl c0306201 20000440 returned -22 [ 533.537675] binder: 26796:26798 unknown command 536870912 [ 533.547034] binder: 26796:26798 ioctl c0306201 20000440 returned -22 [ 533.547956] binder: 26767:26769 transaction failed 29201/-28, size 0-3499296910466875392 line 3155 03:37:30 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0xfffffffffffffffe) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@', @ANYPTR], 0x0, 0x0, 0x0}) 03:37:30 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) futex(&(0x7f0000000000)=0x2, 0xa61d21dafc92a234, 0x2, &(0x7f0000000080)={r1, r2+10000000}, &(0x7f00000000c0), 0x1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 533.561551] binder: release 26794:26797 transaction 1502 out, still active [ 533.579298] binder: undelivered TRANSACTION_COMPLETE [ 533.590546] binder: undelivered TRANSACTION_ERROR: 29201 [ 533.598665] binder: release 26794:26797 transaction 1501 out, still active 03:37:30 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="287b1600", @ANYPTR], 0x0, 0x0, 0x0}) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x4000, 0x0) ioctl$FIONREAD(r1, 0x541b, &(0x7f0000000080)) write$P9_RCREATE(r1, &(0x7f0000000040)={0x18, 0x73, 0x2, {{0x80, 0x3, 0x7}, 0x6}}, 0x18) [ 533.633942] binder: undelivered TRANSACTION_COMPLETE [ 533.650147] binder: 26805:26806 ioctl c018620b 0 returned -14 [ 533.671070] binder: 26805:26806 ioctl c018620b 0 returned -14 [ 533.673444] binder: 26807:26810 unknown command 1473320 [ 533.692205] binder: release 26805:26806 transaction 1503 out, still active [ 533.696871] binder: 26807:26810 ioctl c0306201 20000440 returned -22 [ 533.709171] binder: 26807:26810 unknown command 1473320 [ 533.709771] binder: undelivered TRANSACTION_COMPLETE [ 533.715684] binder: 26807:26810 ioctl c0306201 20000440 returned -22 03:37:30 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040), 0x4) sched_rr_get_interval(0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') 03:37:30 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x3) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) r1 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000000)) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r1, 0x6, 0x15, &(0x7f0000000040)=0x100, 0x4) 03:37:30 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) r1 = creat(&(0x7f00000000c0)='./file0\x00', 0x20) accept$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x0, @remote}, &(0x7f0000000140)=0x1c) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:37:30 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@', @ANYPTR], 0x0, 0x0, 0x0}) openat$zero(0xffffffffffffff9c, &(0x7f0000000040)='/dev/zero\x00', 0x400000, 0x0) openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x8000, 0x0) 03:37:30 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x0, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x48) socketpair(0x1, 0x80000, 0x7fffffff, &(0x7f0000000240)) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x1000000000002, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f00000005c0)={0x80000000000000, 0x7}, 0x4) syz_genetlink_get_family_id$team(&(0x7f0000000180)='team\x00') getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) getsockopt$inet_mreqn(r0, 0x0, 0x0, &(0x7f0000000300)={@initdev, @remote}, &(0x7f0000000480)=0xc) getpeername$packet(r1, &(0x7f00000004c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000500)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000280)=0x32, 0x4) connect$inet(r0, &(0x7f0000000340)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) 03:37:30 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 534.068618] binder: 26772:26776 ioctl c0306201 20000140 returned -14 [ 534.074355] binder: release 26773:26782 transaction 1498 out, still active [ 534.084073] binder: undelivered TRANSACTION_COMPLETE [ 534.113589] binder: 26821:26825 ioctl c018620b 0 returned -14 [ 534.119728] binder: 26819:26826 ioctl c018620b 0 returned -14 [ 534.123099] binder: 26818:26829 unknown command 536872064 [ 534.126654] binder: 26824:26827 ioctl c018620b 0 returned -14 [ 534.139934] binder: release 26820:26828 transaction 1504 out, still active [ 534.143372] binder: 26818:26829 ioctl c0306201 20000440 returned -22 [ 534.150322] binder: 26819:26826 ioctl c018620b 0 returned -14 03:37:31 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@', @ANYPTR], 0x0, 0x0, 0x0}) [ 534.161647] binder: undelivered TRANSACTION_COMPLETE [ 534.169889] binder: 26818:26829 unknown command 536872064 [ 534.174851] binder: release 26820:26828 transaction 1505 out, still active [ 534.181419] binder: 26818:26829 ioctl c0306201 20000440 returned -22 [ 534.189748] binder: 26835:26838 transaction failed 29189/-22, size 0-0 line 3018 [ 534.195289] binder: undelivered TRANSACTION_COMPLETE 03:37:31 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x12, 0x0, &(0x7f0000000000)=ANY=[@ANYRES64=r0], 0xffffff81, 0x0, 0x0}) [ 534.208362] binder: 26821:26839 BC_ACQUIRE_DONE u0000000000000000 no match [ 534.208385] binder: 26824:26840 unknown command 536871488 [ 534.223443] binder: 26835:26838 transaction failed 29189/-22, size 0-0 line 3018 [ 534.231053] binder: release 26819:26826 transaction 1507 out, still active [ 534.231061] binder: undelivered TRANSACTION_COMPLETE [ 534.231098] binder: release 26819:26826 transaction 1506 out, still active [ 534.231103] binder: undelivered TRANSACTION_COMPLETE [ 534.231987] binder: 26824:26840 ioctl c0306201 20000440 returned -22 03:37:31 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x7fe) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) [ 534.247480] binder: undelivered TRANSACTION_ERROR: 29189 03:37:31 executing program 5: syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x1) prctl$PR_SET_UNALIGN(0x6, 0x0) r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x20802, 0x0) ioctl$TUNSETTXFILTER(r0, 0x400454d1, &(0x7f0000000080)={0x1, 0x2, [@local, @remote]}) 03:37:31 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0xfffffe55, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) [ 534.295410] binder: undelivered TRANSACTION_ERROR: 29189 [ 534.316789] binder: 26844:26849 ioctl c018620b 0 returned -14 [ 534.338367] binder: 26844:26849 unknown command 3 03:37:31 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FIBMAP(r0, 0x1, &(0x7f0000000000)=0x81) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@', @ANYPTR], 0x0, 0x0, 0x0}) [ 534.365076] binder: 26844:26849 ioctl c0306201 20000440 returned -22 [ 534.380911] binder: 26853:26854 unknown command 536872064 [ 534.383132] binder: 26844:26849 ioctl c018620b 0 returned -14 [ 534.386539] binder: 26853:26854 ioctl c0306201 20000000 returned -22 [ 534.409526] binder: 26856:26858 ioctl 1 20000000 returned -22 [ 534.422544] binder: 26856:26858 ioctl 1 20000000 returned -22 [ 534.433176] binder: release 26856:26858 transaction 1511 out, still active [ 534.461836] binder: undelivered TRANSACTION_COMPLETE [ 534.474144] binder: release 26856:26859 transaction 1512 out, still active [ 534.482538] binder: undelivered TRANSACTION_COMPLETE 03:37:31 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040), 0x4) sched_rr_get_interval(0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') 03:37:31 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB]], 0x0, 0x0, 0x0}) 03:37:31 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) ioctl$EVIOCSABS0(r1, 0x401845c0, &(0x7f0000000040)={0x7fff, 0x8, 0x7, 0x9, 0x5, 0x3}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:37:31 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000)={0x0}, &(0x7f0000000040)=0xc) getresuid(&(0x7f0000000080), &(0x7f00000000c0)=0x0, &(0x7f0000000100)) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000140)={0x0, 0x0, 0x0}, &(0x7f0000000180)=0xc) setsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000001c0)={r2, r3, r4}, 0xc) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000009c00000000ebffffff000000000000000000000000000000000000002eb986318f9c7edf35b2889de30000000000000000000000000000"], 0x0, 0x0, 0x0}) 03:37:31 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x0, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x48) socketpair(0x1, 0x80000, 0x7fffffff, &(0x7f0000000240)) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x1000000000002, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f00000005c0)={0x80000000000000, 0x7}, 0x4) syz_genetlink_get_family_id$team(&(0x7f0000000180)='team\x00') getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) getsockopt$inet_mreqn(r0, 0x0, 0x0, &(0x7f0000000300)={@initdev, @remote}, &(0x7f0000000480)=0xc) getpeername$packet(r1, &(0x7f00000004c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000500)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000280)=0x32, 0x4) connect$inet(r0, &(0x7f0000000340)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) 03:37:31 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 534.910518] binder: release 26821:26839 transaction 1509 out, still active [ 534.917765] binder: 26824:26827 ioctl c0306201 20000140 returned -14 [ 534.935328] binder: undelivered TRANSACTION_COMPLETE [ 534.966088] binder: 26867:26873 ioctl c018620b 0 returned -14 [ 534.972389] binder: 26868:26872 ioctl c018620b 0 returned -14 [ 534.974222] binder: 26871:26875 ioctl c018620b 0 returned -14 [ 534.978896] binder: 26865:26869 ioctl c018620b 0 returned -14 [ 534.991396] binder: 26866:26876 unknown command 536872064 [ 535.001465] binder: 26868:26872 ioctl c018620b 0 returned -14 [ 535.007328] binder: 26866:26876 ioctl c0306201 20000440 returned -22 03:37:31 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x7fe) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x1, 0x0, &(0x7f00000001c0)=ANY=[@ANYRESOCT, @ANYPTR64=&(0x7f0000000240)=ANY=[@ANYRES32=r0, @ANYRESOCT=r0], @ANYPTR64, @ANYRESOCT=r0], 0x33, 0x0, 0x0}) [ 535.018037] binder: 26865:26869 transaction failed 29201/-22, size -8738903024400859136--8596749504678686927 line 3155 [ 535.044484] binder: release 26868:26872 transaction 1513 out, still active [ 535.048010] binder: 26867:26882 unknown command 536871488 [ 535.056467] binder: undelivered TRANSACTION_COMPLETE 03:37:31 executing program 0: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.swap.current\x00', 0x0, 0x0) ioctl$EVIOCGSW(r1, 0x8040451b, &(0x7f0000000080)=""/202) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="00af316801ab65fcfbfc7a444405d0bb011ad24479"]], 0x0, 0x0, 0x0}) 03:37:31 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:37:31 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000)={0x0}, &(0x7f0000000040)=0xc) getresuid(&(0x7f0000000080), &(0x7f00000000c0)=0x0, &(0x7f0000000100)) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000140)={0x0, 0x0, 0x0}, &(0x7f0000000180)=0xc) setsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000001c0)={r2, r3, r4}, 0xc) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000009c00000000ebffffff000000000000000000000000000000000000002eb986318f9c7edf35b2889de30000000000000000000000000000"], 0x0, 0x0, 0x0}) [ 535.063826] binder: 26867:26882 ioctl c0306201 20000440 returned -22 [ 535.079150] binder: 26871:26884 BC_ACQUIRE_DONE u0000000000000000 no match [ 535.100505] binder: undelivered TRANSACTION_ERROR: 29201 [ 535.123790] binder: 26886:26892 unknown command 536870912 [ 535.130854] binder: 26889:26891 ioctl c018620b 0 returned -14 [ 535.140364] binder: 26886:26892 ioctl c0306201 20000440 returned -22 [ 535.148999] binder: 26893:26895 ioctl c018620b 0 returned -14 [ 535.156930] binder: 26889:26896 ioctl c018620b 0 returned -14 [ 535.163878] binder: release 26889:26896 transaction 1517 out, still active 03:37:32 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='memory.events\x00', 0x0, 0x0) ioctl$EVIOCGPHYS(r0, 0x80404507, &(0x7f0000000040)=""/158) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0}) [ 535.167442] binder: 26893:26895 transaction failed 29201/-22, size -8738903024400859136--8596749504678686927 line 3155 [ 535.173719] binder: undelivered TRANSACTION_COMPLETE [ 535.191587] binder: 26886:26897 unknown command 536870912 [ 535.202037] binder: 26886:26897 ioctl c0306201 20000440 returned -22 [ 535.208839] binder: release 26889:26891 transaction 1516 out, still active 03:37:32 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000)={0x0}, &(0x7f0000000040)=0xc) getresuid(&(0x7f0000000080), &(0x7f00000000c0)=0x0, &(0x7f0000000100)) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000140)={0x0, 0x0, 0x0}, &(0x7f0000000180)=0xc) setsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000001c0)={r2, r3, r4}, 0xc) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000009c00000000ebffffff000000000000000000000000000000000000002eb986318f9c7edf35b2889de30000000000000000000000000000"], 0x0, 0x0, 0x0}) [ 535.223231] binder: undelivered TRANSACTION_COMPLETE [ 535.235158] binder: 26898:26900 ioctl c018620b 0 returned -14 [ 535.260996] binder: undelivered TRANSACTION_ERROR: 29201 [ 535.267206] binder: 26901:26903 ioctl c018620b 0 returned -14 [ 535.283103] binder: 26898:26900 ioctl c018620b 0 returned -14 [ 535.289622] binder: 26901:26903 transaction failed 29201/-22, size -8738903024400859136--8596749504678686927 line 3155 [ 535.321654] binder: undelivered TRANSACTION_ERROR: 29201 03:37:32 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040), 0x4) sched_rr_get_interval(0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') 03:37:32 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FIGETBSZ(0xffffffffffffff9c, 0x2, &(0x7f0000000000)) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r1, &(0x7f00000004c0)={'syz1\x00', {0x8, 0x5, 0x3, 0xffffffffffffffeb}, 0x8, [0x3, 0x5f, 0x3, 0x9cb7, 0x4, 0x8, 0x9, 0x1, 0xa60, 0x3ff, 0x3, 0xee32000000000000, 0xffff, 0x1, 0x800, 0x1ff, 0x401, 0x5, 0xd20, 0x4fc1daf5, 0x9, 0xfffffffffffff788, 0x2, 0x6, 0x5, 0x3f, 0x8000, 0x7fff, 0x0, 0x400, 0x9, 0xffff, 0x0, 0x1000, 0x5, 0x8, 0x8001, 0x1ff, 0x4, 0xe852, 0xd233, 0x6, 0x3, 0x0, 0x8f, 0x7, 0x9, 0x1, 0x91, 0x1000, 0x100000000, 0x200, 0x1fe0, 0xff, 0x0, 0x2, 0x18000000, 0x0, 0xd036, 0x1, 0x0, 0x8, 0x5, 0x6], [0x5, 0x1000000, 0x6, 0x1, 0xf2b, 0x7, 0x1, 0x10000, 0x40, 0x3f, 0x1, 0x7ff, 0x7, 0xf5, 0x8, 0x7fffffff, 0xa9f, 0x36, 0x6, 0x100, 0xfffffffffffffff9, 0x8000, 0x8000, 0x17d, 0x8001, 0x2, 0x5e, 0xbed8, 0x9, 0x3f, 0x8, 0x6, 0x7, 0x7, 0x2, 0x3, 0x800, 0x4a8, 0x2, 0x6, 0x0, 0x80000001, 0x400, 0x6b36, 0x1ff, 0x0, 0x40, 0x1, 0x80000001, 0x10001, 0x3f, 0x4366, 0xdfdd, 0x4c3791d4, 0x6441, 0x3, 0x2, 0x10001, 0x3fff8000000, 0x6, 0x3ff, 0xffffffffffffffff, 0x400], [0x1, 0x101, 0x2, 0x80000000, 0xfffffffffffffff9, 0x4, 0x1, 0x2, 0x8, 0x3, 0x200, 0x7fffffff, 0x1f, 0x3, 0x80000000, 0x4, 0x2, 0xdc, 0x3, 0xffff, 0x8, 0x1f, 0x7ff, 0x1, 0x8, 0xd7, 0x6bf2, 0xe0, 0x9, 0x3, 0x40, 0x3, 0xd8f, 0x0, 0x1, 0x6, 0x6, 0xb357, 0xb7, 0x9, 0x401, 0x8, 0x6, 0x10000, 0x4, 0xffff, 0xad8d, 0x5, 0x9, 0x8, 0x2, 0xff, 0xfff, 0x8, 0x7ff, 0x6, 0x9, 0xffff, 0x922, 0xe85, 0x9, 0x6, 0x4, 0x100000001], [0x2, 0xffffffffffffff7f, 0x100, 0xfffffffffffffff9, 0x8, 0x7, 0x4, 0xa4, 0x9, 0x200, 0xffffffff00000000, 0x7ff, 0xd9e, 0x41d, 0x5, 0x4, 0x0, 0x4, 0x0, 0x1, 0x10001, 0x7, 0x5, 0x3f, 0x2, 0x400, 0xee, 0x85, 0xf9, 0x7f00000, 0xbd05, 0x7fffffff, 0x9, 0x2, 0x7fffffff, 0x5, 0x0, 0x3, 0x2, 0x0, 0x94, 0x4, 0x7, 0x9, 0x10001, 0x0, 0x8, 0x3, 0xc8, 0xe4a, 0x0, 0x1, 0x3, 0x7e000000, 0x1f, 0x4, 0x4, 0x5, 0x1, 0x14d7, 0x7, 0xff, 0x10000, 0x20]}, 0x45c) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) 03:37:32 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) fcntl$F_GET_FILE_RW_HINT(r0, 0x40d, &(0x7f0000000000)) r1 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000040)='/dev/keychord\x00', 0x8000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="00635940000000000000000000000000000000000000000000000041056439f100000000000000000000000000000000000000000000000000000000000031602fc976cc6f4ebe82fd0990d1fb548422ddd0a7106b35302fa5b47a828c5e25660d533ada1b93027cc7533730be41fe52e0a00279b3ecd2730514f8862cb63a9e045480962c8a21cb65ccad8659a9959608b178a0327018cc6d3f26237bd2fb55e6e7667004d5765cac07000000000000006b14127133f24b"], 0x0, 0x0, 0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000001c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000200)={0x0}) write$P9_RREAD(r1, &(0x7f0000001480)={0x3f, 0x75, 0x2, {0x34, "2c6495cc47ef152b99c82cb846da4aeed91da4275a3bba91cb1fb4d2aeb26a40de52f38082ae780b6c30b4686604cd6ba6518cc3"}}, 0x3f) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xa8, 0x0, &(0x7f0000000300)=[@clear_death={0x400c630f, 0x2, 0x2}, @reply_sg={0x40486312, {{0x3, 0x0, 0x3, 0x0, 0x11, 0x0, 0x0, 0x20, 0x10, &(0x7f0000000080)=[@fda={0x66646185, 0x6, 0x3, 0xe}], &(0x7f0000000180)=[0x20, 0x40]}, 0xb2}}, @transaction_sg={0x40486311, {{0x2, 0x0, 0x4, 0x0, 0x1, 0x0, 0x0, 0x50, 0x28, &(0x7f0000000240)=[@flat={0x776a2a85, 0x100, r2, 0x3}, @fda={0x66646185, 0x9, 0x2, 0x2b}, @flat={0x736a2a85, 0x100, r3, 0x3}], &(0x7f00000002c0)=[0x18, 0x38, 0x60, 0x28, 0x38]}, 0x1}}], 0x1000, 0x0, &(0x7f0000000480)="a3d825dd5c27e88da373df3143e14d988bdea0058918c1f564874dc8edd11714f721c5657c2340fe3cb2c1797aafbc475960ccf3a4d085f5af587c3942c966adc170ec7d79f989acb809710e8ceff1c090a24eb10340a88932e8821522ecb3fee726c8c57b47f95b82a5e97d049773de5f56ec9f4d8c9cb94854f0d915a2090486f2e069341c90e40ce6319a91809bddec0f735b605caf7ee967e7343b5195b9fc85029c54de798c24ed8575511ea3ef856ab68a89076196ab28b35033d4df5cdad1a5ac563d01d668c3665c94b3d575d81242b083d0539eb36b586a2840c8a02528c8303b36871c369e390c6cbe76dce6d16b63d9ae22916462dc48a28f2deffc1d503bbf04af3f256c6f84d0d7a059471eaa2133420e4efda749568eef3e3b4ac10276e0a983d508d5ba3f1367bbb669986cfec0b048bf68fb8062dd42c235e930631afb8894218eddb5adb24fab1b7bb231ae1e8931b41397041601c57b4411fae6a2f49b2003a6f1009c62a9fc0bdcbd3eb44e33e62bda92b4d94576ede46195913f86ceaf3d05e3d5a7f76c620de96af0f2e97ca124b3346ecaf8614d147f18b7462a8d2c0c573ef5754eba79bbc9ef38ebf27c08aab4b208d5afa85d1e016b901730bb3a426785e88a8190dc8a412150c23f2b5b49da015b13a8b16d49c9619b6e8b5f22fcf4fe3b0ec0bc70f1316dc8b768c1f63bb18e763d2993e7b1e33ffa44fbf98ddcf6f613b71e6e9802402451b16cee5c077051d17ea6cb2d263dd13c6e21961b5e136554c1cbf6e4a8c27baa585cfa676f2243ce73a1f8c6616b92d315cb527e7d1190d2aac31fb786dc8e5a5f18c30dce20fae21e0fe6724ff3a08f8dd50717d428f3c847f84f5d0622b2ff70bab591848af4baee6e79bef32da222bad78e3223de9b0c2e8801bd47442e89360f0bc45f95821d18705d1a247ed6e86aec7328592d2543fbb9e922ddb6cecaba86d2165ff4da54186102b860e292b4b332ebd88b509d300c6d2386bc75ee0bdea4cd758397575ffe2c8a94627c218a85ded00f68300b9bec93448e5a583cbcfccb3bdd0b63db33775f55756d76330a1c95e24e1b293703c75ccd826d1b99ca844b5c8f3904aa46478cfeca72d4e5d1a7ee6ec4c5cbd7ae65327b4006397f82c03f7534ceca6cd07d0293960ad18aabe68fe4179e0d5b4f3a3218d4ac33d7f5adc3eee4e3e0edd87539f00fb3a42cca1963c703323b907eb3f6b040b96e9ec2c2d0e355157c71495637368aa7c82528e01a3d8b995a4533ce552a30278c99a0e36b204e9a1f5efde9714b37a777a74985bfa42d533c4a2fcf671c7895d6af8407f31d273bf1323b44c0342e34d89d70bf56a7d6bd50f476b6c15d0d951e214602e71917b21e047675835b07e752072e91ad530a7a676cfe566a8f987ecd6c13740180f4c29d9ed5944ee1580e730f82e689f747354a59518131d9113f5caf1ffc999e8d02ce310cb26fb9ec84d9acb1fa3f869ff7bfed34c8d768880c9424a710d24ab89ec726ea5617a0c50967d4ee0d1f617128cd057a91397384c7789a4214a78520c82c849979cd1ac9b7ec2d1bf0a651cadbd9f3a5f7e3d1f24fd8f5dd3608c0cf73830c0e247e24d67d8baa0ce358eb41697bd033144d1cdf4c23737e85da81adaddc28b9d5c61b8b9bb95fae6c36ea9d5f2af208c10929d11335d1066148cc734d4d1f693fb6d96b6c36653d590e0bf24f2fba7933931d3b50e6d70d2a75e82c61b10be2e53080513a3841dc1e91193df54e2a33ff7741a34b16db3d3d9d71b2a0fc84846fb485b31754b6d600e729da22e7e19a8f7d71bf0fdd3eca09b9a0563b0f9f71b283ea39f4d1106252e87129dd9ffe3e7ad5f5756173e48a55c8b409364e1eec61526ccb052d1faa86e1e1b3e8a963137e9ba6fa1d4524d1b949fc6dd404007ddae6afe0fbfa83b6d8f6f5a149ff304bf5475088e451b6b1674c358bcf85203b31f6ae44c734a99dcca5cc869a4a327241a0be2a0ffd0d6b4b588dba0bd54b4d35a8e327b1d7ce590d69f220bb092c63ebee9ac8be73af0c725a1acd7e4d036742b118dd763f00eb69284bfeaedeccd260eff692d90af8280e3d64206ec07810b16a1ec404760fb72868008187a6e5d9370f61a7ddd3d824473edfb45c544c14a44aaee81af25f60fce2cac4efeb2c54ec8c2d1a89c7d9bdca1d0e65cb5422255ac4aca597ad4dfd21b08f5da730865533109080581518134a6b002448e21674c2d6ddddc869a17537a9d32f70a24d7457f0ebeb99724193ab06d6a351877ff7615ff4b56e2dc70a5ab19032b82e5581afb3f7ee3caa1a804f7683f76f7b0ce2bbae33d4619003b0f1edeb2c4abdb9e8139a7ebad8ebdcba6f175d6b4dc135888ae166c792e4eb1b8badcab6871150dc87a82daaa04b1ae3019389bb4d3fa2a63006b752b4eb8f9fb3c425f6a772f2fa4b13a467b56c1d37f42af7bf82bbecf15084c6741d8417dc80f97ecd9b3ff38d5dce4a6be777f49492a915ae5eaf5fba9f539afd613d82455b31dc3edf4e5d0d1dce1cc21eecf9c0a9c85518120e556b0ac5f89950ef0432cbd50f5e9485ce56b977fffc8c6fbb787309dcf00eb3126b86b462cbb899f136a463a9f672721515eb037928f3a3a6de13a85b732bf527bd29dca402404f48417bd5e1f98b32210e75d21f0392acf8d0c4fa07cc4157a008049aedecc04d0d6c69c1a061976dba87b8b1249547451b5878a6f7227b68a91b3b7f6684e8f796639c51ca4615b0d5b32431db830cb6b5a564881b9fba888e2ac3368828a52302f2daf734d3ba7d8b97ed808e9ca46a9df6ece94ff57bc8ad24f0f9576b9c5e09e9dcc0b0920ab42e2d920eafd6722bf063350eb48aa2e78d293641f5fc43b6d101fe84cad1b78b134ba93a1b5870104af49f76fe5a8ce2b69fbe35ab92011ed863e9f4c704f6dee0b55a0158d1a44817126f2ff67e1f0d967fc1d83c04739b27e3e0738b6396f48c4a7ae75c3f9f91be38758417054abe86ba5f9aeb941b5304a2c1de6d4b5f5849134a56f62dc9190c135f8a3aac4dad587bd22178b6b1e0a919815358affcc7add419951a4501d86057d869e5e843ade17c5d968eecfee8bb53014bd568c5c9dd000c276bfff6298b416a72f51ccd94a8361318e649b0d4c10f56f4bad4cd0f093edeba25c4d3bfa351695defa34fc76046462055ef2da71b8fe4d8159ab335b1c0bf6fb32f57791978003a2cfe543f3db90ef8d641ba5d467b11ffc43c9cf3c414d164ec96475d9ad295883f17105a324451608dcf44ffb0fdb8c56ca6cc7fdd01b2629c60ff1e55cc8de0b449bfe3cf303a21757656bc25980ceefd92be139bf44e0b43247c6730b98df622ea13f6af2c9e14e5be7d21d6196a51c3f654a8cba3887c5c0a811513ad6b16f77f5ab4c354d942f0471cce4cd8e96fe8cf321c0412f3d21e05256c581d225e4367620f3234887b61d3dff30e04ba815f585b59c3cd80d7bf8290a4c7cefc5dbf015dec8706dcb029ab4e3f6b06164b6b804fefa31d09321c79f6a9a5850a5ec0fb2b6d180ed8cca7e511e02b0d120abf86110a4f19f76ab59c3449009335dbfa91025c50ec4025f49b27eddcb5cacb8041af29f361eaea7be3f87003ab042c9e7fc42b1d874b5a8d92b9494f74c9c95bfa949bf220c4e0fd313ae1f59ce608bbe76e7aa3cefa0ace39bf0808328d3e73befeee11613fe9f7e8a1461f5aa6c1799f794b3cd135430886da4d692f3e57c7da7626415867b96c55cec716768f69ac4fd90b478ad9340f5e295978fca2331aed5e3a6a1e553114949034e1bc08dfee07dcc99cc5ea2fd691a14d503890aec1da5bef59ac1ce4bb00649d2b8489d287aa16e11322676c6bdad5944788ac69a81e59a700d15dd3ddf3c55b52cb9051f7b92da76b763e82e9cd59a0c226d9620ebdc2d94131a4f212a8bd72380376f8f20234f286acaf8657b485ef9c01df0b44bf5be05d5c14ab24eac5b32f4627bfe74ed65760067ad1342cb7ba80599fbe006c8fcd69fc42711f60515d9bb9d2b96dabc2f4e239401ad02bd85571d975fca26e1c1f3a633eae3925b2d881096cba3cc7fe3ca71f59152bb245e8c2305a6afd15923d600e3522d94fe3751fffb77e6ed835a86b93b9f489b0557fc5cf3cfb0f79ceb70cfaed76940e7d7e2606dd567cdad12e6ba43fcba76a51b5cceeab0572ac1b77bdead12d5352f9d106dd2eb398d5d10a1cf8c001a238213ab696d64cc9dc52e2859c9fc476ecefe942b29fa3e902d31dfbd9134d1afac212333c3a79202ad532b95e495c870f3ab1bde5841dc970ccf50ecaac05c6f19bcc77f285d6504e5bf7c006836e09e7584cbe985f9f0da2ace3e63a0c3e56732a31b94591933f373d7a746a38964a2ad55d3f8bb860ba2cd9a7dc41c8e95631417d6aaec3913f7eb5110dd9a4f6b60474d8e9a7b56f8ea5cb6c0c7a88334961138e8e4bd4ecfbecf1f19d910ad5f824224993c65df9eac140b0c5ac69c2b4939933e9e9c81378027427c83074b626c4924b1cacd7f7e37df372860704bbaf531685b1b44450157bc8e290ab8e36b348b1700f72af24a4ecf85749f32ed9b42ea063004434f68d0efc126283b12c57710038b146ff829ba3e79a6d5ed0ae229f4668e5e5e5b991473d3d3b500b27e2aa2ea3ce3b1c2881fcf371f7a48e20ee285c8ae94e9346f7256026a12aaf68062a8ec75000c50c80672f6f1a2873ef49df7c9fd56b0208bd6749acb4440dea311cce7cfc4a97894c6ddea9f1b3ec2163a3cb988418edc61d7c061bd88134da9114a37981e1a7b69474713cbebc60fbab3cf411dac9b2f92eea8528c92025ad1d0f1442d5b50abc3bd24351f718623e02b0dea2a233855e65798fa9ad071d882306f135ecbba236be3bf75661094a44e1ff19032491a87965ff9d2dd5c4b53ee1622c978f1d6e811813b76f01e9c1bae8f93174a16addac3a372a59667e15072998a3c062b7c2a3cfc2b767a61b783bddacf1c607ed410efc6a5af3945ad464bca01e6d6ec33b62946275a9e27a1bb292335ffa917a408ed59c74b05bc9d2e172e7fa626718012c1cc92f7c1e612c51a12765455d264c8ee8d249b50bb9ece9db38c8be52740feb0b91844486c79128e5f32e02b837c3b7b3219f98073a1074309d55887e0836b737ea7114e58586facb2de01a6c07b7f704f06b3143412b69e30389b3a93a68c09bdbcd6c63d55e7c214840ce87664949f3784cb8bb30aead69d70d1e2d5a943f8b3f206ceb76f073b964835be3b04ce2b4744c04300500014956d802aada01371f306ca9a85ef7ffa0f4f0bae3630a6a6d090455010cbfbade0b42c43bff63c76e7ae8ef05cf41ca9bc3cc8ca92bcb3ba643ea80971bd29eff6ff70d72dee4248cf0dce0fa991684b8d326cf21b21451de5c45055471b1cffb43a46f6d419fe57acef4bda489a28610124bfba79c0f8f3b18dc92ffd08e83c3a15f168b5ca9e731cf6cb613dc670f8922a1aea3382ea13348cebf9591ef73d21397fd3dd46044b4a693963d965afe9c8d283fd6114f2ddd9710133f94ed8c255af5311b3113375e34608559b63174495fa35e1eac422627e58781b071c09098f0c53d191eef95b7d2213d6ba8521251347091371b21b2bc925bf9ed205082885ddd053c8b66e15625b10ac19001ab3d3d67b3cb5dd43021a55935cacd0c150eb536c670ee20453cb15afb6d644bc16abdade4f7c05dc840fe2496f6225864d08cf8b9474c6189769d994b89e25fb49d1973"}) 03:37:32 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000)={0x0}, &(0x7f0000000040)=0xc) getresuid(&(0x7f0000000080), &(0x7f00000000c0)=0x0, &(0x7f0000000100)) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000140)={0x0, 0x0, 0x0}, &(0x7f0000000180)=0xc) setsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000001c0)={r2, r3, r4}, 0xc) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000009c00000000ebffffff000000000000000000000000000000000000002eb986318f9c7edf35b2889de30000000000000000000000000000"], 0x0, 0x0, 0x0}) 03:37:32 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x0, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x48) socketpair(0x1, 0x80000, 0x7fffffff, &(0x7f0000000240)) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x1000000000002, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f00000005c0)={0x80000000000000, 0x7}, 0x4) syz_genetlink_get_family_id$team(&(0x7f0000000180)='team\x00') getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) getsockopt$inet_mreqn(r0, 0x0, 0x0, &(0x7f0000000300)={@initdev, @remote}, &(0x7f0000000480)=0xc) getpeername$packet(r1, &(0x7f00000004c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000500)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000280)=0x32, 0x4) connect$inet(r0, &(0x7f0000000340)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) 03:37:32 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 535.759651] binder: 26867:26873 ioctl c0306201 20000140 returned -14 [ 535.766958] binder: release 26871:26884 transaction 1515 out, still active [ 535.778770] binder: undelivered TRANSACTION_COMPLETE [ 535.811295] binder: 26912:26917 unknown command 536872064 [ 535.817892] binder: 26916:26918 ioctl c018620b 0 returned -14 [ 535.818077] binder: 26910:26920 ioctl c018620b 0 returned -14 [ 535.825247] binder: 26913:26919 ioctl c018620b 0 returned -14 [ 535.836558] binder: 26912:26917 ioctl c0306201 20000440 returned -22 [ 535.844529] binder: 26915:26921 ioctl c018620b 0 returned -14 [ 535.849971] binder: 26910:26920 transaction failed 29201/-22, size -8738903024400859136--8596749504678686927 line 3155 03:37:32 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$RTC_PLL_SET(r1, 0x40207012, &(0x7f0000000040)={0x8, 0x7abd, 0x6971, 0x10000, 0xfffffffffffffff6, 0x6, 0xfffffffefffffffd}) [ 535.852980] binder: 26912:26924 unknown command 536872064 [ 535.867783] binder: 26912:26924 ioctl c0306201 20000440 returned -22 [ 535.874434] binder: 26913:26919 unknown command 1079599872 [ 535.880732] binder: 26913:26919 ioctl c0306201 20000440 returned -22 [ 535.882307] binder: undelivered TRANSACTION_ERROR: 29201 [ 535.895672] binder: 26913:26919 ioctl c018620b 0 returned -14 03:37:32 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f0000000040)=0xc) getresuid(&(0x7f0000000080), &(0x7f00000000c0), &(0x7f0000000100)) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000140), &(0x7f0000000180)=0xc) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000009c00000000ebffffff000000000000000000000000000000000000002eb986318f9c7edf35b2889de30000000000000000000000000000"], 0x0, 0x0, 0x0}) [ 535.908928] binder: 26916:26926 unknown command 536871488 [ 535.912307] binder: 26913:26919 unknown command 1079599872 [ 535.922825] binder: 26915:26928 BC_ACQUIRE_DONE u0000000000000000 no match [ 535.937211] binder: 26916:26926 ioctl c0306201 20000440 returned -22 [ 535.942489] binder: 26913:26919 ioctl c0306201 20000440 returned -22 [ 535.951303] binder: 26929:26933 unknown command 536872064 03:37:32 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = dup2(r0, r0) openat$cgroup_ro(r1, &(0x7f0000000000)='cgroup.stat\x00', 0x0, 0x0) [ 535.961186] binder: 26931:26934 ioctl c018620b 0 returned -14 [ 535.970151] binder: 26929:26933 ioctl c0306201 20000440 returned -22 [ 535.984162] binder: 26931:26934 transaction failed 29201/-22, size -8738903024400859136--8596749504678686927 line 3155 [ 535.991347] binder: 26929:26933 unknown command 536872064 03:37:32 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f0000000040)=0xc) getresuid(&(0x7f0000000080), &(0x7f00000000c0), &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000009c00000000ebffffff000000000000000000000000000000000000002eb986318f9c7edf35b2889de30000000000000000000000000000"], 0x0, 0x0, 0x0}) [ 536.007561] binder: 26929:26933 ioctl c0306201 20000440 returned -22 [ 536.014410] binder: 26937:26940 ioctl c018620b 0 returned -14 [ 536.015790] binder: undelivered TRANSACTION_ERROR: 29201 [ 536.022556] binder: 26937:26940 ioctl c018620b 0 returned -14 [ 536.045741] binder: release 26937:26940 transaction 1523 out, still active 03:37:32 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) ioctl$KDGKBDIACR(r0, 0x4b4a, &(0x7f00000004c0)=""/4096) 03:37:32 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) r1 = accept4(0xffffffffffffffff, &(0x7f00000000c0)=@ax25={{0x3, @netrom}, [@bcast, @remote, @null, @remote, @remote, @netrom, @null, @bcast]}, &(0x7f0000000140)=0x80, 0x80000) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000180)={{{@in6=@loopback, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in=@local}}, &(0x7f0000000280)=0xe8) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f0000000380)={@dev={0xfe, 0x80, [], 0x13}, @ipv4={[], [], @broadcast}, @rand_addr="2d5d4f83be2cba3814be896a162c1c11", 0x9, 0xfffffffffffffffd, 0x0, 0x100, 0x2, 0x40000000, r2}) r3 = gettid() syz_open_procfs$namespace(r3, &(0x7f0000000080)='ns/pid\x00') r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_int(r4, 0x0, 0x32, &(0x7f0000000040)=0xcfcb, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000000000000000000000000000061ac00000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) r5 = mmap$binder(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x1, 0x10, r0, 0x1c) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={r5}) [ 536.061534] binder: undelivered TRANSACTION_COMPLETE [ 536.081648] binder: 26944:26947 ioctl c018620b 0 returned -14 [ 536.086078] binder: release 26937:26941 transaction 1524 out, still active [ 536.093424] binder: 26946:26948 unknown command 536872064 [ 536.103153] binder: undelivered TRANSACTION_COMPLETE [ 536.113167] binder: 26944:26947 transaction failed 29201/-22, size -8738903024400859136--8596749504678686927 line 3155 [ 536.125417] binder: 26950:26951 ioctl c018620b 0 returned -14 [ 536.130703] binder: 26946:26948 ioctl c0306201 20000440 returned -22 [ 536.139347] binder: 26946:26948 ioctl 4b4a 200004c0 returned -22 [ 536.140986] binder_alloc: 3591: binder_alloc_buf size 2892038144 failed, no address space [ 536.159371] binder: 26946:26948 unknown command 536872064 [ 536.159613] binder_alloc: allocated: 9904 (num: 437 largest: 32), free: 2384 (num: 1 largest: 2384) [ 536.165493] binder: 26946:26952 ioctl 4b4a 200004c0 returned -22 [ 536.175542] binder: 26950:26951 transaction failed 29201/-28, size 2892038144-0 line 3155 [ 536.182430] binder: undelivered TRANSACTION_ERROR: 29201 [ 536.194821] binder: 26946:26948 ioctl c0306201 20000440 returned -22 [ 536.198748] binder: 26950:26951 ioctl c018620b 0 returned -14 [ 536.213237] binder_alloc: 3591: binder_alloc_buf size 2892038144 failed, no address space [ 536.236341] binder_alloc: allocated: 9904 (num: 437 largest: 32), free: 2384 (num: 1 largest: 2384) [ 536.246826] binder: 26950:26954 transaction failed 29201/-28, size 2892038144-0 line 3155 [ 536.259750] binder: undelivered TRANSACTION_ERROR: 29201 [ 536.266290] binder: undelivered TRANSACTION_ERROR: 29201 03:37:33 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040), 0x4) sched_rr_get_interval(0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') 03:37:33 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f0000000040)=0xc) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000009c00000000ebffffff000000000000000000000000000000000000002eb986318f9c7edf35b2889de30000000000000000000000000000"], 0x0, 0x0, 0x0}) 03:37:33 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000040)={'team0\x00'}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000080)=ANY=[@ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="003d809552f770dff9af433949d7a6b62c40d784b33fc2f33b3515810e5ebef895b7df72c23962f6f4aad839a08180849310641b4357f0546053d56a40a6aea03ecbcabbcc6b2ed32b47430a8c8c6e8ac1f6483c5e68f4ad4695"]], 0x138, 0x0, 0x0}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='pids.current\x00', 0x0, 0x0) ioctl$KDGKBMODE(r2, 0x4b44, &(0x7f0000000180)) 03:37:33 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_MSFILTER(r1, 0x0, 0x30, &(0x7f0000000480)=ANY=[@ANYBLOB="020000000000000002004e21ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000500000002004e23ac1414aa00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e22e000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e24ac1414aa00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e24ac1414aa00000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e2400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffb0000000000000000000000000000000000"], 0x310) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:37:33 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x0, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x48) socketpair(0x1, 0x80000, 0x7fffffff, &(0x7f0000000240)) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x1000000000002, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f00000005c0)={0x80000000000000, 0x7}, 0x4) syz_genetlink_get_family_id$team(&(0x7f0000000180)='team\x00') getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) getsockopt$inet_mreqn(r0, 0x0, 0x0, &(0x7f0000000300)={@initdev, @remote}, &(0x7f0000000480)=0xc) getpeername$packet(r1, &(0x7f00000004c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000500)=0x14) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000280)=0x32, 0x4) connect$inet(r0, &(0x7f0000000340)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) 03:37:33 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 536.609514] binder: 26916:26918 ioctl c0306201 20000140 returned -14 [ 536.620668] binder: release 26915:26928 transaction 1521 out, still active [ 536.638296] binder: undelivered TRANSACTION_COMPLETE [ 536.654788] binder: 26962:26966 ioctl c018620b 0 returned -14 [ 536.662515] binder: 26959:26967 ioctl c018620b 0 returned -14 [ 536.666387] binder: 26963:26970 ioctl c018620b 0 returned -14 [ 536.675977] binder: 26968:26972 ioctl c018620b 0 returned -14 [ 536.684402] binder: 26959:26967 transaction failed 29201/-22, size -8738903024400859136--8596749504678686927 line 3155 [ 536.695769] binder: 26962:26966 ioctl c018620b 0 returned -14 [ 536.697944] binder: BINDER_SET_CONTEXT_MGR already set 03:37:33 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00u\x00'], 0x0, 0x0, 0x0}) [ 536.707492] binder: 26961:26969 ioctl 40046207 0 returned -16 [ 536.707590] binder: release 26962:26966 transaction 1528 out, still active [ 536.715730] binder: 26961:26969 unknown command 536871104 [ 536.726838] binder: 26961:26969 ioctl c0306201 20000440 returned -22 [ 536.731672] binder: undelivered TRANSACTION_COMPLETE [ 536.738378] binder: 26963:26978 unknown command 536871488 [ 536.743609] binder: 26968:26972 BC_ACQUIRE_DONE node 1531 has no pending acquire request [ 536.749459] binder: 26963:26978 ioctl c0306201 20000440 returned -22 03:37:33 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000009c00000000ebffffff000000000000000000000000000000000000002eb986318f9c7edf35b2889de30000000000000000000000000000"], 0x0, 0x0, 0x0}) [ 536.769548] binder: undelivered TRANSACTION_ERROR: 29201 [ 536.783116] binder: 26981:26985 ioctl c018620b 0 returned -14 [ 536.787553] binder: BINDER_SET_CONTEXT_MGR already set [ 536.794919] binder: 26961:26987 unknown command 536871104 [ 536.803522] binder: 26986:26988 ioctl c018620b 0 returned -14 [ 536.813941] binder: 26961:26969 ioctl 40046207 0 returned -16 03:37:33 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 536.814098] binder: release 26968:26972 transaction 1530 out, still active [ 536.833083] binder: 26961:26987 ioctl c0306201 20000440 returned -22 [ 536.834450] binder: 26981:26985 ioctl c018620b 0 returned -14 [ 536.847561] binder: 26986:26988 transaction failed 29201/-22, size -8738903024400859136--8596749504678686927 line 3155 [ 536.862023] binder: 26993:26994 ioctl c018620b 0 returned -14 03:37:33 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) r1 = dup2(r0, r0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'gretap0\x00', 0x0}) bind$packet(r1, &(0x7f0000000040)={0x11, 0x1f, r2, 0x1, 0x8001, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}, 0x14) [ 536.869124] binder: unexpected work type, 4, not freed [ 536.887446] binder: undelivered TRANSACTION_COMPLETE 03:37:33 executing program 2: r0 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) recvfrom$unix(r0, &(0x7f00000001c0)=""/164, 0xa4, 0x40002063, &(0x7f0000000280)=@abs={0x0, 0x0, 0x4e24}, 0x6e) ioctl$FIBMAP(r0, 0x1, &(0x7f00000000c0)=0x200) ioctl$SNDRV_TIMER_IOCTL_INFO(r0, 0x80e85411, &(0x7f0000000040)=""/72) write$binfmt_elf64(r0, &(0x7f0000000480)={{0x7f, 0x45, 0x4c, 0x46, 0xfff, 0x5, 0x8000, 0x338000000000, 0x5, 0x2, 0x3e, 0x2, 0x109, 0x40, 0x90, 0xb1f9, 0x56, 0x38, 0x2, 0x7, 0x0, 0x7f}, [{0x1, 0xffff, 0x6, 0x9, 0x9, 0xef1, 0x8000000000, 0x2}], "f81aa8a17e8e7870e689ca06d1be5d32a0c9c4d2748837a670e5ba5d9ec7453caeb60a02b2a03a4cb7379f614f00683d6c3f5692bd03dcb653bcfbb5cc17f7f2fa3b1c358a899d86f74c8a0f556148f83d567d11f17ea1b804c7713da910a00279b3bf074552093f52da01df08a7f8a580cbb9daeb22a4d8cb4b791987e8f06619ea3b474793a51a515536e5e7d782161b993adb612e90d1c6de4b110db1e1caca744efcc0be", [[], [], []]}, 0x41e) setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f0000000100)={0x800, {{0x2, 0x800000000004e21, @multicast2}}}, 0x88) ioctl$BLKTRACESTOP(r0, 0x1275, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) pipe2(&(0x7f0000000380), 0x80000) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:37:33 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000009c00000000ebffffff000000000000000000000000000000000000002eb986318f9c7edf35b2889de30000000000000000000000000000"], 0x0, 0x0, 0x0}) [ 536.929510] binder: undelivered TRANSACTION_ERROR: 29201 [ 536.935943] binder: release 26981:26995 transaction 1535 out, still active [ 536.953296] binder: 26993:26999 BC_ACQUIRE_DONE node 1537 has no pending acquire request [ 536.964518] binder: 26997:26998 unknown command 536872064 [ 536.968248] binder: 27002:27005 ioctl c018620b 0 returned -14 [ 536.975152] binder: undelivered TRANSACTION_COMPLETE [ 536.984693] binder: 27000:27004 ioctl c018620b 0 returned -14 [ 536.985423] binder: 26997:26998 ioctl c0306201 20000440 returned -22 [ 536.991935] binder: 27002:27005 transaction failed 29201/-22, size -8738903024400859136--8596749504678686927 line 3155 [ 537.002954] binder: release 26981:26985 transaction 1533 out, still active [ 537.020280] binder: 26997:26998 unknown command 536872064 [ 537.026342] binder: 27000:27004 ioctl c018620b 0 returned -14 [ 537.030513] binder: 26997:26998 ioctl c0306201 20000440 returned -22 [ 537.055981] binder: undelivered TRANSACTION_COMPLETE [ 537.072050] binder: release 27000:27004 transaction 1540 out, still active [ 537.082145] binder: undelivered TRANSACTION_COMPLETE [ 537.088030] binder: undelivered TRANSACTION_ERROR: 29201 03:37:34 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) 03:37:34 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000009c00000000ebffffff000000000000000000000000000000000000002eb986318f9c7edf35b2889de30000000000000000000000000000"], 0x0, 0x0, 0x0}) 03:37:34 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) 03:37:34 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040), 0x4) sched_rr_get_interval(0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') 03:37:34 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x0, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x48) socketpair(0x1, 0x80000, 0x7fffffff, &(0x7f0000000240)) r0 = socket$inet_udp(0x2, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x1000000000002, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f00000005c0)={0x80000000000000, 0x7}, 0x4) syz_genetlink_get_family_id$team(&(0x7f0000000180)='team\x00') getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) getsockopt$inet_mreqn(r0, 0x0, 0x0, &(0x7f0000000300)={@initdev, @remote}, &(0x7f0000000480)=0xc) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000280)=0x32, 0x4) connect$inet(r0, &(0x7f0000000340)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) [ 537.459321] binder: 26963:26970 ioctl c0306201 20000140 returned -14 [ 537.493716] binder: 27015:27018 transaction failed 29201/-22, size -8738903024400859136--8596749504678686927 line 3155 03:37:34 executing program 5: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000009c00000000ebffffff000000000000000000000000000000000000002eb986318f9c7edf35b2889de30000000000000000000000000000"], 0x0, 0x0, 0x0}) 03:37:34 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) fsetxattr$trusted_overlay_origin(r0, &(0x7f0000000000)='trusted.overlay.origin\x00', &(0x7f0000000040)='y\x00', 0x2, 0x3) [ 537.505173] binder: 27013:27019 ioctl c018620b 0 returned -14 [ 537.506018] binder: 27016:27020 unknown command 536872064 [ 537.514492] binder: 27013:27019 got transaction to invalid handle [ 537.519038] binder: 27016:27020 ioctl c0306201 20000440 returned -22 [ 537.531633] binder: undelivered TRANSACTION_ERROR: 29201 [ 537.537315] binder: 27021:27023 ioctl c018620b 0 returned -14 [ 537.544600] binder: 27013:27019 transaction failed 29201/-22, size 0-0 line 3018 03:37:34 executing program 5: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000009c00000000ebffffff000000000000000000000000000000000000002eb986318f9c7edf35b2889de30000000000000000000000000000"], 0x0, 0x0, 0x0}) [ 537.582633] binder: 27013:27019 ioctl c018620b 0 returned -14 [ 537.585723] binder: undelivered TRANSACTION_ERROR: 29201 [ 537.599001] binder: 27027:27031 unknown command 536872064 [ 537.608254] binder: 27027:27031 ioctl c0306201 20000440 returned -22 [ 537.615880] binder: 27021:27032 unknown command 536871488 03:37:34 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 03:37:34 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) close(r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 537.641328] binder: 27027:27031 unknown command 536872064 [ 537.647826] binder: 27021:27032 ioctl c0306201 20000440 returned -22 [ 537.650427] binder: release 26993:26999 transaction 1536 out, still active [ 537.655112] binder: 27027:27031 ioctl c0306201 20000440 returned -22 03:37:34 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="0300"]], 0x0, 0x0, 0x0}) 03:37:34 executing program 5: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000009c00000000ebffffff000000000000000000000000000000000000002eb986318f9c7edf35b2889de30000000000000000000000000000"], 0x0, 0x0, 0x0}) [ 537.702330] binder: unexpected work type, 4, not freed [ 537.713007] binder: 27040:27043 ioctl c018620b 0 returned -14 [ 537.713082] binder: 27042:27044 ioctl c018620b 0 returned -14 [ 537.729768] binder: undelivered TRANSACTION_COMPLETE 03:37:34 executing program 5: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000009c00000000ebffffff000000000000000000000000000000000000002eb986318f9c7edf35b2889de30000000000000000000000000000"], 0x0, 0x0, 0x0}) [ 537.753033] binder: 27040:27043 ioctl c018620b 0 returned -14 [ 537.753372] binder: 27046:27050 unknown command 536872064 [ 537.769734] binder: release 27040:27051 transaction 1543 out, still active [ 537.780268] binder: undelivered TRANSACTION_COMPLETE [ 537.791715] binder: 27042:27052 BC_ACQUIRE_DONE node 1545 has no pending acquire request 03:37:34 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) r1 = dup(r0) ioctl$PIO_UNISCRNMAP(r1, 0x4b6a, &(0x7f0000000000)="68f6e01df3cea2174c472073c08fea113fcfec4c12985383c2dc496f20b8d043e41b22cf5a92f02580a94142af5313940ed8989cb24f4ec07f93e19795a4d3b9db655c16dbba42662bc96f42a7f44a2ee8ace9") ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000080)={0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x30, 0x0, &(0x7f00000000c0)=[@request_death={0x400c630e, 0x3, 0x2}, @acquire={0x40046305, 0x3}, @enter_looper, @acquire_done={0x40106309, r2}], 0x0, 0x0, 0x0}) fchdir(r1) [ 537.796959] binder: 27046:27050 ioctl c0306201 20000440 returned -22 03:37:34 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB]], 0x0, 0x0, 0x0}) [ 537.833258] binder: release 27042:27052 transaction 1544 out, still active [ 537.835068] binder: 27056:27058 ioctl c018620b 0 returned -14 [ 537.847395] binder: unexpected work type, 4, not freed [ 537.864144] binder: 27056:27058 ioctl 4b6a 20000000 returned -22 [ 537.882909] binder: undelivered TRANSACTION_COMPLETE [ 537.892385] binder: 27056:27058 BC_REQUEST_DEATH_NOTIFICATION invalid ref 3 [ 537.914615] binder: 27061:27063 unknown command 536872064 [ 537.916250] binder: 27056:27058 Acquire 1 refcount change on invalid ref 3 ret -22 [ 537.925456] binder: 27061:27063 ioctl c0306201 20000440 returned -22 [ 537.928601] binder: 27056:27058 BC_ACQUIRE_DONE u0000000000000000 no match [ 537.948430] binder: 27061:27063 unknown command 536872064 [ 537.949144] binder: 27056:27058 ioctl c018620b 0 returned -14 [ 537.958918] binder: 27056:27065 ioctl 4b6a 20000000 returned -22 [ 537.966410] binder: 27061:27063 ioctl c0306201 20000440 returned -22 [ 537.970592] binder: 27056:27064 BC_REQUEST_DEATH_NOTIFICATION invalid ref 3 [ 537.980671] binder: 27056:27064 Acquire 1 refcount change on invalid ref 3 ret -22 [ 537.988682] binder: 27056:27064 BC_ACQUIRE_DONE u0000000000000000 no match 03:37:35 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040), 0x4) sched_rr_get_interval(0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') 03:37:35 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) 03:37:35 executing program 5: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000009c00000000ebffffff000000000000000000000000000000000000002eb986318f9c7edf35b2889de30000000000000000000000000000"], 0x0, 0x0, 0x0}) 03:37:35 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = dup2(r0, r0) sendto$inet6(r1, &(0x7f0000000000)="1bf9c227530a434f62c485b9ab8f4ea4df455b6ed73e4627f28c763de176ae4562c620aada912df51da76fc13814dff7ea42ba5b51c318923fb88f359a527b5fd61b5787e6cc429020957cf48b0d01eee314c44bc940d3f9d899fca08edd8a3b7f628569cb3efcf6aeb7d666d40530edf02f356fc86e5716c7ca44c8a103e85fe035861dd9ae0c6613d78d90e3ff3951286437e48c3c3ffa9250f673", 0x9c, 0x4000000, 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x5, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="00ab0a816d1199c33b"]], 0x0, 0x0, 0x0}) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, 0xffffffffffffffff, &(0x7f0000000180)={0x1}) ioctl$PPPIOCGNPMODE(r1, 0xc008744c, &(0x7f00000000c0)={0xfd, 0x3}) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r0, &(0x7f0000000100)={0x2}) 03:37:35 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) close(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:37:35 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x0, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x48) socketpair(0x1, 0x80000, 0x7fffffff, &(0x7f0000000240)) r0 = socket$inet_udp(0x2, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x1000000000002, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f00000005c0)={0x80000000000000, 0x7}, 0x4) syz_genetlink_get_family_id$team(&(0x7f0000000180)='team\x00') getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000280)=0x32, 0x4) connect$inet(r0, &(0x7f0000000340)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) [ 538.319739] binder: 27021:27023 ioctl c0306201 20000140 returned -14 03:37:35 executing program 5: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000009c00000000ebffffff000000000000000000000000000000000000002eb986318f9c7edf35b2889de30000000000000000000000000000"], 0x0, 0x0, 0x0}) [ 538.376425] binder: 27074:27076 ioctl c018620b 0 returned -14 [ 538.383365] binder: 27070:27078 ioctl c018620b 0 returned -14 [ 538.392900] binder: 27069:27080 ioctl c018620b 0 returned -14 [ 538.411695] binder: 27074:27076 ioctl c018620b 0 returned -14 03:37:35 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = dup3(r0, r0, 0x80000) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_RESET_STATS(r1, &(0x7f00000004c0)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000003c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="88010000", @ANYRES16=r2, @ANYBLOB="02002bbd7000fcdbdf250a000000e00001002c0004001400010002004e227f00000100000000000002004e24ac1414aa0000000000000000140001006574683a6970366772657461703000000c00020008000400ffffff7f08000300feffffff44000400200001000a004e2100000008ff02000000000000000000000000000100020000200002000a004e240000000400000000000000000000ffffac1414bb177a000044000400200001000a004e2100000009d291a3eb386224b605105d5c937cb534fbffffff200002000a004e2000000002fe8800000000000000000272d4054bfa71a9de000000000101d09d000014000900080002000900000008000200090000001800040014000700080003000000000008000200000800002400070008000100010000000c00030007000000000000000c000400040000000000000010005200080001000200000004000200040001001c0005f50400020008000100030000000400020008000100e0ffffff14000900080002001f0000000000000000"], 0x188}, 0x1, 0x0, 0x0, 0x40}, 0x4040000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) setsockopt$inet_mtu(r1, 0x0, 0xa, &(0x7f0000000000)=0x1, 0x4) fcntl$dupfd(r0, 0x0, r0) 03:37:35 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 538.435773] binder: release 27074:27076 transaction 1547 out, still active [ 538.458038] binder: undelivered TRANSACTION_COMPLETE [ 538.475866] binder: 27070:27089 unknown command 536871488 03:37:35 executing program 5: syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000009c00000000ebffffff000000000000000000000000000000000000002eb986318f9c7edf35b2889de30000000000000000000000000000"], 0x0, 0x0, 0x0}) [ 538.495026] binder: 27070:27089 ioctl c0306201 20000440 returned -22 [ 538.530859] binder: 27093:27097 ioctl c018620b 0 returned -14 03:37:35 executing program 5: syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000009c00000000ebffffff000000000000000000000000000000000000002eb986318f9c7edf35b2889de30000000000000000000000000000"], 0x0, 0x0, 0x0}) [ 538.548103] binder: 27090:27098 unknown command 536872064 [ 538.555409] binder: 27090:27098 ioctl c0306201 20000440 returned -22 [ 538.571763] binder: 27093:27097 ioctl c018620b 0 returned -14 [ 538.576076] binder: release 27093:27097 transaction 1551 out, still active [ 538.589425] binder: undelivered TRANSACTION_COMPLETE 03:37:35 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0xc, 0x100010, r0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000af8ae02abefe8bb05427e905d1ba32826c90100f63d9172ec790edde9b72ec796253ec82be67207d4346257bc02a10bc25a1a6dc"], 0x0, 0x0, 0x0}) [ 538.614621] binder: 27090:27103 unknown command 536872064 [ 538.620385] binder: 27090:27103 ioctl c0306201 20000440 returned -22 [ 538.679656] binder: 27109:27111 ioctl c018620b 0 returned -14 [ 538.701937] binder: 27109:27111 ioctl c018620b 0 returned -14 [ 538.725637] binder: release 27109:27114 transaction 1553 out, still active [ 538.742827] binder: undelivered TRANSACTION_COMPLETE [ 538.759734] binder: release 27109:27111 transaction 1552 out, still active [ 538.776019] binder: undelivered TRANSACTION_COMPLETE 03:37:36 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) r1 = socket$inet(0x2, 0x3, 0x0) getsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000000), &(0x7f0000000040)=0x4) 03:37:36 executing program 5: syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000009c00000000ebffffff000000000000000000000000000000000000002eb986318f9c7edf35b2889de30000000000000000000000000000"], 0x0, 0x0, 0x0}) 03:37:36 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0xfffffffffffffffc) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) 03:37:36 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x0, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x48) socketpair(0x1, 0x80000, 0x7fffffff, &(0x7f0000000240)) r0 = socket$inet_udp(0x2, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x1000000000002, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f00000005c0)={0x80000000000000, 0x7}, 0x4) syz_genetlink_get_family_id$team(&(0x7f0000000180)='team\x00') setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000280)=0x32, 0x4) connect$inet(r0, &(0x7f0000000340)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) 03:37:36 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x10, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040), 0x4) sched_rr_get_interval(0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') 03:37:36 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 539.172034] binder: 27070:27078 ioctl c0306201 20000140 returned -14 [ 539.183741] binder: release 27069:27091 transaction 1548 out, still active 03:37:36 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) r1 = socket$inet(0x10, 0x0, 0x4) r2 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/\x00~WM\x00\x030\x80\x90\"\xcf\xde&U]\xc9\xec\xfe\x19t@n\xda\xd3\x83dx-c\xb6a(T\xb9\xe4\x9d\xbd\xca\xefq\x81\x97\xe3~\x87\n0\x8b\x1e:y\x8f\xa7\x88\xa4m0%\xef\x93>Q\x82\x8a\xb6u\x06N*\xdb\xe9\x12d#\xb4\xa7=h\xfb\xe9\x9cm\xb2\xf1`\xd4\x9c\xb6\xcc\xe7l\'(\x9aO\x9d\tsT\xaa\xa5\x86\r#\x83\xdf\x87Rk\xaa\x18M\x90\xbbw)6l\x17\xbc3\xd7e\xe9\xbc/\x88*\x13\xf3\xa9\xc1\xf6\x06`\xbdO\xd2\xfa1\xd2\xc0\xa7u$\"\x89\xbc\xe0b\xd1\r$\xde\xd5@i\x18\xa6k,u\xc4?\xe1\xffE\x8a\xe5\xcd\x9f\xecc\x03\x9b\xa5\xa7\xb6j`\xed\xe5\xcc\xda\xbc~\xe7v`\xef#X\xcc\xdf\xf0\"&\x02\x13\x84\xb0\xc25\xf1\x14\xed\x9a\xde\x92vz\xec\xc2V\xac\xde\xb6\x10\xdfB\xe7\x16\x9f$\x03W\xf75\xae_\xe2\x90\x17\xe5\x1e\'%/H\xb9[\xfb\xbb:\x86U5)\x8b\xdc6\xd7\x1d\xb65\xf4\x1cWw\x1d\xb7z\xea\xff\x88?\xeb=\xc3\xcc$\xbd<\x03n9j\xd3\xaf7\x94PX\x83\x9e\x81\"p\xbc@\x90\x1f\xa6T\xe7\xcc2\x92\xa8/\xc8\f7M\xc0qB\xa1\xc2\xe9\xd3\xe2R\x8eO\xda\xc3+\xca\xef\xe9\x10\xeb\xd3\xb9H\xa3\xbf\xeb\xef_\xa8\xd8$s\xc7\xfb\xf3\xec', 0x0, 0x0) getdents(r3, &(0x7f0000000280)=""/135, 0x74f) syz_genetlink_get_family_id$ipvs(&(0x7f0000000340)='IPVS\x00') sendmsg$IPVS_CMD_GET_DAEMON(r3, &(0x7f0000000540)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x11000}, 0xc, &(0x7f0000000380)={&(0x7f00000004c0)=ANY=[@ANYBLOB="24002caa7017cb42f800fbdbdf250b000000080006005267ed561c00030008000400008000000800010002000000080008000600000009000200080006000100000008000500"], 0x1}}, 0x40004) ioctl$PERF_EVENT_IOC_ID(r2, 0x80082407, &(0x7f00000000c0)) openat$full(0xffffffffffffff9c, &(0x7f0000000580)='/dev/full\x00', 0x101100, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$EVIOCGABS0(r3, 0x80184540, &(0x7f0000000400)=""/176) r4 = open(&(0x7f0000000680)='./bus\x00', 0x40, 0x44) ioctl$KDGETMODE(r4, 0x4b3b, &(0x7f00000003c0)) close(r1) syz_open_dev$loop(&(0x7f0000ca9ff5)='/dev/loop#\x00', 0x0, 0x105082) fcntl$getownex(r4, 0x10, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00#@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 03:37:36 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 539.252607] binder: 27118:27126 unknown command 536872064 [ 539.257228] binder: 27122:27129 ioctl c018620b 0 returned -14 [ 539.264393] binder: 27118:27126 ioctl c0306201 20000440 returned -22 [ 539.264906] binder: 27123:27127 ioctl c018620b 0 returned -14 03:37:36 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 539.331871] binder: 27136:27139 ioctl c0306201 0 returned -14 [ 539.338339] binder: 27137:27140 ioctl c018620b 0 returned -14 [ 539.338598] binder: 27118:27126 unknown command 536872064 [ 539.351758] binder: 27123:27142 unknown command 536871488 [ 539.358644] binder: 27118:27126 ioctl c0306201 20000440 returned -22 [ 539.366568] binder: 27123:27142 ioctl c0306201 20000440 returned -22 03:37:36 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000000980)={0x2, 0x1}, 0x10) syz_emit_ethernet(0x423, &(0x7f0000000080)={@link_local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x415, 0x0, 0x0, 0x0, 0x200000000000011, 0x0, @rand_addr, @multicast1}, @dccp={{0x0, 0x1, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d70502", 0x0, "f53475"}, "b441d632cdbbcb211363807aec73d3883762a61dc02d349bfa3ac974b987aa7fb97eb324d594fbbb77bab759418aa8d451d921e8f5d2cf2b08292111701192e97cac366dd3eb2e0fb039e58314ef4709c5f3556db6a1ab6b4fb2bdd83cdc26e8395ec4984ec3faf71a611d1569545d654cded93be827a85188b803c19c1b56aab522862a718b81e512b49690994d3425e33bd93f0e744c66a083c1f9f1bd7bb8f9e123c08f3f041ed3fdc058136cf0071a47cc0e38720a12e11e842a7b5b26dff07f578fdb9a7b14662a625c1ee76c41ccb2b1fc6376aa718e1067b9e4af511ef5b360dbfad326108bb033db193dab27974eb8c462739eaee51d87f31c516e7e391073770da3202e02c41a7277c847df24bd5b0a7ab6e252f3c8ebf00688cc55311d887e8bfd95a7f4c6a126af3fe26714ddb869c66d18f870631bbd497e8a06881b754ecdcdd0dcffc51cd52a6b560f8d64b63a1674745edc5f53b18a8ffcc5c2fbc4d2bbcc2faf3c189d9b36c0655d1394f5c127ec86b8a764a87b546c2b6ac37d0a8ec3edd7cda6f930570763dbdc0640d219749bd57c7c89eaadfdae41d654a46b17be069a32a7d94d29b612fbe61b8bd11a2d10ba5d4ac7014fc0465c3f144598bd1f913343e7293711040eee0ae8df1e49f04ed1037d4b742aed0e932116060aaf6b985238d2e10fb5b11d19d7801befed4833287d96a85a7cdd9e211a672760335655576fc0fa0336621c2b2b1018ef71bb5077c67ee5fa8d479d6776013363e98b1f1213712be7e47549b6035459008c509f0f983130a451531381ee3c1ab9e1cbb8e558b56ca1a70939389addc5f9632b37ff3f634abb504bb0be0a51649683f6e29588c15cda40255e173328681884ffef6729e9058c5623e1401fdcc7b8cb5623a8fd725fbeea05fc417c44e46500619218dff7c70aa068994c58883cada505a2aa85b6620dfe9c45b707c9aa1222b86972eae564b28a05ddfa3545df231fde2707d4bf67dc6ba41daba91dee8081e5c7e2bcfbebebd42d5ab8a32d6e098fd57233e3b813dc0d772134775def451823b7fef2bc93da01722cd613b9a3db7e2d4c51fb7b56006ee9cea53b62343599a56167388d45247f9289fb1cab67a7cb0c3665ddf1e1411875b4de3428b32fc6603691a023d8e4cb93c667acb7b535fb5f77af9a49640cbe8ffe3a193cf4df1b556a67cb753c60bdf978b871aa513c07074c6602037ebc32199290e3c7ac6f103ad9358951ad4de0c8f1b34951b0e6a48295975cf08b2c3c95064855fc95317e386f1c18608d1d08699003c998b93332cd316f17a5139d350cbfa9dabc3f77c4197a0186e50913978e980a7a028e7ccdeee718af028200e94a6b3a0ec93ba14b0c64dfaf3967e230d8cf876f26287d436ebc9588b52b43f2380836bfe3"}}}}}, 0x0) recvmsg(r1, &(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffc7e}, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000000)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0xfff1, 0x0, 0x0}) 03:37:36 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 539.434212] binder: 27149:27152 ioctl c0306201 0 returned -14 03:37:36 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 539.474950] binder: 27137:27155 unknown command 1077945088 [ 539.490975] binder: 27137:27155 ioctl c0306201 20000440 returned -22 [ 539.492328] binder: 27156:27157 ioctl c0306201 0 returned -14 [ 539.503138] binder: 27151:27158 unknown command 536872064 [ 539.509765] binder: 27137:27140 ioctl c018620b 0 returned -14 [ 539.518839] binder: 27151:27158 ioctl c0306201 20000440 returned -22 03:37:36 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 539.565909] binder: 27137:27155 unknown command 1077945088 [ 539.581086] binder: 27137:27155 ioctl c0306201 20000440 returned -22 03:37:36 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x1) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:37:36 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 539.684281] binder: 27171:27172 ioctl c018620b 0 returned -14 [ 539.694171] binder: 27171:27172 transaction failed 29189/-22, size 0-0 line 3018 [ 539.703435] binder: 27171:27172 ioctl c018620b 0 returned -14 [ 539.709593] binder: 27171:27174 transaction failed 29189/-22, size 0-0 line 3018 [ 539.718451] binder: undelivered TRANSACTION_ERROR: 29189 [ 539.727693] binder: undelivered TRANSACTION_ERROR: 29189 03:37:36 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x0, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x48) socketpair(0x1, 0x80000, 0x7fffffff, &(0x7f0000000240)) r0 = socket$inet_udp(0x2, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x1000000000002, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f00000005c0)={0x80000000000000, 0x7}, 0x4) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000280)=0x32, 0x4) connect$inet(r0, &(0x7f0000000340)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) 03:37:36 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x10, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040), 0x4) sched_rr_get_interval(0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') 03:37:36 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0}) 03:37:36 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/enforce\x00', 0x0, 0x0) ioctl$BLKBSZSET(r1, 0x40081271, &(0x7f00000000c0)=0x3) prctl$PR_SET_PDEATHSIG(0x1, 0x20) r2 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x0, 0x0) setsockopt$inet_mreqsrc(r2, 0x0, 0x2e, &(0x7f0000000040)={@dev={0xac, 0x14, 0x14, 0x14}, @local, @empty}, 0xc) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000180)={{{@in6=@dev, @in6=@ipv4={[], [], @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in=@local}}, &(0x7f0000000280)=0xe8) mount$bpf(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x82000, &(0x7f0000000480)={[{@mode={'mode', 0x3d, 0x8}}], [{@uid_gt={'uid>', r3}}, {@audit='audit'}, {@fsname={'fsname', 0x3d, '/selinux/checkreqprot\x00'}}, {@permit_directio='permit_directio'}, {@obj_type={'obj_type', 0x3d, '\xfdeth1++\xa7]lo\rvboxnet1'}}]}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:37:36 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000003c0)={0x14, 0x0, &(0x7f0000000680)=[@acquire_done], 0x0, 0x0, 0x0}) [ 540.060172] binder: release 27122:27141 transaction 1554 out, still active 03:37:36 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0}) [ 540.107588] binder: 27184:27187 ioctl c018620b 0 returned -14 [ 540.109926] binder: 27183:27189 ioctl c018620b 0 returned -14 [ 540.134662] binder: 27181:27186 ioctl c018620b 0 returned -14 [ 540.149674] binder: 27181:27192 ioctl c018620b 0 returned -14 [ 540.165124] binder: release 27181:27192 transaction 1560 out, still active [ 540.174607] binder: undelivered TRANSACTION_COMPLETE [ 540.184698] binder: release 27181:27186 transaction 1559 out, still active [ 540.189561] binder: 27183:27195 unknown command 536871488 [ 540.200674] binder: 27183:27195 ioctl c0306201 20000440 returned -22 03:37:37 executing program 0: pipe(&(0x7f0000000000)) syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 03:37:37 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = dup2(r0, r0) ioctl$TIOCGLCKTRMIOS(r1, 0x5456, &(0x7f0000000000)={0xfff, 0x6, 0x4, 0x0, 0x14, 0x4ea, 0xf65, 0x100000001, 0x4, 0x80, 0x5, 0x800}) 03:37:37 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0}) [ 540.212688] binder: undelivered TRANSACTION_COMPLETE 03:37:37 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) 03:37:37 executing program 0: syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 540.262295] binder: 27201:27204 ioctl c018620b 0 returned -14 [ 540.277814] binder: 27201:27204 ioctl c0306201 0 returned -14 [ 540.287193] binder: 27201:27204 ioctl 5456 20000000 returned -22 [ 540.298634] binder: 27201:27204 ioctl c018620b 0 returned -14 [ 540.304392] binder: 27201:27207 ioctl c0306201 0 returned -14 03:37:37 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB='\x00F']], 0x0, 0x0, 0x0}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) [ 540.330670] binder: release 27201:27204 transaction 1564 out, still active [ 540.338661] binder: undelivered TRANSACTION_COMPLETE [ 540.374875] binder: 27214:27215 unknown command 536872064 [ 540.397564] binder: 27214:27215 ioctl c0306201 20000440 returned -22 [ 540.409775] binder: BINDER_SET_CONTEXT_MGR already set [ 540.425864] binder: 27214:27215 ioctl 40046207 0 returned -16 [ 540.433807] binder: 27214:27215 unknown command 536872064 [ 540.435738] binder: BINDER_SET_CONTEXT_MGR already set [ 540.441910] binder: 27214:27215 ioctl c0306201 20000440 returned -22 [ 540.453770] binder: 27214:27218 ioctl 40046207 0 returned -16 03:37:37 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x0, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x48) socketpair(0x1, 0x80000, 0x7fffffff, &(0x7f0000000240)) r0 = socket$inet_udp(0x2, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x1000000000002, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) socket$packet(0x11, 0x2, 0x300) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000280)=0x32, 0x4) connect$inet(r0, &(0x7f0000000340)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) 03:37:37 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x10, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040), 0x4) sched_rr_get_interval(0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') 03:37:37 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) 03:37:37 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000023e8ffffff000000000000000000000800000000"], 0x0, 0x0, 0x0}) 03:37:37 executing program 0: r0 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/mls\x00', 0x0, 0x0) getpeername(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, &(0x7f00000002c0)=0x80) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000040)={{0x0, 0x3, 0x190, 0x1, 0x4}, 0xfff, 0x8}) write$cgroup_subtree(r0, &(0x7f0000000180)={[{0x2b, 'cpu'}]}, 0x5) ioctl$KDGETKEYCODE(r0, 0x4b4c, &(0x7f0000000000)={0x5, 0x8}) socket(0x0, 0x8000a, 0x1f) setsockopt$IP_VS_SO_SET_STARTDAEMON(r0, 0x0, 0x48b, &(0x7f00000001c0)={0x2, 'nr0\x00', 0x1}, 0x18) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) clock_nanosleep(0x5, 0x0, &(0x7f00000000c0)={0x77359400}, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="bd850cab832d00000000f0daf5"]], 0x0, 0x0, 0x0}) 03:37:37 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 540.902959] binder: release 27184:27194 transaction 1561 out, still active 03:37:37 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x0, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x48) socketpair(0x1, 0x80000, 0x7fffffff, &(0x7f0000000240)) r0 = socket$inet_udp(0x2, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x1000000000002, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) socket$packet(0x11, 0x2, 0x300) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000280)=0x32, 0x4) connect$inet(r0, &(0x7f0000000340)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) 03:37:37 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) [ 540.948048] binder: 27224:27230 ioctl c018620b 0 returned -14 [ 540.953239] binder: 27229:27233 ioctl c018620b 0 returned -14 [ 540.957491] binder: 27225:27235 ioctl c018620b 0 returned -14 [ 540.967582] binder_alloc: 3591: binder_alloc_buf size -26237955211264 failed, no address space [ 540.995058] binder_alloc: allocated: 10192 (num: 455 largest: 32), free: 2096 (num: 1 largest: 2096) [ 541.007452] binder: 27228:27231 unknown command 536871232 [ 541.014579] binder: 27228:27231 ioctl c0306201 20000440 returned -22 [ 541.018338] binder: 27224:27230 transaction failed 29201/-28, size 0--26237955211264 line 3155 [ 541.037647] binder: 27228:27239 unknown command 536871232 03:37:37 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x22, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000009c00000000ebffffff000000000000000000000000"], 0x0, 0x0, 0x0}) [ 541.040655] binder: 27229:27242 ioctl c0306201 0 returned -14 [ 541.044264] binder: 27228:27239 ioctl c0306201 20000440 returned -22 [ 541.051795] binder: 27225:27246 unknown command 536871488 [ 541.069723] binder: 27224:27230 ioctl c018620b 0 returned -14 [ 541.076147] binder: undelivered TRANSACTION_ERROR: 29201 [ 541.076845] binder_alloc: 3591: binder_alloc_buf size -26237955211264 failed, no address space 03:37:37 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) fchmod(r0, 0x40) write$binfmt_misc(r0, &(0x7f00000000c0)={'syz1'}, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) set_robust_list(&(0x7f0000003f40)={&(0x7f0000003ec0)={&(0x7f0000003e40)}, 0x1f}, 0x68cd69618cda11ec) sendmmsg(r0, &(0x7f0000003dc0)=[{{&(0x7f0000000100)=@ipx={0x4, 0x1, 0x434214d4, "9ab650a53623"}, 0x80, &(0x7f0000001940)=[{&(0x7f0000000180)="daafeeb0ac0f0e6bc1db22ec71e61ada5edfea1f08104713cac00cad64b362a3f8da0c8f9fa6f6f9a7e38d7080c97c2bbd7dcfb7a51572b5b36d8d6e74274851cb8f4bf837975b45106950084ae6bd2def27f3c7196d51474e377864be39666a978b58ad4c4859c1c6c29cd3eb0b98cc1bc54603c24095e4832c44813f45392bf8485cdef20549e83d7c410d26d26b6a6e3d41519761071a00dedc180ae93f5f5528794bef887127d71a", 0xaa}, {&(0x7f00000004c0)="4eb1bb3827e59754f35caf1cc5b7bf83704251bad730fdce7c0695b108bfb3626bb709ec54d743a849234e2b565a91450b7c4b152a728a8e8e826da88892ae839ff05672c8c43211d7c3a0ce948155df887805cb5f5f977f95e92f76bd7beb023a2cedcb9ea6f71dc05c2da0149e916c660d62a3009609d00f327b9a155f3290f7b4e202422d938386362cd3f9c7acacb7f04e64626320f7efaac7424057aff2bf6db8ad086e412cdd266db768efa886269cca8dfa662c4ab376e4539c70409ed5", 0xc1}, {&(0x7f00000005c0)="3209420909b1656c4aefbd13c19288085059643db2e2730900fdf2f427da0248546ac8221b9cf464f35e1c3d392551a2b7b4a70f3f64abb82ff75682eeeae7ee8c38ba4e19e2a72bf2166cfd02acb52f1261d2ad987749339eb6c633f44b13eb7fe7a7a526ebd2c5ef7f379b0faeafec3eda2bd395786a99d33d08bf7608ddb933469a49329fe20a597e756ae8d7656664e794367773f19da78f66f116d3c59af60ea373e0acdc928049517996dabae3b23ea4ac799c6ed611825e0214ccc1fe12", 0xc1}, {&(0x7f0000000240)="0032d07566ca5764aff9ac07063c3ed8ae98bfb4516f1665cc4e4ee91bb309571bb9b7921f45701f3b6a47689cb81b513a48e748d955618ea100faa977196f3c91c641a5604ad4f40179fde0cec2a8e8ff035848f9ba6f868fed5006d808fe79b06895e0966f721a3d78a692934ca2607e61ad5eb5fba803fa661579967ecd146187b3e23094b68fe858827246398503a7daa969c8c5017895cfc87b75162313", 0xa0}, {&(0x7f00000006c0)="75771ff50b6c1f435c485edaadef0f294f06fca50a067a1ded2e90718cdaaf784875eb48f1ffd55d06337e3623ba5a76fc09c23fc41ca3108c4bfb3b8793278fb7546613d633688e9ccaf3dc1f79755de45134acbd30a0c60fbbf5e6edcfc7c8c531a3c7697e60e1eb719dd53a236ddb5908144ef654066c75cc384e159c4f675436a64f9eddd119ad48b2329e404a2f750e0a48aa4b2836e60e94d5dbad68e8fce76bc1c79c03a4fb4080e97e6e0d61570592dbcca9e47b400e61452f1e2bd7520fa6662677de52b369f9ffee2477aad63845623187f626af00d5797f86eb18164e5d82cf9fc5f30fe0c2c9818b45da4f5271328b95ef1ab57b89", 0xfb}, {&(0x7f0000000340)="0d47f35886d8c30a1ed818d5da53d6f5b686fc736a131ce66f6897c61081f649e4741cad233ade30581dd4a1d59fb1f18567a840cb6d36dce6c4ea3feecd50066285681276bf4271d2d223ee1ea9d4ffdc5a2e6d1b9a072146540d847199030b4b3b4c6389cfbc6ce08d05e9e6c87c663a619b0239623d725c1a15320ce707d9057735d77e7f36cdba6cd05c606fc5888eec0fe49c976572a36c0fbcec25134b1cddafbe5f83de84060ce824b2404f781c3ffa7e", 0xb4}, {&(0x7f00000007c0)="945d02b741ed20eab13e82c7225cf78ac555eb817c4c3af4c7dee028c1260b3374c5c76d6672501aa7dc0aca1ba8659d9ccf5ec2681c26b4c86d34f16bb0ec23d09a6e6b284ffe5a48cceb3a9a2765330592cfe877247141930d5541adc80c68b05b24b020d454033e8b971d6be58450958d02fce46971ff57f7432a175626344545d1b3536fea0038a467983cf65b568e5e590b23c4f1752bafcb4e2e13ee5511394e48391231ec51fb52d14d6227072765a29c6c5f1f8813349a41490994d63689cdbb955b73a32bdf83d7864b2b6213d0624d9469", 0xd6}, {&(0x7f00000008c0)="500180f717429cdade46b8cc98e802ec18454176f873cace00403603990c9f88a8012fe46a1cb47e4b15c8de0ba0101640e1709d46afec3776497355172744578d978adc70524c9032cab7bacb61d7432f3317ce10c5e9048e73102099119165d75118d56352b0c6d2b56c573df7d41cb16a1c5c2d7888267495afeb12ce6c68a923f0cd75f30e1780d2de4abd53906d6a5f65e714ef8447030e8eaa20c2797be961cf62cd170b47bb3c02d15ee9f7eb6f0d91889a25c6f93954b1751df0754612f4ba096e82f045a913d5946654a68272a324d407d6f873e95223228ce827a3d7f7c53b617f0e7790fd69aded55696d8851486483e7c42e545e6f91350c64289387c3a3f4810748d8baa23b61b93704e7b813f6b759b46fac0135d6756ce7de4746b25d10009410220ec5a89c9c18eac4f565b9b32688940c50ffaea687064a78dbe4aa00842149518b7c803c1e0149cfc26f085ca72006fd0227182a90e965303e18b36576378d709d2ffc45ac5cad428710775842d7b7d2bbd91e978d6ff15cace861ca030ce5282cd79c0cfc80abea71464dc400b96402024f2a84b11b6f4e92208cf347634a0e707501fb3a6a5585b37d77c76ab3daa57ea41ef812b1652061784274bdf56068a47c0174773842324d8fe16fa2878315928bf906a8e7b3d8b451ede1708754989a73f7779027b23bf462abbfb2149b798ce2d21eedac60b0b2699e8bb82d090007b2de7b364409902cc3b9fe4a1065a2e3de672dd6e4e6d035e727e40c6aedbdf43a470861bde330189315841827fab2be7a24c725b04c85053f6e4d895d1262c7e65a2249b2e6cd4f622fd56297f2ac9e1fe5b1de80514a4fba864bf981fe4db5cebf002c7d01aa72b410262f4438cda7a1c908e43505af716b7a940dc123cc9b99e4bfa8a3b0d3cc4a2f11b73a822f9c81eec450530d43754eb69f1091eb2fbabc1b8c5bf54aa265603151dd4cf1be1e900e128c9f42a69d88e0ca7830868f11d5e216cc2f63cf3cbea6bafde36af517908fcfe0dfe266221b04d47eb90756f3dc484c971651123e9c65dc65b78a63274493baf00c10140a572fc2cbf9d0d87c5d40bb16d81c6e413a03c351b2665eb27dcfcef17d57fd4a35323bef90b979777844bbd359578af509eefedd805440e017c7302f0595daf654f495928fb7f71b6b68793092389ecd6ac25611b8b171d1581c678772466d91f256b1dcab70ad4eda819fe8e3680a5e4671e0ff692eff828c432ce80bc4475ccfc510bb3f6746924f3d6520cff9fb142b1fa11da1cd74cc4a406bc6f21b8bb8774ab333008c0eab1cbd0dc59a22cfb27eab5ec0178fed57d2e6ab75c02589ba19c5a7896abd8fee1bd6bb6f3ae2c9b615e123a22f034268306d6f86be8b10b89d88aac6e30c96cdb39d8b508cca53ac6fe0058de2bc0aa61e60f9680664e432ca8fad40b0c6fbd8283fce254592c491821f9a76a59e4e7c9b55526d7bf97de784afc0b9b11a0bdbb3f1460733afa58c2ba5d4c372a64c04707feca386310bdbe2ea5e853218eeb3d88e5857e240893da114a6a92d0943d9ee8a55259142ea076bf57b831bb8b923afd452ac900272304af1a1c1424d548bb5075783cfb49df1862b7d4aed26233ac994a5e9cb3cdddb7253dd38b5f225c1b71763166d55ff3a8378a9ff3003945a266c8a1eacc06bede84cad4b25ac2b2e91cd9c8e17e4728939caa5e0be6444bc16d21329776b973dcb40f4ecc1386431b724bbf175e9543431aaeee4c5fc9edb4def15133691585ae7af3fe44912a917bc77eedf5dcf40a1630ff197791277c7c1aabcefb3a9ca44631c6cf9326ee58ce73bcc6e67ec304d724d98cbfd34b0245fb12281d14b353b8d3eaca423a7329b6a83d226e99ad1c09100238ecbc89a284dbd1602f5986fa840bf50161095403247927e6468f64ae16d64df9f7a0585a11aa9a02e42ff84250b2f462dea7a6a36f27ec5cf048e4ca86286e0327bbbc4cccf71dbb0db59a9a7e08409fe9e2e073b01fac3aa7ea63232cf07e56defad0e912a3048f54e0c236afdd98a61b0a1d5ed768ef3fc6419515d44992959bbd2fb05af30b67ff62243b9fb19ca0e0fbee6d1ff42bb1eeebfc86602dbfb345307cbb46f1d458beb70fe7f53d3c790b139c8e81bb9b6082fc24acfa59be2407157bdc6d5c93d88022d81bf4cc2d00826666949ae6d207d143c64e40a0ba5d7b7c25c0162a2ab065030a3452f95efc7cf3f9de092cf38e10de104d3c437058fb1ba75e638f6d35ef13d4741a1978e064bd56eb88947261d67d9cb3a37eeff01dd0b6e687215b7c4f62d87cd0008da843ec98221f76c161c28bfe608d4cbe8f848f5551e283986f97ea91a784d374952d8c8c0354cbc1461e2e7348c923f0a3b168de2dfc95952a6eb08e3d44676b113763387fc1b7f56d93839138e5f785da61a6ac484c2c93a84fed64a9c4ee65b6ba60f5eb00d06b385339314c9e57964b73532f8b065a52c875bcc9a3ab9e013b12779c982cbd233b2e0eaab81f7fcd2f7944694ef55a5d762c99ab0321c53e608ed9c864e947157556d75b7bb89f1a28f6c6a22801cc19698e8ab792f24fff8670f1cf313251e9420f0a465d4f01d79b4c46e1bead0a7e26e72653bec82031c4ea15ad2315e27d6302d32deaa51922e0718c29c2f634536d9c6321e2f56a4e7316fc29755a43e831fb0277afa1a98d3d8b9eeede2d31aeee8675dfb734681700ca07a91c0a1fa606f93506aac7871c5141b72f00ef362bf09fa528f754be2561ad156c0297248beba9c36e9513825162b19fcd5a1a6bcae98d9bc5f1ebea6a6482084a0b70387983e124b7ead222e18d7276bdc2d21e8b78fdedd3bf54eee7703e63c6dfaab2950aa2d8dfe6a419f4d035f350bf3b214c782be0354a85b825e829969340a7d49a23c7c1af8f4cc46aca2dae8a1357f4af14d78b02eb2d45300b14d533c22c2d7e08557b0127c0b20344c6fdad062306aa97f90ef24b8a7b7ae2aee8d5637a386b01230bc35e18765448da65f20a7fa9bafd95eaff12b6c219a546d820b4a9c83c34a152b16283bfc7b9ff3ccc4faf84f45d44f536da98f0a60a21856ce7fb10bfbfcc96c31bfab4b1021c71561c9b6755852acda920b43067710ea8a2b7955198027e3c58cc6634be433263fbf323f2a0cb5e82403ea5913aa54f59c1dcc0ebdd8d658bfc434eaa69fee3d75a3c8f0898117e72dc3cce46c81f19fe8a128ea364999761269cd34582a8d90c81c3753fdcf3bb3116244e1f3b3c437e632277309edffbbd292b421b92878ec5eeef6d4b7cda112c7b746db27b152b23899af3c32cf25e18c7a132b380b35e44604a2c8ee5e3b51f2ebcc5c1fd25bc6385c9c34641d8a6a3b711cb57aaf4271827cacdd7be979ace0ef52346e6d31292caeb41952f11c4e156a7b1d0fb006bf9002280c331babf68f5b3a2733648bbbe6e0e9198c6f3579b5285dc709bf251033419f27937a6e610558b4c3c79ab27c9946bff18da685848b85e39d710d90d286ba8ebf8bf2475901f4e36b4b7c53f6be946371c349bddc621e1e832cec6343e27ef0e7fda5403454330bb55bb33f69ce3545c351f9146752d93c3da9809c638ff6948baa4044eb0588b5b08a73fbe450f28f7f11b76c719d629a6af81fcdc00d88d8e322a1c6bc1bf1505bc70149fd8d15f17e6cf6e0ec9174da75f3ffd9be8e66bb97f3c1ad031d81c902a23bf1725240afcb18998cc94f5d2d6ca9233191d12c0fb0fce6dc8ebee4cd9e13fc49aca58dfaf57fb76694a5d5bb98e010481acb612dfe0ba069cd7dc73ecf1ec1fe5afbb3c4ffedb8735c090b665b5b7fd3658b491153c20b00259d6ed0157534adb2676ae526d8a6aa2b97e6e019085440119c41415ba066043576b7f20537c57b12ded1571182d607726f2a2fe0e7ea7020bab98cb3b6989910490cae28e4cf04b912622ffce2f96eac6514de57c57d7a54ca98ecba1ba3a6eff95d1c42b5ba6a278e094cad0bd2230978ccec0094bd9a3ba48332b98cc79f907587bbae144c146adeda9795bcf9fa86814fdcf7fab63fbea056057bff83de0db05e5846f7e59ec15fb751f2e18d38c06debb6222d30cbba8f8994ac9b544d9d2b943f20206d5b17c3f99f189efca2ae20730686c78ce9a79a9b61b2c320ca2d4cebb0e34933c281b37a9e60cd3182f64891f377da53a5455e9d7bb35e290a6647d568862db7450bc2287d75714d753c96b9234ac4b8a52f2f1347601052528b1ae91b4e87397e6dc0515b944cbdb519a0f2d501b63e840c1406de8a2d2ecd97cdaa52634472a65700a3d21923ec114e39a6d3b7e709e038fbb18ac376505b73051ad7a5f177f9149b8a897960a1273174ddfb8d50458cf1e11dc9d89f522b25fe5b37377de8b459d008f4f60349a302af930be89a7790f6e8cec1943afc2d4fba8c0437ab39200ef4e519577413eb30e6ec9b02c794482eb8f343fc3225793d49229b409528151cad1f09a66408c6ea00c6fe373fed2e68a09bddc1ba65b8bda071cecd88108977bc8c19cea8a30d5ba22661a4e223f151e86f1291227b34a078119495b2ccc6f7860d69944deaf35ac3744211a95e481737d2d8795b4ddb3421635837470e654abd2909c71776e7f761d581fb5fcf5349cfee4f6734b68b32e1dfc1f3c2b59980bfd906cb43a18bd6a23405aee317d731a011f795242411aebc09bb49eb94bb48a3e0d76269217bf25ae533dffa32899656dce52ae065d79ee866e33353cb576bc3382e4caea7c59a4f2e3c1e22ed086e135dbbab8e9c5aec0e5dbbefb89f31a25918cba38da9a9936398e4c9b5268eeba7e09f35fa1a03e58e032f50bc32bbd73804a04ece562ff109352230fe3064b99fdfd8956d04983b71bb75138454570c42373099bab5eb390c7c69c984c8cf29cdc207185286b1bdbafa6c598981e551093961f41f5a3ca18b2e33c1c67e8755811aba05e89a871eee0395627f05760b11d7eb7675fdfbfca827ea20c330b500e61edbcce7e1a433e311b8cb2f225007c36d4e1d98b7add4c4d4569c4667faf71d3a8d64f54d07d2ac0aba326528239a5a1e8669e29a61a868e054800290c4eb5bea40e8b4bcac96db7634ba1978a04ae8b17032e8957e7790bd689972d8d76c72a1c25c7b7c3e9244a1918090c8450912e576de989feb9393e214a3f898d72c53e3db41f4e91caead3b3ed641af3a2975315a00d6224c78c389917f9649249cf402dc40a1f97b2d4d416d9f19b28a34c294d5dcdf110647cf7ca40f8a144a40db04cb6b96e804a6c610b41403a5d6c30fe7197c2c3db797a956fd34edd2af9d444c36931a989785c3276fc9eadb9b34748ac11e0dae8488e5ed3ad54fad6d16a7ee98a5db2eba9b6d76f573304ca8718cffec8470f43d465945b69bee21733876d6ff7099cd5725e6586a09690d5f810587cedb4fe8a8cb47ee1c6490ad405b6c3297e2b6bdcf820bc1189b8e67db811465b2585e9bb40d6c5d72938a6dc16f383818a5e974c8605651b12a4f0b589746786d06fd0653e1c7494f749868fae51a0a7b9b03aa4ea89d4f2c0038b4e07a0c2b45456270db7794e11a3909cb4590065b5b3a65aec034dfa6bde44beeb4e7d4234e8be86794cb5b89608f8d22219d917d40637839fe15a48b6c5caebcb6a458a6a759143f7b673fabda693a91917ea4af1c13962f22459bd9a6b966a9aae8a2e59b04e9498aa1bbe6576dfa4e953a144d202e22a5eaf6435a00be29a7bab04ed888535bc768c718", 0x1000}, {&(0x7f00000018c0)="3bff76753494183e0b21b2f741c69e401cd3727c72d8ca1ecbd66ee2541a1a3087f063e09cbf8cb775d70796cedd509c6907b9513257a90ddfb2ba77a9f6e1dbcc4467c1a0f0319a3903ce981f2528a1b5db7485dd8755b15d96488c34acedf7924a0376d1d3dd635405d800eb817cb59dbb025404a1735e3564", 0x7a}], 0x9, &(0x7f0000001a00)=[{0x1010, 0x0, 0x8, "13fa010e06b7edc89c34b1a9152e41778e44cfe42550f247402fbd235a26899780c90826fad96ded0af058d32b3383075cd80364cc91f8b92e65f585e8098734e79c4231ed29a27e811c1875bb06afffaff335e2a8e6cf2c583d028a459fea7f263dfe6577d7e228867120848357cfe929ff3f29edb973e86a8bd274e795b419431e3b5f6d2fd7ccec421f12c3855d4d10457cc2b85c4e3efa8c13cc71b7c8a86ce4b7625b320ac3e3040c2225d86a5ddd9966fa5fec8408b2a04ad71e6040cbfd853c9a4e27ee9f69112874b6f4c18d74a18f774928ddd6c016c22914eb5bdcf8ef7eb4bc2ee59eb55705f2cb08fda0ae2c4bfcd120ef08e60d63de176f879b83291b04e65e78a18c5e966b7eb4a217a57295b51c73155f5c26a173194e665a1d77b898447ba2a3728f3a15baa19ff79d7ecf5b08c123bc62a25952b9463dfea35f82510c6ae024b9661ad600f535cd79490c1ea9820abdb78ae75e05c2620b3915a1f617878c8c11a42bb7721ac3380b0ea49230d26143b81493412114d50f4da2383d3e9244df4519478818403b5c73575db7c7addab23627d4b09068347a61a6759f075435f4f86035beb4149c64ad562d410417196131de53a25d39258b8c003f50f1a34784c7dc4704886c38c81f594ca46166ff2d19a5119feaea88d9cc7fc2416f8aee7c16dcea35a686c426fbc3c5ed97104800cf3d4768d267c88958240452939ffd3fa450141c2f49c730a963dbd67c9054597d58a2fe2d1ea4d3b1df75644e3c983d01120116f8f6d5bb0b7a0e00257927909b04d93d8c8c747d5af284a85cf3439f72ff5e5ca7bde7b15cd8c3d408955bb0534a63ba13654249c77b5813d6964ba6f26834fd8d4739f04f09fac7470aceccbbcfc885defbb2440213359e6c9ec06b3410e7be75a41c31e7500605cf364b73443a9f3092a07423f8b6894be06a2b5cce4f9c90b74067e46e97891d85d6818e32fbeb7b5e9e93c3a1abbba418e73fa0d35162d6f92d234f8acc292c09648bb11099502f993d867ce75ab9bad43833eb7039b7d5244738981e48417b9dbdc9e8082aa85cec6f2f300ab226211fa1d42c04dc606d403dc4a623be1f633f17a8b0e0ee27327d7015c5b5e5fd29fd6a30bd6ba5cd58f2eeac19754057bf8c2b125854c33c150254d3cdab8a2fca2f0b18dde7a0f6a446892d23aaa5ee55c94bfb29acd5dd75cc2e596bda78ddaa328037e80ee9b6e16eb57ce8bb5c307586ebf6a8cc93dc4e4bf3a2566708a13f42e9ae405bf5e582267ef24fc3d16f3d5f8f5b220d8d63a004b3a2bf9169a1136fb05a05d95f109f26c86ded6d05d532ceeb28e2e7b5aea2521a4ba0fa108da1a4116392325db25d9521d79ed2453eec77792af7b4669383ebcf3c70f2c30a68be4e44d0ca5822696fd59af9d345128067aeeb691345ea483d59c19a3f93e849d0d2b2c1493ee85d7089d3dc8638f32a383903050a587ebea766c851a6620f1007869c6f8c28f2b09fb539341e028a5e90fd9849637c44b7427bc778993882c64a7aa829353ff8e29cc67bce907177c7da780be71b2f09c90c0f138648aef882f4c78ba079c1f10dbe935f02ceb64e5a3a87d9b441b1e8e30013882ec731c07fb11e29f7baceaad54420afaed17508c6b86a794a453433710f9bfb4d42477acb31a32fcd226bea0b5dec64ff98553eaaa9cb60ae4f3c19240469113468c618abc819911a4b1bb23bea8c0a9baaf4d7d4ab73de1e62fae391584766d9b107e3aa8a38e55e089c250828070124c1f8c8d99e09c1890b6988b409e4f993af5d91f3eb930bb9b9b0d6a288a43d2f31c9b16d205161e4bc34b946fb044c748742dd0c1178d9d6566d2e78ebcab5531dd08e18759238ad08dd588ced2531218fd7bd5e97c3e909831a5269fe7b14e6c1dbb41f841363b153de9be451cbf68680b6929669aea410c37b9c4907d1b53644671237999d776b8ea1f46f7ed45814e8cbe04cc46a44445a0e09dad1ac2dfe6f1ef04daac3777ebbf7e4ac2a18ed5a38004038d2d04861eb3cd97afb3dbfa5f2309c43162dcddca200e0b639b7573f7776ff702ae0b36f97051e87d98151cd90993b9e97bfc15ead2769fd2e8ce272a34b3319be5ab33914477d0a0f4b9729ab2145433ae55af2eb6b3d2abbcbc7928e620c3889f90e9ae81c08ae7d76d16698848f5fde1375f26f675228bcd445373fbf6a557f83e493426f924f68d2a21eb9c62e55863b6f8e3deaf11947283ba71627384d67b96303052b46c762871e0566a258250d822dfc4f6d638fc2c015537aa92484f236d5adef3c3b0c6d24a87cbe74e1cbd06cb4af68423944afcf225c99537819be360c049381519324b7097617732a71495cb4a8c19fc54c569825c636f1e53bc853edadbdb3d98072a5e67ecbafc71bb0ddb86390f405e5890ec30754ebb2910ba2cd469d940d9f4999b926f5c6d03af70394f4207fe81e9b61b019fe5118ecbdc1b67c2c58fcae1edd3ab4e8ac12ec8437a4f96e47b88ca60b98d97026ed76e669b27d5ed6779b161fca60e8cc0db504eaa75ed701400d188eaa3a2cb03058786f2dc10e21a33cb4c76fef2c169416c85da1468e2500ea97cfac54269c70b98d6b9a782a62f21921484cfca0df01d75728426f6c8de04fac5b1ace63f79543b8193ce6ac2510ec34fff0461c2b1645d5531b91e2a9833710ba9830be9c81f243a9430b1c96ba250e65233f2d276cedabf6e315e2ec0e3fb856d8984ed4d2c234336638c21308c4c76a7fe6a1ea11694e2b04408b59982b4c682b67355e4631ca54ed7cde2d3e0cb63e45076f66234c2e830d5ce892038c74a2aea2f2d61294a53c48ef032a5ab9cbc8601f38ef9ec3b0343f7173110426c60c3872b429e4e4bccc988f3548c2b3ca65b08b0a0d6a04a3b345557d3f8cb1526e5e42d6e73d3795b75a3f63f589198f695b3bd4674fc71739cedbe8771fd1c9973a123b5f3052707c97b68d0c2f10362ef857766be0aa9ee85e86e3678cade4e8dbda5fac178bd166c32b8c753c5dc67ec2b352f25673562e0bab4eff4dcdc079373006878096c8bae75d0174f8ec0ab3d851f6edf2082eb33781f50db0014d4a0d39676575d3a60ff9e84028b471c6d75c3f3aa6f9e0456230b5a626a2cb84dcbdf98fc66f03a024d9f47dc766064ff4e5eadb162a169d7e0456be1871eddcd89bde5be77fe1833b87a1de3a2528437d19c5151c475cf15ae4098ec876b052f08f96111d2a67179ee1fd254d9177ccad8a04227c4494c2752f29843a2d4bc28d6d0576bd9f75a671fae3ea8adfd64a0c945408a622353b2aac7abf4c14247b3f835a8ded540c89ceb6fb33e5263eaf034b23bf4e4bb48a157506fd4599d51ccf08697e63e1c6135165bd5c5a03a3cdaf48c3a76c621b7579c49b2ccc8355eb71b8ee63824bcee383ef19cdf13c0295306863479a9d49f36a007683025f8fbbb607feee66a67f74c92b62e3e727d14a9a46ad18683dccfce97f6676207860cde1a5bf36cfe9b1f98149dddab612d7ca7423da24a60b4557bcb6bb9d00ff76c1e824a4865d096dc0e18920ed783d8053ff18c806c8d52bd866516a8dec79de7f1c156799e8df7c905892a71d968c3d1ad2d63181228779931bde6d56be78dedff714bf6268ad0ee9b0f10e56c247e48a0795dd6b9a09cef8b3cde276ed165378f8ae862a1b3bc7718319afa41a05dfeddb5fbb492cb10541c840290c380ced4ae776004ca333088023a4aa4ec0f9633bcd5a1277e867857a59a7e2fce80c55112cf21fabe4a3f7d3cfb92791b6e612bf47ad8d56b34a6208b15fd891edc3059ad043a4c377ec0ec58b208e82b21395beb40e7d6ace114568d34f0fca70950cb92674a65a2ff30f32c0140bdcb37e3fde8f94f7b28d433fe0042d97dc2884d35002a52a62a53cd4ff3f1ab72f96ec0929993a1b9178653821f8627e2e9d7a8bcb6038802e7b9b7b3bd24f9292415e3fb5db5b500d93c824dec00d38cebf62111ad8cb65f8f125289d6c0f5c35bcc5c8d3c5e1f0d58c7f4b8dee06b026c8b023bd25e6f0c5ea7c8c098055ac1c9c165ad091bdc4a372782d21568ca7781bca58d07d7270d97393c8a323c566779eafd89ad4eb987d9038f57db04c29e47c0bbbf0a8d2d1cf165d0df7743d916ddbbf5661a680fbc5cd19df217f4a7873a5da625242a13a7aaac0d331bfac93bdb72b7209e5f302f20f2c77233a911ed41b882f64c61e8ce04b952497cd90ab6acd1363bb02e91b13bc4b6988f65b40d75f0869b0977df87afd5c26c3cf1efa89192a1903b965ecc400ee303e00b59db98e26a8c03198288138f8da014c5a4666556ec425110e51e86b479864ba39c5b30ba22b215a9b9220f645c1a6289de7eee0972c863eb3f00b03367de45327ad5c343387b0f769684ddefa3f2d160ef32864490323d6ededb89a1654f35beae398967a9577e6f957ac82ee0885b4fea93e0459e52aa6aef49261ed26e382901c24ef7c8fd0ae944e002b9f22a56fbea3eb2c6095c385853d6bd9e456c1c557b37f842f384e0f2cab1701958b623b2fef927985c83eb1feea672bb0029c71e8b9cbcaa5765a7fe63fa62517ad9ac8e4e0decd7fc3fcbfd9957548d10f7e3faf8d947622258fae219500b7b41e38411eecf7be72c7b05d24d3acc56064d823a7afe84d1ec4e9465d2864b10eb3bb5e8e3850cd24e45dcfae02f7927e60ad505c25b7fc6128ea99b86981dc7a795879c51579314a80bab5524e1f643625c6d4bf7a1073b3e72f2b68159647d835bcff0b5643493d5c21ea12fbe1b3171b3790953d90a2ef14645c561b685415512742ed7d25f7d53071d33706eb74a7cdc893eccc69a01673bef60ca6e6b8898a92f3dfc6d8eab74f54b29f69db80772c10ac1fe56b9c501ebba9764b28e865eed61771744f96deffca0cd3d01e8f2eb7e2efe2a70a5dd25545b021d75efaf4542561d75f577aa23f4a461763d0de1b955de6f1c95ce9896f6cce90a9acd255c984bcd11d6854cc83cb10a9e7621996d69e83ba9292d220c40952989f7e6c99912484b6656713bf27aadc485037902832ee4d7c6253d9fc88ab7b5b8f4e8db7152e3dfcc6f2ca5f1d2ad4b5cb25cc450370b3ba9d75819bfb1738adcd4c7b8afaf5e4ce49933a8cb7a094172d1684771635719cc5e469f2fe8eb9139434da8e186892d7fb92ff67142673ad3f87b0ed7a0b6008a089c722f78b0d6557fd31364ef5667bdbad01cd9cb271e717aa1c356edeb9a13bfa0b716847be1bec48d5bfa4431fa04849b5a073f4a9962fe53e3c5849c1fa0a0aca2b56e5c3647f530c98b46be09921ac6343fdfcf4a5b3394b21d8d7b67dfc4fd40973eedf94188e6f01c1041c8addf5bd7f4cf5f20cfc829028178edc7051a1978c1b93f8bcc0e8f8a5f811ce724c0b179a5e75083cffcb2f6e35030d3e812f0c891aa7901cef764f3dc2fad22d5b30d39df9478510d0d7209d3654ddca913d15f0eecc4c69b683daeb7e458ea0b15be7494c593b0c5993ace0621e9c93b696b1ff76fdfebd7bde24383374c4a9ed92084e4fcd3dbc0b27b23b3b69c5b88ef8f42752aededc2e1b022a45f4d07681d1d447ddacde5b84bb3456fc22b5e08b4e61e8fcc71b877d5f8252f26de910e585386892535abafda05ff1f735d85c31ea38c904cf4ac5ff84fb8f649b373e1f01e0fb9d291dc950f4fada614757ad03c1c2d701f3089a8b6cc2d6b4cbb67c56e707245e258d496f98059c126e2401f67946db3af66c3d34"}, {0xa8, 0x10f, 0x6, "562867c8da5017af87e8f3757caade6de00f96e09bfabf839497db6c95fcd24cd460bef4edcd92e49ba9ec9c8a44b94309c8d82ebca32de921f226fb33e50a99bcff7533cccf19b08a01ff2032837cab529ef1db8ac62d3e04e7d402faca56d9a952464ff50c07572680f126fdc68e91f9ca28cc0b98dec76979658bab595712512664aa02fb61059af8ae6eeb036ccf5f155aaca70046"}], 0x10b8}, 0x5}, {{&(0x7f0000002ac0)=@llc={0x1a, 0x33e, 0x8, 0x1ff, 0x88b1, 0x1ff, @local}, 0x80, &(0x7f0000003d40)=[{&(0x7f0000002b40)="9ac5a3d7c7e624d786ab8e74c7812a49cfc7c2335a048f5e8973da2045a8a131b56e6df17762586f6c1d407a914558aadf310e6c4bab19b9cfe48d9b23722141c9c028095b8a13d67d198ce71ce7e9cb1b68811521dfeedb6ad4b54a19e71c975a4a15d7bc6a06463ab3f5d7825dcf53e9b833ca9248", 0x76}, {&(0x7f0000002bc0)="fcd4d5b14dcc4477fd62779ccb72252cb4bb361bc57512c158734c2c4a1ddb205bdbf1a6b93563411125563207547080396f35c6454aca52", 0x38}, {&(0x7f0000002c00)="56d06387d97edbf9a42b35141c4644f7c9c04946de9e901a2ddce6df4a29995fcad24cb8289b21b43f54e0a94de974a89525c45116884f5b27c23a0b0d4c0df740fd9dc70334087116a1126a", 0x4c}, {&(0x7f0000002c80)="9acce457a5fbce55aba44fdab66a6b3b25a99c2e018464061330fbd8266c84a74d81bbec8c26a4fb5780c7fb949e9f7e5277afcbebc2c6d83d1bf1364fdfb88e3f5784741e881aa98d201e0286dc00ff480b3b85b0ff9ae3dddb17c14a13721584d7e4b6f0cf726f41b6dcbed06310c76bbec38e656bc8fc646f88f9e1c10eb92943d823fffda53909b999cdcb72774e225e1c62c84d947d96873374fcfab5cdeff60bb7feeab73b76ec653dc9fa1c7ebb53055329d13f2d5d03582ae5733f96399110136d4fb1ad989dd2145707424277ddd359054554d15dea478d71e04a4acbe2467e9f561a76ac7b6d92e59021eb6e73ebff6ea45dd845672f1a618cff730bbdcf8f97912c01140af4687be347abedf423f6a9cc5f7857a6055474af18d92628156b8d17df11ae13762a24065d831b135cd4761e06ec9959586083f8a94e73a1efe6c23829b6c7154a6991daec8c7e6fa9d1649705a3f53d91949c4b80d7c72e2f130c5b8e0faa5e05609012d6a66f8866423f63a993b4e9580d733fd0023ece1732fa82ac428ea9c733d913d07a04d45d91f3e38a415d7bdbda968c9a81a9ad71f2dfe2da7b997d70ff90647bcaefcfe5e622d29f01545e08fd971310f43b25594b8edcc616b0bad3ac139da709288155164c6924865ee669168c556ab9de424ff986ba018bed225f594ec95496761500219efa320c1c65b0d0d4f7b6781e75c75c7fa813939e8ab1f96c5a3a4bc9dc215768166d26a63f3f0985c2273e74ae3d6ad5475c7aa6348de59f9e4877a3f874ce942838935002f41f770d7a051840d8aeeafe6e61145c94636ed006a08f713fb6e9f6419acc6827b44bb11d865962c74ecd32ecb148451747fe0886a580635d31977162a13fa5362ccc15b924282b75f369e45f01147ce4ecac13bd237aee9903f5c15aea5e80e0171291a20fd188497c1a0d8c18617b7d61b7978be28ce53222f27ac5b856b03ebb12027900a1d385d5b59541e0b8311cd960a8db7bb3feb4beb756d92b8639b4b46e2157d14c00a45513f1a32d40f7b3348904a38c18faa518461a37971320975c530397448d82cdfe0c5635a8f882a279cbf17572cb23c9f02dbfd67097f6b4976dabf074ddd9f08ea61ac305c378549711c8049f1c480843af2a18ba64edc1fec6eae81359ea761325ae9fe40fbd95dab099f8e978033f465248d6b3c94377f5f06d43115e5e00d74816f755a5c1d1a397925c0a7b7d59701b2dab44574e9a8cf716e2accd96ceea48768211b5b6cf5b322999d53785ffec1170d1f95b6cdc68e4556131c569d45b3b1e7721ffa8ea72f1ff1e207f7b5aad1320b18255f20f1aac376f5211bcf83f7e808970165c11cfcde8a9e9880716c5395f28f5ca103e901931aa1949cb31af41639968d54e6c8dc83e9c5ca5aa9298389e3300a81bd24ac024854d3a89ed85fa2196d114841f27c0cecd87137268efd0ab588a07017f3a8ddbe6b098246e57cdf4d6862b6aa3c83514b519f533f03df7caa122eb2c8ee1ec7b82e3e26b418efdb0b506ddc44610c81a805e295a0b150e57bbbb4abf8e6ad16711175f4060bfee65db753e7b3ce34f2bb90cee7fb569edb53c9d94e5cb5666bfd1d1b8b8e72fb777a75278e433392a3f8e85a542656313800ad213a9d64768ad2fb1151033eaea7fd2e556efd04a38eaf6f0a20420be517cb9438a275c35230e86778346ca27e0ffd1fac76d3a0e2232ddf0b66fed8fb0e121c8164d88dde5870cd115fefa80aa98613d71affdeba3d6542508e3ce26709b4df7e9b6657f1e6a4e6de5ef26ada6c5b6947b267d8ae24c0612326dace0ffc0daec81533f322a3ace6e5a99471e84128c11bb23dbe0e2685799af4ce325ada71f5cc0df1f11ea8de602199a88032f9af8e1199f6118e58f089add878388a93548c927752099135f5e0ee0f658176c4300b43eed39595c47d9dd3a28308e7ec4d6726cf312aa8f409f96e6df0e5c83b1baff15e97cdc1f6a5eed19c1fc9759d0320b3f3ae3f9241253e8701c558a12b2651990a98386e06197a8b555568532c1339b28cde4c0b87bfc544ea3db68d449d15e055bcaf4c87f1901f5ddb7e5558b43294861f9312504dfab868559350632f2d77ee6a9bb077e5c445615ea0cf07b92bca94e17e1400408198edc3e0a44e8bd4c9fd328577e3d8bcee93f9c3ace57470c868b4129c1519e18ce2bac2a608930f04993230d1ad4245776715f807dad085721fab3f4118d82a165e0fc2489460ff4aa2d6ce75087e98bacac32c0a2629ba1fdecea213c6add4224cb0d7eaa40065d4d469de068e1e6728149e628c3c4ce07b6bd27c73442f87101a980fe82544b01dc0fbc48bf445994c9d61c052724d3a62ca4ca6858a14d41595b4ff9470fd610d0864aab14a5717d427b3263e1cd6eafd81f1455edf178f7e9161445eb0d36711665b134eb7288ead4040cc91e10e76643d0b130b39951d2b9dc0d6e5dfcddbc0e7c9b2471b38a85edebe86db510050680552d11693730725489ffd58bc260e8ac7a994fcc36f4aa1eaf9a9087fd2c4773fb094b6604b40f14b3677c399f520f7ac099645c9f415587bbbb5c0c8251473ed170099527a5395671f10919deea79061fe556cb66b28a8433076cc0d63df8aa10ac8b529ef5ce7bd35ad98559f617c77a76cc6e427c10afd0ab0d3e842d88b08d79c81b3750410bc9676b3b50d58a2a919d0a308bdca7bee5cf2da5a1b10ce1fc20a6d5a546732e52da4ba01f06ed458dbdb0f8613c2bc9dce3f92f90d9fe85f0205e0b72b352749a939ea7e281ac9d1278709cc6ceb21f1aa4930ac280a264291040748b086ec9e2608f7ad910fd50bfadd19b12876b93b573673f90081df6f176bf36c59bfaa14376fa1f1b2996af04db0d7300e0e6c8ab0e3297bf5e89b5913b52cbc88b434df9186fda585c31a23ef0d1cb8005a9eccb99bc087dc89a7073f2be683c4ac8dae1f1c18ffe59d02de78c7888f26bfc4f417ee284ab9b94c81d00265bd37f4167c33e4c557e23ddccd3682bc8dd6cde0e170d2831cd657da209a4381d0c5b4b3b5cfb0c966f75761bd49b949c408ec7b26a49e51843a7f784de86af98b22c4188ba095874b5965c394de3712ebe31f31f61127cae3bc004d92faff91bd5a360f7d65b8e3935ed264523d0883ff1e5349c5ac3576376e9376ac5d9adb29438d05ca01826e855c45cb22171cf85ce1fd245e6e887b44d7f3da21b280573e954e0c6e3afbb7616a0d8a3419c8a64a842dd76d4a758c78ecb02b5c35ac9ffebf7c9fcdcf0fa40ce3075ef66c527c453b35f475ac33680c1bfa001546fa36b1d53bf86fa3af6b9e539d6160c986372f3c138b4c24ea6d19404da255af9f5afb864c0854f1709a5e594470f616dcc5d4f7e9ef10253c54a81c697d8d51ecf307ded8192759446c783dce03d3c6d01d75f62e306f7b8078ee8b6b4478cdd30bb427ae538a47463c402bdae166a3552154b3db1759027ca2fb2ae416de6d93610238dacc6793a98d5a453887f50fb1d3c97e55331a3e4991266be9eb4beebecbf8f33f0fd03c5fea8390014c908cf09398f3cf6b62bcdbec89a61a558d2c84775cc414e241f3288a7bb3bc5ca5fcb2067af151dbdaaddde4b4f1425c8c39fa7fd18fab6780a724f3a493a68142e34f690ce9e17e3a070fbbcc071959effa73ab2cdc27d42a8e93d0f91be0f5faf260bb6f388e775fa617986c10230c88cccce280dee637c2bbd6ec2fb2ab4df01686cf5909f2c6c9481aec9036f49d94ab33895e892cc9809712e1ea6b269d6c8a7ea503627da4d2b329cc3901d4d5430fbd63d22283cc4f7b84705e8b9e49bd3046522273ec926b686f90f5f9785cc17919026958ca474b3dc7c48528f7a14d612a2147c019bc4d3a16c653b22f5912388192a97e321af2caf7a0987dcda724f52872c4e56e65b47e9de41503185f250b768bc66d0c5b0bf8442735ff69bf33c44f606a6c061af379be0c467c015f47a58e6f50b100df31838161439765948994bde99e24d96113b62d6c52381a42deddbe68bc89efab7fbc75950801d23b610cf2d09d29f07642a2f9e8b8fce612b87b599f50ad34fca25b5d890279aa571641731776aeb6437238384fc8dfde07739ca6858ed599b095d8ec27dfa785eb09e72788c4948da265b3ff2efdd46b4be456c1207a3f6add48722ec82fd673459ec936dc9ff5bdcfe139e8adc0ac2de3f95c9b41e87e8c3183dc02cdea3a7a6e739e4eedfa5337ea7c87826fd0eea685033a5421f01fe9311591a69ef421b5f32fe2560798c7aea1868343e62c03b246650800dc9a6338f8ad0abade1fefe48f027a2ccb3f9174555d789b3f422a06481cc725419935386dbead0718517f03f65f098947edb5e41b0d8b24b7dd2d72b1734860b6eccd34b9ad63a0a0fc6384bacfdf71475c8be542685ba8ff3b22576f67e5844fa4a20c42796b3d759c65499c0f6a71c480a2891f9a7040127a44d6369110c14497221646faa73bdce37f5120eac305a36f6053c3c7a584a82ee8f175e58d924454ec68b8210984f83aeeda664e45123058f8a6ca73501a9ae852e2fc126bbbc7bb762d707bb82618607bea1e0a801bf45bdb454589aec8a2f4eed80f19b727ad77271cb8718f696ccb077c031f71df67946db4cbf44f6defa0d8f6f902dd46283a1c93fe2d1b03a261ca4d7f76bb6a335086f594611c9ba0c7884cb5f81b7c962409e8bf83153d206849db53a936e87d11a2e175a7d5636aca70d8163ee0ac22c61fc0e6e6052bbd25aac4a7b6abcb259c5b32e9283b57b5a404c2a9c6466b37a468e6f14aac72deeea4e18b23a745eeabaacd0fcc377773f19db481418dc9d2758181ca932be183a9efe96fdb5f0a6f79708329fd18038e150dc2300ea92bc23d5f1bd3803d3a9cb9f1246282d85e3f7e5562ab5b2ae23de510f182e197d462ed9de55915d0d92d0482b9f94d9573227671c9afa8b407fee84e736dbab1059ac9e59beb1e65c6984a8ac9d1f6313fec3204c9826c70be674136535069e0a24996ff4afd4e23078dc6142e95b249b9e61de7ec853815b8d44e8fbe46cc020d52b1dcb8897073da85db31f6b044470976e95be4553715851e0f0edede8e0d68e88cfae407175e64678c7073f80884e834fa74b1577a29eb57c0e7e139bfb7886598c553dff3e30967a59883c523e3119ad928ce3479e5ebc508f4ecfe5258e8ef13e4187bbcc34fd8f2f594139acac5b78869ac8f45b7d3ceb12ca16ca83c05e72cae2a309d9db90ff199b8921f7fe0885e22a1742f293c65bf01608c581717f2d17a97ec1688908ea32ebd00ed635c651566ad8fd955f35371eab94b0a1eda1a448cb8c446d480fb6e496f6e20c054650b2db96380931df5813c00bf5f988584d89abcea9bf168e9461b9c91957c210b424db9ce5d68cdefe0a91030f16e01656c4b58683d5e2e194038adb8c6e806593df72232283916df64b34100777be480ae061465e4907240258b11ee506d64fd5631b6e846753e1530736986c54ead22418e62de628ddc4d120e6767e519fad8ec9e69b4fc8f83d0ffe24e8be0a08935a4b1e85159b706441ed45886353ac5fa920559c041202e0a59cb1bc2f436fd9bc7594082846174f96985c45808635192426f97527be5536d14b4437ed87aa794f13513fc20a2082b0a909c9433adf5c3adae7a54138e0c822c67bffe8eb735c1f6973140abcae99d435b4a849a047e439ad7a6b5dc5a62a5f930896e075c8291c416f14", 0x1000}, {&(0x7f0000003c80)="fd7f6a5ae9387bdc7f3da4b4618157e3f5e0a47ae7e2979df1e9937a6df9f3685d2629a926dd6749077e725eb011c454d0657c3966869cc82c04ed9d230a7fed1516a3e853741a7681695778870d69307b38678eb7bdef2b70bfc913ef50b4e02f4296f192bc08f24cb0a2e039ae41b521adcc0553379f27cacb59517da38d7056f12e6a292c2fa27629199171f66dec51552edb2d6839e2352f5760c711eb587aa7addc31457ec7be80088a0cabc7fc935e", 0xb2}], 0x5}, 0x20}], 0x2, 0x5ce93df81f970e16) [ 541.101177] binder: 27225:27246 ioctl c0306201 20000440 returned -22 [ 541.126522] binder_alloc: allocated: 10224 (num: 456 largest: 32), free: 2064 (num: 1 largest: 2064) [ 541.132757] binder: 27254:27255 unknown command 536872064 [ 541.141836] binder: 27254:27255 ioctl c0306201 20000440 returned -22 03:37:38 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x22, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000009c00000000ebffffff000000000000000000000000"], 0x0, 0x0, 0x0}) 03:37:38 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x8000, 0x0) ioctl$KDGKBSENT(r1, 0x4b48, &(0x7f0000000040)={0x8001, 0x5, 0x3ff}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 541.148044] binder: 27224:27249 transaction failed 29201/-28, size 0--26237955211264 line 3155 [ 541.149127] binder: release 27247:27251 transaction 1570 out, still active [ 541.177153] binder: undelivered TRANSACTION_COMPLETE [ 541.187921] binder: 27254:27255 unknown command 536872064 03:37:38 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x6a8da51c70b997da, 0x0, &(0x7f0000000000)=ANY=[@ANYRESOCT=r0], 0x1c3, 0x0, 0x0}) fsetxattr$security_evm(r0, &(0x7f0000000040)='security.evm\x00', &(0x7f0000000080)=@v2={0x7, 0x2, 0xc, 0x82, 0x77, "0258289f7bd2bd5ac7ca09ed5049ffa31e59d40bb5fc721c728ce318dfdf83d62d3c5e4629d7aede4cfc73c40b1426214723f8c4ddf130a80f7fffdf949b65f9c6dd92de39d49a00a89c1f48106628640f9023492438a891c1b704baa93d7d740134fa67a1253e71a0ea77ad568a5ff0bbfe92efaa074d"}, 0x81, 0x1) [ 541.202045] binder: 27254:27255 ioctl c0306201 20000440 returned -22 [ 541.209973] binder: undelivered TRANSACTION_ERROR: 29201 [ 541.223549] binder: 27258:27262 ioctl c018620b 0 returned -14 [ 541.233912] binder: 27258:27262 ioctl c018620b 0 returned -14 [ 541.254278] binder: release 27257:27261 transaction 1571 out, still active [ 541.264255] binder: undelivered TRANSACTION_COMPLETE [ 541.293688] binder: release 27258:27263 transaction 1573 out, still active [ 541.302750] binder: 27266:27268 unknown command 808464432 [ 541.308494] binder: undelivered TRANSACTION_COMPLETE [ 541.314266] binder: 27266:27268 ioctl c0306201 20000440 returned -22 [ 541.321745] binder: release 27258:27262 transaction 1572 out, still active [ 541.330800] binder: 27266:27268 unknown command 808464432 [ 541.336662] binder: undelivered TRANSACTION_COMPLETE [ 541.342396] binder: 27266:27268 ioctl c0306201 20000440 returned -22 03:37:38 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, 0x0, 0x0) sched_rr_get_interval(0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') 03:37:38 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x22, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000009c00000000ebffffff000000000000000000000000"], 0x0, 0x0, 0x0}) 03:37:38 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x42202, 0x0) getsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040), &(0x7f0000000080)=0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000000000b7542016c4ff05f900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) 03:37:38 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x12, 0x0, &(0x7f0000000100)=ANY=[@ANYRESHEX=r0], 0x0, 0x0, 0x0}) syz_genetlink_get_family_id$tipc(&(0x7f0000000000)='TIPC\x00') 03:37:38 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 03:37:38 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x0, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x48) socketpair(0x1, 0x80000, 0x7fffffff, &(0x7f0000000240)) r0 = socket$inet_udp(0x2, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x1000000000002, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) socket$packet(0x11, 0x2, 0x300) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000280)=0x32, 0x4) connect$inet(r0, &(0x7f0000000340)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) [ 541.748993] binder: release 27229:27242 transaction 1566 out, still active [ 541.793264] binder: 27273:27281 ioctl c018620b 0 returned -14 [ 541.797595] binder: 27277:27283 ioctl c018620b 0 returned -14 [ 541.805828] binder: 27276:27282 ioctl c018620b 0 returned -14 [ 541.815341] binder: 27275:27284 unknown command 808482864 [ 541.816947] binder: release 27274:27285 transaction 1574 out, still active [ 541.821949] binder: 27273:27281 ioctl c0306201 0 returned -14 [ 541.828568] binder: undelivered TRANSACTION_COMPLETE 03:37:38 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x33, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000009c00000000ebffffff000000000000000000000000000000000000002eb986318f9c7edf35b2"], 0x0, 0x0, 0x0}) [ 541.834792] binder: 27275:27284 ioctl c0306201 20000080 returned -22 [ 541.849401] binder: 27277:27286 unknown command 536871488 [ 541.862268] binder: 27273:27281 ioctl c018620b 0 returned -14 [ 541.864893] binder: 27273:27291 ioctl c0306201 0 returned -14 [ 541.869529] binder: 27277:27286 ioctl c0306201 20000440 returned -22 03:37:38 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, 0x0, 0x0) sched_rr_get_interval(0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') [ 541.887884] binder_alloc: 3591: binder_alloc_buf size -8688741244528193736 failed, no address space [ 541.913643] binder: 27275:27284 unknown command 808482864 [ 541.919031] binder_alloc: allocated: 10272 (num: 462 largest: 32), free: 2016 (num: 1 largest: 2016) [ 541.919600] binder: 27275:27284 ioctl c0306201 20000080 returned -22 [ 541.944553] binder: 27276:27298 ioctl c0306201 0 returned -14 [ 541.946574] binder: release 27273:27281 transaction 1575 out, still active [ 541.953399] binder: 27289:27293 transaction failed 29201/-28, size -8738903024400859136-50161779872665393 line 3155 [ 541.962920] binder: undelivered TRANSACTION_COMPLETE [ 541.987064] binder: release 27273:27281 transaction 1578 out, still active 03:37:38 executing program 2: pipe(&(0x7f0000000000)={0xffffffffffffffff}) ioctl$IOC_PR_REGISTER(r0, 0x401870c8, &(0x7f0000000040)={0x8, 0x2}) r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000340)='/selinux/checkreqprot\x00', 0x400000, 0x0) ioctl$KDGKBTYPE(r4, 0x4b33, &(0x7f0000000480)) r5 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x2, 0x0, 0x7f, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind$inet(r2, &(0x7f00000001c0)={0x2, 0x10000000000, @local}, 0xfffffffffffffc27) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000140)=0x37, 0x4) ioctl$sock_inet_tcp_SIOCOUTQ(r4, 0x5411, &(0x7f0000000400)) connect$inet(r2, &(0x7f00000002c0)={0x2, 0x4e22, @multicast2}, 0xffffffffffffff90) ioctl$sock_inet_SIOCADDRT(r3, 0x890b, &(0x7f0000000500)={0x750, {0x2, 0xfffffffffffffffe, @multicast1}, {0x2, 0x4e22, @multicast2}, {0x2, 0x4e20, @broadcast}, 0x0, 0x0, 0x2, 0x46a, 0x0, 0x0, 0x801000, 0x800000000, 0xffffffffffffffff}) sendmmsg(r5, &(0x7f0000003740), 0x400031b, 0xfffffffffffffffd) ioctl$TIOCGSID(r4, 0x5429, &(0x7f00000004c0)) ioctl$SNDRV_TIMER_IOCTL_STOP(r4, 0x54a1) ioctl$KDDELIO(r3, 0x4b35, 0x8) rename(&(0x7f0000000100)='./file0\x00', &(0x7f0000000040)='./file0\x00') sendmsg$key(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[]}}, 0x40) socket$key(0xf, 0x3, 0x2) getsockopt$inet6_IPV6_IPSEC_POLICY(r4, 0x29, 0x22, &(0x7f00000048c0)={{{@in6=@remote, @in6=@ipv4={[], [], @remote}}}, {{@in6=@remote}}}, &(0x7f00000049c0)=0xe8) unshare(0x60000000) r6 = socket$inet_tcp(0x2, 0x1, 0x0) recvmmsg(r6, &(0x7f0000000f00), 0x0, 0x0, &(0x7f0000001080)) recvfrom$inet(r3, &(0x7f0000000240)=""/35, 0x23, 0x40000000, &(0x7f0000000280)={0x2, 0x4e21, @multicast1}, 0x10) ioctl$LOOP_SET_STATUS64(r4, 0x4c04, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x80, 0xfff, 0x0, 0xf, 0x2, 0x8, "251c88068803793a89c696b9749c73cb995353c3d8df03048e91658ab9906d6556920a3ff64f85cc4275b0a21dcc054cee7d8b61bf6764ff7da833d80fd136f0", "2475f3efa518d2bdc54a3d745ef09dbcebbdb0ff487c27d106851b485d6f8b49d650810fc7be598d6c32ef556c2df29752ba0ac37d82b36b9c926af00ae7e931", "b6f6c0116256f480baa70981af55ee587ffadfec56106feed668d83405f97d50", [0xf6a, 0x8]}) 03:37:38 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0}) 03:37:38 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x33, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000009c00000000ebffffff000000000000000000000000000000000000002eb986318f9c7edf35b2"], 0x0, 0x0, 0x0}) [ 541.995336] binder: 27300:27301 ioctl c018620b 0 returned -14 [ 542.015809] binder: undelivered TRANSACTION_COMPLETE [ 542.025846] binder: 27303:27304 ioctl c018620b 0 returned -14 [ 542.033661] binder: undelivered TRANSACTION_ERROR: 29201 03:37:38 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x37f, 0x0, &(0x7f0000000000)=ANY=[], 0x2f, 0x0, 0x0}) [ 542.064197] binder: 27300:27309 unknown command 536871488 [ 542.076478] binder: 27300:27309 ioctl c0306201 20000440 returned -22 [ 542.082104] binder_alloc: 3591: binder_alloc_buf size -8688741244528193736 failed, no address space 03:37:39 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="00aff91a6e036178c25aae87d78f3209e3cb05622423e0a89178429a6f27f188330ab1"]], 0x0, 0x0, 0x0}) [ 542.111332] binder_alloc: allocated: 10312 (num: 464 largest: 32), free: 1976 (num: 1 largest: 1976) [ 542.115314] binder: 27315:27316 unknown command 0 [ 542.126932] binder: 27315:27316 ioctl c0306201 20000040 returned -22 [ 542.137982] binder: 27306:27311 transaction failed 29201/-28, size -8738903024400859136-50161779872665393 line 3155 03:37:39 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x33, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000009c00000000ebffffff000000000000000000000000000000000000002eb986318f9c7edf35b2"], 0x0, 0x0, 0x0}) [ 542.167054] binder: undelivered TRANSACTION_ERROR: 29201 [ 542.186661] binder: 27319:27320 unknown command 536870912 [ 542.203687] binder: 27319:27320 ioctl c0306201 20000440 returned -22 03:37:39 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB='\x00\'']], 0x0, 0x0, 0x0}) [ 542.213615] binder_alloc: 3591: binder_alloc_buf size -8688741244528193736 failed, no address space [ 542.223899] binder: 27319:27320 unknown command 536870912 [ 542.229800] binder: 27319:27320 ioctl c0306201 20000440 returned -22 [ 542.235324] binder_alloc: allocated: 10312 (num: 464 largest: 32), free: 1976 (num: 1 largest: 1976) [ 542.256191] binder: 27321:27323 transaction failed 29201/-28, size -8738903024400859136-50161779872665393 line 3155 03:37:39 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x3c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000009c00000000ebffffff000000000000000000000000000000000000002eb986318f9c7edf35b2889de3000000000000"], 0x0, 0x0, 0x0}) [ 542.279875] binder: 27325:27326 unknown command 536872064 [ 542.289476] binder: undelivered TRANSACTION_ERROR: 29201 [ 542.306503] binder: 27325:27326 ioctl c0306201 20000440 returned -22 [ 542.367613] binder: 27328:27329 transaction failed 29201/-22, size -8738903024400859136--8596749504678686927 line 3155 [ 542.390984] binder: undelivered TRANSACTION_ERROR: 29201 03:37:39 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 03:37:39 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x2000000000001) lsetxattr$security_smack_transmute(0x0, &(0x7f00000001c0)='security.SMACK64TRANSMUTE\x00', 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000d12000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f00000000c0), 0x4924924924926fe, 0x0) connect$unix(r1, &(0x7f0000000200)=@abs, 0x6e) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) r3 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x141000, 0x0) ioctl$SNDRV_TIMER_IOCTL_TREAD(r3, 0x40045402, &(0x7f0000000080)) 03:37:39 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x34, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000009c00000000ebffffff000000000000000000000000000000000000002eb986318f9c7edf35b288"], 0x0, 0x0, 0x0}) [ 542.584799] binder: release 27276:27294 transaction 1577 out, still active [ 542.607037] binder: 27333:27335 transaction failed 29201/-22, size -8738903024400859136--8596749504678686927 line 3155 [ 542.618891] binder: 27334:27338 unknown command 536872064 [ 542.625616] binder: 27337:27339 ioctl c018620b 0 returned -14 [ 542.630296] binder: undelivered TRANSACTION_ERROR: 29201 [ 542.631746] binder: 27334:27338 ioctl c0306201 20000440 returned -22 [ 542.647724] binder: 27334:27340 unknown command 536872064 [ 542.658969] binder: 27334:27340 ioctl c0306201 20000440 returned -22 [ 542.690640] binder: 27337:27344 ioctl c0306201 0 returned -14 03:37:39 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, 0x0, 0x0) sched_rr_get_interval(0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') [ 542.787346] binder: 27300:27301 ioctl c0306201 20000140 returned -14 [ 542.807164] binder: 27345:27346 ioctl c018620b 0 returned -14 [ 542.815635] binder: 27303:27318 ioctl c018620b 0 returned -14 [ 542.859400] binder: 27345:27350 unknown command 536871488 [ 542.865137] binder: 27345:27350 ioctl c0306201 20000440 returned -22 03:37:39 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x0, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x48) socketpair(0x1, 0x80000, 0x7fffffff, &(0x7f0000000240)) r0 = socket$inet_udp(0x2, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x1000000000002, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f00000005c0)={0x80000000000000, 0x7}, 0x4) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000280)=0x32, 0x4) connect$inet(r0, &(0x7f0000000340)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) 03:37:39 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000009c00000000ebffffff000000000000000000000000000000000000002eb986"], 0x0, 0x0, 0x0}) 03:37:39 executing program 0: r0 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000000)='/dev/keychord\x00', 0x501000, 0x0) ioctl$BLKSECDISCARD(r0, 0x127d, &(0x7f0000000040)=0x1ff) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) 03:37:39 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_inet_SIOCGIFADDR(r1, 0x8915, &(0x7f00000000c0)={'ip6gre0\x00', {0x2, 0x4e23, @multicast2}}) [ 543.096078] binder: 27354:27358 unknown command 536872064 [ 543.098243] binder: 27356:27359 ioctl c018620b 0 returned -14 [ 543.103830] binder_alloc: 3591: binder_alloc_buf size -8738903024400859136 failed, no address space [ 543.120985] binder: 27354:27358 ioctl c0306201 20000440 returned -22 [ 543.127838] binder_alloc: allocated: 10344 (num: 465 largest: 32), free: 1944 (num: 1 largest: 1944) 03:37:40 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = dup2(r0, r0) ioctl$sock_SIOCBRDELBR(r1, 0x89a1, &(0x7f0000000000)='veth1_to_hsr\x00') ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) [ 543.137799] binder: 27353:27360 transaction failed 29201/-28, size -8738903024400859136-0 line 3155 03:37:40 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000009c00000000ebffffff000000000000000000000000000000000000002eb986"], 0x0, 0x0, 0x0}) [ 543.170185] binder: undelivered TRANSACTION_ERROR: 29201 [ 543.183889] binder: 27364:27366 ioctl 89a1 20000000 returned -22 [ 543.197739] binder: 27364:27366 unknown command 536872064 [ 543.203472] binder: 27356:27359 ioctl c018620b 0 returned -14 03:37:40 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000000000725602a057000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) [ 543.217133] binder: release 27356:27359 transaction 1590 out, still active [ 543.221064] binder: 27364:27366 ioctl c0306201 20000440 returned -22 [ 543.230955] binder: undelivered TRANSACTION_COMPLETE [ 543.230997] binder: release 27356:27359 transaction 1589 out, still active [ 543.231003] binder: undelivered TRANSACTION_COMPLETE [ 543.267419] binder_alloc: 3591: binder_alloc_buf size -8738903024400859136 failed, no address space [ 543.287616] binder_alloc: allocated: 10360 (num: 467 largest: 32), free: 1928 (num: 1 largest: 1928) [ 543.297163] binder: 27368:27372 transaction failed 29201/-28, size -8738903024400859136-0 line 3155 [ 543.302865] binder: 27374:27375 ioctl c018620b 0 returned -14 [ 543.307706] binder: 27364:27376 ioctl 89a1 20000000 returned -22 03:37:40 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2c, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000009c00000000ebffffff000000000000000000000000000000000000002eb986"], 0x0, 0x0, 0x0}) [ 543.319190] binder: 27364:27366 unknown command 536872064 [ 543.326080] binder: 27364:27366 ioctl c0306201 20000440 returned -22 [ 543.330854] binder: 27374:27375 ioctl c018620b 0 returned -14 [ 543.333292] binder: release 27374:27375 transaction 1592 out, still active [ 543.369335] binder: undelivered TRANSACTION_COMPLETE [ 543.391990] binder: undelivered TRANSACTION_ERROR: 29201 [ 543.409995] binder_alloc: 3591: binder_alloc_buf size -8738903024400859136 failed, no address space [ 543.425972] binder: release 27337:27344 transaction 1585 out, still active 03:37:40 executing program 2: r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x80002, 0x0) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000080)={&(0x7f0000000040)='./file0\x00', 0x0, 0x8}, 0x10) ioctl$TCSETA(r0, 0x5406, &(0x7f00000000c0)={0x0, 0x0, 0xffff, 0x6, 0x4, 0x6, 0x27, 0x200, 0x0, 0x101}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0047404000000000000000000000000000842440e6750d008600000000000000000000000000e6ffffffffffffff00000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) 03:37:40 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 03:37:40 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="0097472e230000000000"]], 0x0, 0x0, 0x0}) syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x802) [ 543.439483] binder_alloc: allocated: 10368 (num: 468 largest: 32), free: 1920 (num: 1 largest: 1920) [ 543.475655] binder: 27379:27382 transaction failed 29201/-28, size -8738903024400859136-0 line 3155 [ 543.485877] binder: 27385:27387 unknown command 536870912 [ 543.491160] binder: 27386:27389 ioctl c018620b 0 returned -14 [ 543.493556] binder: undelivered TRANSACTION_ERROR: 29201 [ 543.501223] binder: 27383:27388 ioctl c018620b 0 returned -14 [ 543.511934] binder: 27385:27387 ioctl c0306201 20000440 returned -22 [ 543.512376] binder: 27383:27388 unknown command 1077954304 [ 543.534428] binder: 27385:27387 unknown command 536870912 [ 543.534918] binder: 27383:27388 ioctl c0306201 20000440 returned -22 [ 543.544681] binder: 27385:27387 ioctl c0306201 20000440 returned -22 [ 543.569010] binder: 27383:27388 ioctl c018620b 0 returned -14 03:37:40 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040), 0x4) sched_rr_get_interval(0x0, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') [ 543.607319] binder: 27345:27346 ioctl c0306201 20000140 returned -14 03:37:40 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x0, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x48) socketpair(0x1, 0x80000, 0x7fffffff, &(0x7f0000000240)) r0 = socket$inet_udp(0x2, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x1000000000002, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f00000005c0)={0x80000000000000, 0x7}, 0x4) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000280)=0x32, 0x4) connect$inet(r0, &(0x7f0000000340)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) 03:37:40 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x30, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000009c00000000ebffffff000000000000000000000000000000000000002eb986318f9c7e"], 0x0, 0x0, 0x0}) 03:37:40 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x17, 0x0, &(0x7f0000000100)=ANY=[@ANYRESOCT], 0x0, 0x0, 0x0}) 03:37:40 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340400000000080000000000240000c0000000245f26e980600000000000000000000000000000000000000005d250052d6d8cd2b430d47512b70373ab30000000000000000000000000000110000000000"], 0x0, 0x0, 0x0}) [ 543.663543] binder: 27397:27399 ioctl c018620b 0 returned -14 [ 543.729494] binder: 27397:27405 unknown command 536871488 [ 543.733566] binder: 27402:27407 unknown command 926363952 [ 543.741328] binder: 27404:27408 ioctl c018620b 0 returned -14 [ 543.742387] binder_alloc: 3591: binder_alloc_buf size -8738903022276669640 failed, no address space [ 543.756150] binder: 27402:27407 ioctl c0306201 20000440 returned -22 [ 543.761671] binder: 27397:27405 ioctl c0306201 20000440 returned -22 03:37:40 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x30, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000009c00000000ebffffff000000000000000000000000000000000000002eb986318f9c7e"], 0x0, 0x0, 0x0}) [ 543.770639] binder_alloc: allocated: 10400 (num: 469 largest: 32), free: 1888 (num: 1 largest: 1888) [ 543.780587] binder: 27401:27406 transaction failed 29201/-28, size -8738903024400859136-2124189489 line 3155 [ 543.780870] binder_alloc: 3591: binder_alloc_buf size -2821977955920707584 failed, no address space [ 543.801437] binder: 27402:27407 unknown command 926363952 [ 543.802095] binder: undelivered TRANSACTION_ERROR: 29201 [ 543.814078] binder: 27402:27407 ioctl c0306201 20000440 returned -22 03:37:40 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x800) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) [ 543.837093] binder_alloc: allocated: 10400 (num: 469 largest: 32), free: 1888 (num: 1 largest: 1888) [ 543.853580] binder_alloc: 3591: binder_alloc_buf size -8738903022276669640 failed, no address space [ 543.874350] binder: 27404:27408 transaction failed 29201/-28, size 0--2821977955920707584 line 3155 [ 543.883943] binder: 27415:27417 unknown command 536872064 [ 543.884045] binder_alloc: allocated: 10400 (num: 469 largest: 32), free: 1888 (num: 1 largest: 1888) [ 543.908320] binder: 27415:27417 ioctl c0306201 20000440 returned -22 [ 543.913232] binder: 27412:27414 transaction failed 29201/-28, size -8738903024400859136-2124189489 line 3155 [ 543.925876] binder: 27404:27408 ioctl c018620b 0 returned -14 03:37:40 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) lseek(r0, 0x0, 0x1) 03:37:40 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x30, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000009c00000000ebffffff000000000000000000000000000000000000002eb986318f9c7e"], 0x0, 0x0, 0x0}) [ 543.932798] binder: undelivered TRANSACTION_ERROR: 29201 [ 543.937804] binder: 27415:27419 unknown command 536872064 [ 543.949822] binder: 27415:27419 ioctl c0306201 20000440 returned -22 [ 543.968434] binder: undelivered TRANSACTION_ERROR: 29201 03:37:40 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="00af"]], 0x0, 0x0, 0x0}) [ 544.007406] binder: 27421:27422 ioctl c018620b 0 returned -14 [ 544.023318] binder_alloc: 3591: binder_alloc_buf size -8738903022276669640 failed, no address space [ 544.058530] binder_alloc: allocated: 10400 (num: 469 largest: 32), free: 1888 (num: 1 largest: 1888) [ 544.058932] binder: 27426:27428 unknown command 536872064 [ 544.079223] binder: 27426:27428 ioctl c0306201 20000440 returned -22 [ 544.088211] binder: 27423:27425 transaction failed 29201/-28, size -8738903024400859136-2124189489 line 3155 [ 544.089760] binder: 27421:27422 ioctl c018620b 0 returned -14 [ 544.102434] binder: release 27421:27422 transaction 1601 out, still active [ 544.115067] binder: undelivered TRANSACTION_COMPLETE [ 544.132332] binder: release 27421:27429 transaction 1602 out, still active [ 544.147293] binder: undelivered TRANSACTION_COMPLETE [ 544.169496] binder: undelivered TRANSACTION_ERROR: 29201 03:37:41 executing program 0: socket$inet(0x10, 0x0, 0x0) ioctl$VT_WAITACTIVE(0xffffffffffffffff, 0x5607) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x82) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) r2 = memfd_create(&(0x7f0000000100)='t\bnu\x00\x00\x00\x00\x85nG\x13g\xa6\x05', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) sendfile(r1, r1, 0x0, 0x20002000005) ioctl$LOOP_CLR_FD(r1, 0x4c01) socketpair$unix(0x1, 0x0, 0x0, 0x0) openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(0xffffffffffffffff, 0xc0145401, 0x0) ioctl$PERF_EVENT_IOC_REFRESH(r0, 0x2402, 0x6946) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(0xffffffffffffffff, 0x2405, 0xffffffffffffffff) write(0xffffffffffffffff, &(0x7f00000001c0), 0x7ba27d3a) 03:37:41 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 544.281569] binder: release 27386:27391 transaction 1594 out, still active [ 544.336842] binder: 27437:27440 ioctl c018620b 0 returned -14 03:37:41 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040), 0x4) sched_rr_get_interval(0x0, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') 03:37:41 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) r1 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$EVIOCGPROP(r1, 0x80404509, &(0x7f0000000040)=""/60) ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000080)={{0x3, 0x5, 0x0, 0x3}, 'syz0\x00', 0x2f}) 03:37:41 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x32, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000009c00000000ebffffff000000000000000000000000000000000000002eb986318f9c7edf35"], 0x0, 0x0, 0x0}) 03:37:41 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x0, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x48) socketpair(0x1, 0x80000, 0x7fffffff, &(0x7f0000000240)) r0 = socket$inet_udp(0x2, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x1000000000002, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f00000005c0)={0x80000000000000, 0x7}, 0x4) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000280)=0x32, 0x4) connect$inet(r0, &(0x7f0000000340)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) [ 544.450179] binder: 27397:27399 ioctl c0306201 20000140 returned -14 [ 544.491216] binder: 27445:27449 ioctl c018620b 0 returned -14 [ 544.497659] binder_alloc: 3591: binder_alloc_buf size -8738843790382690504 failed, no address space [ 544.502627] binder: 27445:27449 ioctl c0306201 0 returned -14 [ 544.531797] binder: 27445:27449 ioctl c018620b 0 returned -14 [ 544.534630] binder: 27445:27453 ioctl c0306201 0 returned -14 [ 544.549336] binder_alloc: allocated: 10448 (num: 472 largest: 32), free: 1840 (num: 1 largest: 1840) 03:37:41 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) r1 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/checkreqprot\x00', 0x400, 0x0) write$P9_RLOPEN(r1, &(0x7f0000000040)={0x18, 0xd, 0x1, {{0x3c, 0x3, 0x4}, 0x7}}, 0x18) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) prctl$PR_GET_PDEATHSIG(0x2, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:37:41 executing program 0: creat(&(0x7f00000000c0)='./file0\x00', 0x0) r0 = open(&(0x7f0000000080)='.\x00', 0x0, 0x0) linkat(r0, &(0x7f0000000280)='./file0\x00', r0, &(0x7f0000000000)='./file1\x00', 0x400) [ 544.580431] binder: 27452:27458 ioctl c018620b 0 returned -14 [ 544.593497] binder: 27447:27448 transaction failed 29201/-28, size -8738903024400859136-59234018168625 line 3155 03:37:41 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x32, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000009c00000000ebffffff000000000000000000000000000000000000002eb986318f9c7edf35"], 0x0, 0x0, 0x0}) [ 544.649402] binder: 27463:27464 ioctl c018620b 0 returned -14 [ 544.663262] binder: undelivered TRANSACTION_ERROR: 29201 [ 544.669179] binder: 27452:27466 unknown command 536871488 [ 544.681926] binder: 27463:27464 ioctl c018620b 0 returned -14 [ 544.693290] binder: 27452:27466 ioctl c0306201 20000440 returned -22 03:37:41 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f00000000c0)={0x5, 0x8, 0x400000100000011, 0x8}, 0x2c) r0 = bpf$MAP_CREATE(0x2, &(0x7f0000000040)={0x3, 0x0, 0x77effb, 0x0, 0x820005, 0x0}, 0x2c) bpf$MAP_CREATE(0x2, &(0x7f0000000000)={0x2000000003, 0x0, 0x713000, 0x0, 0x20000820000, r0, 0x1}, 0x2c) [ 544.701375] binder: release 27463:27464 transaction 1607 out, still active [ 544.708734] binder: undelivered TRANSACTION_COMPLETE [ 544.737244] binder_alloc: 3591: binder_alloc_buf size -8738843790382690504 failed, no address space 03:37:41 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000bbfc00000040000000000000000000000000000000000000000000000000000020cf2f176edea2"], 0x0, 0x0, 0x0}) [ 544.741387] binder: release 27463:27470 transaction 1608 out, still active 03:37:41 executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x1, 0x7, 0x7f, 0x6}, 0x2c) bpf$MAP_LOOKUP_ELEM(0x4, &(0x7f0000000080)={r0, &(0x7f0000000000), 0x0}, 0x18) [ 544.789166] binder: undelivered TRANSACTION_COMPLETE [ 544.789858] binder_alloc: allocated: 10464 (num: 474 largest: 32), free: 1824 (num: 1 largest: 1824) [ 544.803003] binder: 27478:27480 ioctl c018620b 0 returned -14 [ 544.822605] binder: 27471:27474 transaction failed 29201/-28, size -8738903024400859136-59234018168625 line 3155 [ 544.829342] binder: 27478:27480 ioctl c018620b 0 returned -14 03:37:41 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x32, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000009c00000000ebffffff000000000000000000000000000000000000002eb986318f9c7edf35"], 0x0, 0x0, 0x0}) [ 544.848596] binder: release 27478:27480 transaction 1610 out, still active [ 544.861189] binder: undelivered TRANSACTION_COMPLETE [ 544.899656] binder: undelivered TRANSACTION_ERROR: 29201 [ 544.930734] binder_alloc: 3591: binder_alloc_buf size -8738843790382690504 failed, no address space [ 544.945010] binder_alloc: allocated: 10472 (num: 475 largest: 32), free: 1816 (num: 1 largest: 1816) [ 544.955150] binder: 27487:27489 transaction failed 29201/-28, size -8738903024400859136-59234018168625 line 3155 [ 544.975544] binder: undelivered TRANSACTION_ERROR: 29201 03:37:42 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 545.140539] binder: release 27437:27442 transaction 1603 out, still active [ 545.164482] binder: 27494:27495 ioctl c018620b 0 returned -14 03:37:42 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040), 0x4) sched_rr_get_interval(0x0, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') 03:37:42 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 03:37:42 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000000)) 03:37:42 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x33, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000009c00000000ebffffff000000000000000000000000000000000000002eb986318f9c7edf35b2"], 0x0, 0x0, 0x0}) 03:37:42 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x0, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x48) socketpair(0x1, 0x80000, 0x7fffffff, &(0x7f0000000240)) r0 = socket$inet_udp(0x2, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f00000005c0)={0x80000000000000, 0x7}, 0x4) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000280)=0x32, 0x4) connect$inet(r0, &(0x7f0000000340)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) [ 545.372479] binder: 27452:27458 ioctl c0306201 20000140 returned -14 [ 545.392978] binder: 27497:27499 ioctl c018620b 0 returned -14 [ 545.410882] binder: 27497:27499 ioctl c0306201 0 returned -14 03:37:42 executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x2, 0x4, 0x7f, 0x20000000000001, 0x0, 0x1}, 0x2c) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000080)={r0, &(0x7f00000000c0)="e0", 0x0}, 0x18) [ 545.417753] binder: 27497:27499 ioctl c018620b 0 returned -14 [ 545.424420] binder: 27497:27503 ioctl c0306201 0 returned -14 [ 545.439424] binder_alloc: 3591: binder_alloc_buf size -8688741244528193736 failed, no address space [ 545.449825] binder: release 27497:27499 transaction 1615 out, still active [ 545.463529] binder: 27505:27508 ioctl c018620b 0 returned -14 03:37:42 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x0, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x48) socketpair(0x1, 0x80000, 0x7fffffff, &(0x7f0000000240)) r0 = socket$inet_udp(0x2, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f00000005c0)={0x80000000000000, 0x7}, 0x4) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000280)=0x32, 0x4) connect$inet(r0, &(0x7f0000000340)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) 03:37:42 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f00000016c0)={0x2, 0x4e22, @multicast1}, 0x10) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$TUNSETSNDBUF(r2, 0x400454d4, &(0x7f0000000040)=0x2) [ 545.468896] binder: undelivered TRANSACTION_COMPLETE [ 545.488658] binder_alloc: allocated: 10512 (num: 477 largest: 32), free: 1776 (num: 1 largest: 1776) 03:37:42 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) 03:37:42 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x33, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000009c00000000ebffffff000000000000000000000000000000000000002eb986318f9c7edf35b2"], 0x0, 0x0, 0x0}) [ 545.515015] binder: 27498:27506 transaction failed 29201/-28, size -8738903024400859136-50161779872665393 line 3155 [ 545.527321] binder: 27515:27517 ioctl c018620b 0 returned -14 [ 545.532486] binder: 27505:27519 unknown command 536871488 [ 545.536179] binder: 27515:27517 ioctl c018620b 0 returned -14 [ 545.541365] binder: undelivered TRANSACTION_ERROR: 29201 [ 545.551751] binder: 27505:27519 ioctl c0306201 20000440 returned -22 [ 545.552590] binder: release 27515:27517 transaction 1617 out, still active 03:37:42 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000000000004ad6cc87b3ffd8ea8bc24fa00000000000000000000000000000000000000000000000000000000009c5ac346066ff96e343f153a317201c23b21db6822d0544d481ede7ac7ded434c70a118f4be3754bab2213b29ad4e90ab8b74f147090b2c210c0499022f418c19e4e6079a3b9e945912411a69fbd"], 0x0, 0x0, 0x0}) lseek(r0, 0x0, 0x5) [ 545.590156] binder: undelivered TRANSACTION_COMPLETE [ 545.607237] binder: release 27515:27520 transaction 1618 out, still active [ 545.626901] binder: BINDER_SET_CONTEXT_MGR already set [ 545.632900] binder: undelivered TRANSACTION_COMPLETE [ 545.641700] binder: 27530:27533 ioctl c018620b 0 returned -14 [ 545.649138] binder: 27524:27528 ioctl 40046207 0 returned -16 [ 545.651929] binder_alloc: 3591: binder_alloc_buf size -8688741244528193736 failed, no address space [ 545.664812] binder_alloc: allocated: 10528 (num: 479 largest: 32), free: 1760 (num: 1 largest: 1760) [ 545.674325] binder: 27527:27532 transaction failed 29201/-28, size -8738903024400859136-50161779872665393 line 3155 [ 545.675196] binder_alloc: 3591: binder_alloc_buf size 8989907689237577024 failed, no address space [ 545.688458] binder: undelivered TRANSACTION_ERROR: 29201 [ 545.696099] binder_alloc: allocated: 10536 (num: 480 largest: 32), free: 1752 (num: 1 largest: 1752) [ 545.700603] binder: BINDER_SET_CONTEXT_MGR already set [ 545.710267] binder: 27530:27533 transaction failed 29201/-28, size 8919498552359518208-70409136878058815 line 3155 [ 545.723695] binder: 27524:27534 ioctl 40046207 0 returned -16 [ 545.732429] binder: release 27524:27528 transaction 1622 out, still active [ 545.737486] binder_alloc: 3591: binder_alloc_buf size 8989907689237577024 failed, no address space [ 545.742114] binder: undelivered TRANSACTION_COMPLETE [ 545.749028] binder: 27530:27533 ioctl c018620b 0 returned -14 [ 545.761430] binder_alloc: allocated: 10544 (num: 481 largest: 32), free: 1744 (num: 1 largest: 1744) [ 545.767439] binder: undelivered TRANSACTION_ERROR: 29201 [ 545.776831] binder: release 27524:27528 transaction 1620 out, still active [ 545.784079] binder: 27530:27535 transaction failed 29201/-28, size 8919498552359518208-70409136878058815 line 3155 [ 545.784451] binder: undelivered TRANSACTION_COMPLETE [ 545.803974] binder: undelivered TRANSACTION_ERROR: 29201 03:37:42 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000680), 0x0, 0x0, 0x0}) [ 545.977612] binder: release 27494:27496 transaction 1612 out, still active [ 546.002201] binder: 27541:27542 ioctl c018620b 0 returned -14 03:37:43 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040), 0x4) sched_rr_get_interval(0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$tipc2(0x0) 03:37:43 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x0, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x48) socketpair(0x1, 0x80000, 0x7fffffff, &(0x7f0000000240)) r0 = socket$inet_udp(0x2, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f00000005c0)={0x80000000000000, 0x7}, 0x4) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000280)=0x32, 0x4) connect$inet(r0, &(0x7f0000000340)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) 03:37:43 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x33, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000009c00000000ebffffff000000000000000000000000000000000000002eb986318f9c7edf35b2"], 0x0, 0x0, 0x0}) 03:37:43 executing program 0: 03:37:43 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) getrlimit(0x6, &(0x7f0000000040)) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) syz_genetlink_get_family_id$SEG6(&(0x7f0000000000)='SEG6\x00') ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) fchmod(r0, 0x36) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0xffffffffffffff8f, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 546.236189] binder: 27505:27508 ioctl c0306201 20000140 returned -14 [ 546.271104] binder: 27544:27548 ioctl c018620b 0 returned -14 03:37:43 executing program 0: 03:37:43 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) r1 = dup(r0) ioctl$EVIOCREVOKE(r1, 0x40044591, &(0x7f0000000000)=0x1) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e1ffffff000000000000000000000000000000"], 0x0, 0x0, 0x0}) [ 546.279131] binder_alloc: 3591: binder_alloc_buf size -8688741244528193736 failed, no address space [ 546.290167] binder: 27550:27553 ioctl c018620b 0 returned -14 [ 546.296481] binder: 27544:27548 ioctl c018620b 0 returned -14 [ 546.303342] binder_alloc: allocated: 10576 (num: 482 largest: 32), free: 1712 (num: 1 largest: 1712) 03:37:43 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x0, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x48) socketpair(0x1, 0x80000, 0x7fffffff, &(0x7f0000000240)) r0 = socket$inet_udp(0x2, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f00000005c0)={0x80000000000000, 0x7}, 0x4) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000280)=0x32, 0x4) connect$inet(r0, &(0x7f0000000340)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) 03:37:43 executing program 0: [ 546.326413] binder: 27546:27551 transaction failed 29201/-28, size -8738903024400859136-50161779872665393 line 3155 [ 546.348898] binder: 27559:27560 ioctl c018620b 0 returned -14 [ 546.361205] binder: 27550:27562 unknown command 536871488 [ 546.374490] binder: 27559:27560 ioctl 40044591 20000000 returned -22 03:37:43 executing program 5: [ 546.385433] binder: undelivered TRANSACTION_ERROR: 29201 [ 546.395739] binder: 27550:27562 ioctl c0306201 20000440 returned -22 [ 546.406541] binder_alloc: 3591: binder_alloc_buf size -34084860461056 failed, no address space 03:37:43 executing program 0: [ 546.434898] binder_alloc: allocated: 10576 (num: 482 largest: 32), free: 1712 (num: 1 largest: 1712) [ 546.471251] binder: 27559:27560 transaction failed 29201/-28, size 0--34084860461056 line 3155 [ 546.496248] binder: 27559:27560 ioctl c018620b 0 returned -14 [ 546.508855] binder: 27559:27573 ioctl 40044591 20000000 returned -22 [ 546.519907] binder: undelivered TRANSACTION_ERROR: 29201 03:37:43 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000680), 0x0, 0x0, 0x0}) [ 546.810132] binder: release 27541:27543 transaction 1624 out, still active [ 546.840851] binder: 27579:27580 ioctl c018620b 0 returned -14 03:37:43 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040), 0x4) sched_rr_get_interval(0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$tipc2(0x0) 03:37:43 executing program 5: 03:37:43 executing program 0: r0 = socket$packet(0x11, 0x2, 0x300) sendmmsg(r0, &(0x7f000000c300)=[{{&(0x7f00000000c0)=@nfc={0x27, 0x1}, 0x80, &(0x7f0000000840), 0x0, &(0x7f0000000900), 0x2}}, {{0x0, 0x0, &(0x7f0000001dc0), 0x129, &(0x7f0000002180)}}], 0x4000000000000ea, 0x0) 03:37:43 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 03:37:43 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x0, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x48) socketpair(0x1, 0x80000, 0x7fffffff, &(0x7f0000000240)) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f00000005c0)={0x80000000000000, 0x7}, 0x4) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000280)=0x32, 0x4) connect$inet(r0, &(0x7f0000000340)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) [ 547.088550] binder: 27550:27553 ioctl c0306201 20000140 returned -14 03:37:44 executing program 5: r0 = socket$packet(0x11, 0x3, 0x300) socket$inet_udplite(0x2, 0x2, 0x88) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="00ac33ff20ffff020002"], 0x1}}, 0x0) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_inet6_SIOCADDRT(r2, 0x890b, &(0x7f0000001f80)={@mcast2, @local, @mcast2, 0x10000, 0x1000000000000000, 0x80000003, 0x100, 0xd908, 0x7ffffffe}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) r4 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFBRDADDR(r3, 0x891a, &(0x7f0000000640)={'lo\x00', {0x2, 0x4e24, @remote}}) ioctl$sock_inet_SIOCADDRT(r4, 0x890b, &(0x7f00000001c0)={0xffffffffffff7fff, {0x2, 0x4e24, @local}, {0x2, 0x4e23}, {0x2, 0x4e23, @local}, 0x4, 0x1000, 0x3, 0x4, 0x7, &(0x7f00000006c0)='bridge_slave_1\x00', 0x9, 0x5, 0x1}) getsockopt$inet_tcp_int(r3, 0x6, 0x17, &(0x7f0000000080), &(0x7f0000000380)=0x4) sendfile(r0, r3, &(0x7f00000004c0)=0x10002, 0x4) ioctl$sock_inet_SIOCADDRT(r4, 0x890b, &(0x7f0000000100)={0x2, {0x2, 0x4e20, @dev}, {0x2, 0x4e24}, {0x2, 0x4e20, @rand_addr=0x5ae}, 0xb4, 0x1000, 0x4, 0x7fff, 0x0, &(0x7f00000000c0)='veth1_to_team\x00', 0x100000001, 0x0, 0x8009}) getsockopt$inet_buf(r4, 0x0, 0x200000000000040, &(0x7f0000000040)=""/30, &(0x7f0000000340)=0x1e) pipe(&(0x7f0000000800)={0xffffffffffffffff, 0xffffffffffffffff}) getpeername$packet(r5, &(0x7f0000000840)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000001c00)=0x14) recvmsg(r3, &(0x7f0000001e80)={&(0x7f0000000740)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, 0x80, &(0x7f0000001d40)=[{&(0x7f00000007c0)=""/49, 0x2d6}, {&(0x7f0000002040)=""/29, 0x1e}, {&(0x7f0000000900)=""/229, 0xe5}, {&(0x7f0000000a00)=""/204, 0xcc}, {&(0x7f0000000b00)=""/160, 0xa0}, {&(0x7f0000000bc0)=""/55, 0x37}, {&(0x7f0000000c00)=""/4096, 0x1000}, {&(0x7f0000002000)=""/22, 0x16}, {&(0x7f0000001c40)=""/218, 0x50}], 0x9, &(0x7f0000001e00)=""/106, 0x6a, 0x40000080}, 0x40) ioctl$sock_inet_SIOCGIFDSTADDR(r4, 0x8917, &(0x7f0000000700)={'nr0\x00', {0x2, 0x4e20}}) r6 = accept4(r3, &(0x7f0000000400)=@in6, &(0x7f0000000480)=0x80, 0x80800) setsockopt$inet6_mreq(r6, 0x29, 0x13, &(0x7f00000020c0)={@dev={0xfe, 0x80, [], 0xd}}, 0x14) setsockopt$inet_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f0000001ec0)='tls\x00', 0xfffffffffffffeb1) r7 = socket$inet6(0xa, 0x1000000000002, 0x0) connect(r2, &(0x7f0000002100)=@un=@file={0x1, './file0\x00'}, 0x1000002ea) ioctl(r3, 0x8912, &(0x7f0000000280)="0a4cc80700315f85714070") write(r7, &(0x7f0000000240)="42394b70c34a9923f656916f559bb3b1bcf8acd90237f4829e17990a", 0x1c) r8 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$IP_VS_SO_GET_VERSION(r6, 0x0, 0x480, &(0x7f00000003c0), &(0x7f00000005c0)=0x40) connect$inet6(r7, &(0x7f0000000300)={0xa, 0x4e20, 0x1000, @loopback, 0x3}, 0x1c) setsockopt$inet6_tcp_TLS_TX(r5, 0x11a, 0x1, &(0x7f0000000680), 0x5e) read(r8, &(0x7f00000002c0)=""/4, 0xf0) 03:37:44 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = getpgrp(0x0) prctl$PR_SET_PTRACER(0x59616d61, r1) clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x2f) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="0d2fc73cda1fad73400000000000000061f97404ca3d6bec5defac893ee06507541656997ce23bbdb6b960f174ff07cf4ae575ae10c738acbb"], 0x39) ptrace$cont(0x18, r2, 0x0, 0x0) ptrace$setregs(0xd, r2, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r2, 0x0, 0x0) 03:37:44 executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="28000000120001000000000000000000fe8000000000000000000000000000aa000000000a00ff00130a10af863fe76fbc170f3f1d7a9c21be893f1c69471dd7b89c92bb36866b15e901f011d4b439449075fdbc9a6ec8bb92601505939d92756d382681643beb49c7a09910b11abb8803a96843a63500ac312a3c49f2bcde366ac571130f9c1009a33a5aa5eeff80850dc1ff1f1bae0a52f9200c6d923d7de21730eb6d112b60ec35afea73e982568a5908b017e50f895c55f9f5cb78765ad8ab6b5153e144de7235884a4edf480ee4d57b9c914ebaa7cd40128bb1fb70cdeccd6251f5452c8f63aee7b223c860dae2cfe1a93aa038f88a6576ad75450d4d90dba9881094c727e0f04d0670ae6e636f0369474eab6e6da9d5adf062cebc133356cca7aa67c48fc1e612b6a74a029e65a3ee0d88c90e77a6cf64eaa640eeae635b9d8e82d96ef3da26c95f9e8908"], 0x1}, 0x1, 0x0, 0x0, 0x3}, 0x0) 03:37:44 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_emit_ethernet(0x3a, &(0x7f0000000000)={@local, @local, [{}], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x0, 0x0, @dev, @remote={0xac, 0x14, 0x223}}, @icmp=@timestamp_reply}}}}, 0x0) [ 547.137994] binder: 27584:27590 ioctl c018620b 0 returned -14 [ 547.144942] binder: 27588:27591 ioctl c018620b 0 returned -14 [ 547.161016] binder: 27584:27590 ioctl c018620b 0 returned -14 03:37:44 executing program 2: socket$inet(0x10, 0x0, 0x0) ioctl$VT_WAITACTIVE(0xffffffffffffffff, 0x5607) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x82) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) r1 = memfd_create(&(0x7f0000000100)='t\bnu\x00\x00\x00\x00\x85nG\x13g\xa6\x05', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000040)}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) ioctl$LOOP_CLR_FD(r0, 0x4c01) socketpair$unix(0x1, 0x0, 0x0, 0x0) openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(0xffffffffffffffff, 0xc0145401, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_REFRESH(0xffffffffffffffff, 0x2402, 0x6946) write(0xffffffffffffffff, &(0x7f00000001c0), 0x7ba27d3a) [ 547.212414] binder: 27588:27603 unknown command 536871488 [ 547.238063] binder: 27588:27603 ioctl c0306201 20000440 returned -22 03:37:44 executing program 0: r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/dev_mcast\x00') sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000000540)}, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) 03:37:44 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000000)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000680), 0x0, 0x0, 0x0}) [ 547.636151] binder: release 27579:27582 transaction 1629 out, still active [ 547.655227] binder: 27635:27637 ioctl c018620b 0 returned -14 03:37:44 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000040), 0x4) sched_rr_get_interval(0x0, &(0x7f0000000080)) syz_genetlink_get_family_id$tipc2(0x0) 03:37:44 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x0, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x48) socketpair(0x1, 0x80000, 0x7fffffff, &(0x7f0000000240)) bind$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f00000005c0)={0x80000000000000, 0x7}, 0x4) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000280)=0x32, 0x4) connect$inet(0xffffffffffffffff, &(0x7f0000000340)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(0xffffffffffffffff, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) 03:37:44 executing program 5: r0 = bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x12, 0x3, &(0x7f0000000000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0x57}}, &(0x7f0000000080)='M\x14%\x87Wo\xdb\xd4\xe5\x8c\xbe\xa3A\x7f\xa2[Z\xf2\xa4\nf07\xc3Ju-\x01\xc2W\x88\x86\xe1=\x85-\xf6\xd3\xf2a|\xa6\x1f\x97\xbe?8\xec\x93\a[\x03\x00\x00\x00\x00\x00\x00\x00\x8a\xc40\x83\xd5\b\x1d\xc7o\xbb\xec\x87\xdf\xd4\x9c\xa7s\xbf\xfd\xdc\xc9\xffI\x82r\x90\x05\xb5\a\xec`VY\x94}\xbfMF\x84xR+\xb9ZmFW\xe39+s\xa16\xff\xb5 \xa4d\x1bm=\xa2\xa1`\"\xaf\xe4\x9b\xd8\xcb\xb3\x82D\xc2\xa4>\xda\t\x00\x00\x00\x00\x00\x00\x7f\xd0/LS\xdf\xd4\xc7\x91S\xb7\x1f\f\xbe\xde\xccz\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0x1, 0x99, &(0x7f0000000180)=""/153, 0x0, 0x0, [], 0x0, 0x8}, 0x48) bpf$BPF_GET_MAP_INFO(0xa, &(0x7f0000000280)={r0, 0x0, 0x0}, 0x10) 03:37:44 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'veth1_to_bridge\x00', 0x0}) ioctl$sock_inet6_SIOCADDRT(r1, 0x890b, &(0x7f00000002c0)={@local, @loopback, @rand_addr="fe3e59b0b053503d84c7647cca06b71f", 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x4000ce, r2}) 03:37:44 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_inet_SIOCADDRT(r0, 0x890b, &(0x7f0000000080)={0x0, {0x2, 0x0, @multicast1}, {0x2, 0x0, @dev}, {0x2, 0x0, @remote}, 0x44}) [ 547.935974] binder: 27588:27591 ioctl c0306201 20000140 returned -14 03:37:44 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000200)="230000002c0007031dfffd946f61050081000000017fffffff000000421ba3a20400ff7e280000001100ffffba16a0aa1c0900000000000012000000000000eff24d8238cfa47e23f7efbf54", 0x4c}], 0x1}, 0x0) 03:37:44 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$nl_route(0x10, 0x3, 0x0) getsockname(r1, &(0x7f0000002000)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000540)=0x80) [ 547.989351] binder: 27644:27649 ioctl c018620b 0 returned -14 03:37:44 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x0, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x48) socketpair(0x1, 0x80000, 0x7fffffff, &(0x7f0000000240)) bind$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f00000005c0)={0x80000000000000, 0x7}, 0x4) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000280)=0x32, 0x4) connect$inet(0xffffffffffffffff, &(0x7f0000000340)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(0xffffffffffffffff, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) 03:37:44 executing program 0: r0 = perf_event_open$cgroup(0x0, 0xffffffffffffffff, 0x4, 0xffffffffffffffff, 0x3) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x3, 0x70, 0x9, 0x0, 0x3f, 0x7994, 0x0, 0x4e17, 0x0, 0x5, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x2ac, 0x0, 0x6968, 0x0, 0x0, 0x1000, 0x0, 0x8, 0x0, 0x8, 0x0, 0x3, 0x0, 0x0, 0x0, 0x3ff, 0x0, 0x9, 0x10000, 0x0, 0x0, 0x4, @perf_bp={0x0}, 0x0, 0x0, 0x10000000000}, 0x0, 0x2, r1, 0x2) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x1) ioctl$TUNSETFILTEREBPF(0xffffffffffffffff, 0x800454e1, &(0x7f0000000440)) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f00000002c0)='./cgroup.net/syz0\x00', 0x1ff) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r2, 0x40086602, 0x400007) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000500)={0xffffffffffffffff, 0x2, 0x1, 0x0, 0x0}, 0x20) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup(0xffffffffffffffff, 0x0, 0x1ff) ioctl$PERF_EVENT_IOC_DISABLE(r0, 0x2401, 0x9) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(0xffffffffffffffff) write$cgroup_subtree(r3, &(0x7f0000000000)=ANY=[], 0x20032600) [ 548.035277] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'. [ 548.049357] binder: 27644:27662 unknown command 536871488 03:37:44 executing program 2: r0 = socket$inet(0x2, 0x80001, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x0, @loopback}, 0x10) sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x0, @loopback}, 0x80, 0x0}, 0x0) 03:37:44 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000000022, &(0x7f00000001c0)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x1e, &(0x7f0000000000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000140)={0x2, 0x0, @local}, 0x10) sendmmsg(r0, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) [ 548.076662] binder: 27644:27662 ioctl c0306201 20000440 returned -22 03:37:45 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000011000)={0x1, 0x2, 0x6d, 0x20000000000001, 0x0, 0x0}, 0xbe) [ 548.456144] binder: release 27635:27638 transaction 1632 out, still active 03:37:45 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000180)='net/arp\x00') preadv(r0, &(0x7f0000000780)=[{&(0x7f0000000540)=""/117, 0x75}], 0x1, 0x0) 03:37:45 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x0, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x48) socketpair(0x1, 0x80000, 0x7fffffff, &(0x7f0000000240)) bind$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f00000005c0)={0x80000000000000, 0x7}, 0x4) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000280)=0x32, 0x4) connect$inet(0xffffffffffffffff, &(0x7f0000000340)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(0xffffffffffffffff, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) 03:37:45 executing program 1: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) recvmmsg(0xffffffffffffffff, &(0x7f0000003500)=[{{0x0, 0xfffffffffffffc6b, &(0x7f0000002580)=[{&(0x7f00000012c0)=""/115, 0x73}], 0x1}}], 0x1, 0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x27, &(0x7f0000000100)={@multicast2, @remote}, 0xc) r2 = syz_open_procfs(0x0, &(0x7f0000000280)='net/mcfilter\x00') preadv(r2, &(0x7f0000000480), 0x10000000000002a1, 0x0) 03:37:45 executing program 2: r0 = socket$netlink(0x10, 0x3, 0xf) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r0, 0x10e, 0x8, &(0x7f00000000c0)=0x7fffffff, 0x4) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x300000003}, 0xc) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/loop-control\x00', 0x0, 0x0) r2 = ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, r2) 03:37:45 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) rt_sigtimedwait(&(0x7f00005a1000), 0x0, 0x0, 0x8) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='task\x00') getdents(r1, &(0x7f0000000080)=""/103, 0x67) getdents(r1, &(0x7f0000000100)=""/181, 0x20) 03:37:45 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) fchdir(0xffffffffffffffff) r1 = creat(&(0x7f0000000340)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x4002) io_setup(0x103, &(0x7f0000000080)=0x0) ftruncate(r1, 0x48280) r3 = open(&(0x7f000000fffa)='./bus\x00', 0x141446, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x3, 0x11, r3, 0x0) io_submit(r2, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x377140be6b5ef4c7}]) flistxattr(0xffffffffffffffff, 0x0, 0x0) 03:37:45 executing program 5: socketpair$unix(0x1, 0x4000000000000002, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x8) sendmmsg$unix(r1, &(0x7f00000bd000), 0x523, 0x0) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x1c9c380}, {0x0, 0x1c9c380}}, 0x0) r2 = gettid() tkill(r2, 0x1000000000016) [ 548.783843] binder: 27644:27649 ioctl c0306201 20000140 returned -14 03:37:45 executing program 1: r0 = perf_event_open$cgroup(0x0, 0xffffffffffffffff, 0x4, 0xffffffffffffffff, 0x3) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x2, 0xffffffffffffffff, 0x2) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x1) ioctl$TUNSETFILTEREBPF(0xffffffffffffffff, 0x800454e1, &(0x7f0000000440)) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f00000002c0)='./cgroup.net/syz0\x00', 0x1ff) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000500)={0xffffffffffffffff, 0x2, 0x1, 0x0, 0x0}, 0x20) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup(0xffffffffffffffff, 0x0, 0x1ff) perf_event_open(&(0x7f00000005c0)={0x1, 0x70, 0x3, 0x2, 0x0, 0x2, 0x0, 0x9, 0x0, 0x4, 0xfd, 0x1000, 0x101, 0x5, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x8, 0x200, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x8000000000000000, 0x0, 0x10001, 0x0, 0x0, 0x7, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x8, 0x5, 0x0, 0x62}, 0x0, 0x0, 0xffffffffffffffff, 0x2) ioctl$PERF_EVENT_IOC_DISABLE(r0, 0x2401, 0x9) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(0xffffffffffffffff) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) 03:37:45 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x0, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x48) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f00000005c0)={0x80000000000000, 0x7}, 0x4) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000280)=0x32, 0x4) connect$inet(r0, &(0x7f0000000340)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) 03:37:45 executing program 2: r0 = socket$netlink(0x10, 0x3, 0xf) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r0, 0x10e, 0x8, &(0x7f00000000c0)=0x7fffffff, 0x4) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x300000003}, 0xc) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/loop-control\x00', 0x0, 0x0) r2 = ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, r2) 03:37:45 executing program 2: r0 = socket$netlink(0x10, 0x3, 0xf) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r0, 0x10e, 0x8, &(0x7f00000000c0)=0x7fffffff, 0x4) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x300000003}, 0xc) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/loop-control\x00', 0x0, 0x0) r2 = ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, r2) 03:37:46 executing program 3: futex(0x0, 0x8b, 0x0, &(0x7f0000000200), &(0x7f0000000240), 0x0) 03:37:46 executing program 4: r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f00000005c0)={0x80000000000000, 0x7}, 0x4) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000280)=0x32, 0x4) connect$inet(r0, &(0x7f0000000340)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) 03:37:46 executing program 3: r0 = socket$netlink(0x10, 0x3, 0xf) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r0, 0x10e, 0x8, &(0x7f00000000c0)=0x7fffffff, 0x4) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x300000003}, 0xc) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/loop-control\x00', 0x0, 0x0) ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) socket$inet_udp(0x2, 0x2, 0x0) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, 0x0) 03:37:46 executing program 4: r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f00000005c0)={0x80000000000000, 0x7}, 0x4) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000280)=0x32, 0x4) connect$inet(r0, &(0x7f0000000340)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) 03:37:46 executing program 2: r0 = socket$netlink(0x10, 0x3, 0xf) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r0, 0x10e, 0x8, &(0x7f00000000c0)=0x7fffffff, 0x4) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x300000003}, 0xc) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/loop-control\x00', 0x0, 0x0) r2 = ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, r2) 03:37:46 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) rt_sigtimedwait(&(0x7f00005a1000), 0x0, 0x0, 0x8) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='task\x00') getdents(r1, &(0x7f0000000080)=""/103, 0x67) getdents(r1, &(0x7f0000000100)=""/181, 0x20) 03:37:46 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000500)='/dev/loop#\x00', 0x0, 0x182) r1 = memfd_create(&(0x7f0000000380)='iC;`\xb6p+\x10', 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000001400)) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81805) sendfile(r0, r0, 0x0, 0x2000005) ioctl$LOOP_CLR_FD(r0, 0x4c01) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) 03:37:48 executing program 1: r0 = perf_event_open$cgroup(0x0, 0xffffffffffffffff, 0x4, 0xffffffffffffffff, 0x3) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x2, 0xffffffffffffffff, 0x2) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x1) ioctl$TUNSETFILTEREBPF(0xffffffffffffffff, 0x800454e1, &(0x7f0000000440)) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f00000002c0)='./cgroup.net/syz0\x00', 0x1ff) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000500)={0xffffffffffffffff, 0x2, 0x1, 0x0, 0x0}, 0x20) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup(0xffffffffffffffff, 0x0, 0x1ff) perf_event_open(&(0x7f00000005c0)={0x1, 0x70, 0x3, 0x2, 0x0, 0x2, 0x0, 0x9, 0x0, 0x4, 0xfd, 0x1000, 0x101, 0x5, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x8, 0x200, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x8000000000000000, 0x0, 0x10001, 0x0, 0x0, 0x7, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x8, 0x5, 0x0, 0x62}, 0x0, 0x0, 0xffffffffffffffff, 0x2) ioctl$PERF_EVENT_IOC_DISABLE(r0, 0x2401, 0x9) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(0xffffffffffffffff) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) 03:37:48 executing program 4: r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f00000005c0)={0x80000000000000, 0x7}, 0x4) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000280)=0x32, 0x4) connect$inet(r0, &(0x7f0000000340)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) 03:37:48 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) rt_sigtimedwait(&(0x7f00005a1000), 0x0, 0x0, 0x8) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='task\x00') getdents(r1, &(0x7f0000000080)=""/103, 0x67) getdents(r1, &(0x7f0000000100)=""/181, 0x20) 03:37:48 executing program 5: r0 = perf_event_open$cgroup(0x0, 0xffffffffffffffff, 0x4, 0xffffffffffffffff, 0x3) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x2, 0xffffffffffffffff, 0x2) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x1) ioctl$TUNSETFILTEREBPF(0xffffffffffffffff, 0x800454e1, &(0x7f0000000440)) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f00000002c0)='./cgroup.net/syz0\x00', 0x1ff) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000500)={0xffffffffffffffff, 0x2, 0x1, 0x0, 0x0}, 0x20) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup(0xffffffffffffffff, 0x0, 0x1ff) perf_event_open(&(0x7f00000005c0)={0x1, 0x70, 0x3, 0x2, 0x0, 0x2, 0x0, 0x9, 0x0, 0x4, 0xfd, 0x1000, 0x101, 0x5, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x8, 0x200, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x8000000000000000, 0x0, 0x10001, 0x0, 0x0, 0x7, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x8, 0x5, 0x0, 0x62}, 0x0, 0x0, 0xffffffffffffffff, 0x2) ioctl$PERF_EVENT_IOC_DISABLE(r0, 0x2401, 0x9) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(0xffffffffffffffff) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) 03:37:48 executing program 2: r0 = socket$netlink(0x10, 0x3, 0xf) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r0, 0x10e, 0x8, &(0x7f00000000c0)=0x7fffffff, 0x4) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x300000003}, 0xc) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/loop-control\x00', 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, 0x0) 03:37:48 executing program 3: r0 = perf_event_open$cgroup(0x0, 0xffffffffffffffff, 0x4, 0xffffffffffffffff, 0x3) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x2, 0xffffffffffffffff, 0x2) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x1) ioctl$TUNSETFILTEREBPF(0xffffffffffffffff, 0x800454e1, &(0x7f0000000440)) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f00000002c0)='./cgroup.net/syz0\x00', 0x1ff) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000500)={0xffffffffffffffff, 0x2, 0x1, 0x0, 0x0}, 0x20) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup(0xffffffffffffffff, 0x0, 0x1ff) perf_event_open(&(0x7f00000005c0)={0x1, 0x70, 0x3, 0x2, 0x0, 0x2, 0x0, 0x9, 0x0, 0x4, 0xfd, 0x1000, 0x101, 0x5, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x8, 0x200, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x8000000000000000, 0x0, 0x10001, 0x0, 0x0, 0x7, @perf_bp={0x0, 0x2}, 0x0, 0x0, 0x8, 0x5, 0x0, 0x62}, 0x0, 0x0, 0xffffffffffffffff, 0x2) ioctl$PERF_EVENT_IOC_DISABLE(r0, 0x2401, 0x9) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(0xffffffffffffffff) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x20032600) 03:37:48 executing program 4: r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f00000005c0)={0x80000000000000, 0x7}, 0x4) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000280)=0x32, 0x4) connect$inet(r0, &(0x7f0000000340)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) 03:37:48 executing program 2: r0 = socket$netlink(0x10, 0x3, 0xf) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r0, 0x10e, 0x8, &(0x7f00000000c0)=0x7fffffff, 0x4) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x300000003}, 0xc) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) 03:37:49 executing program 4: r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, 0x0, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f00000005c0)={0x80000000000000, 0x7}, 0x4) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000280)=0x32, 0x4) connect$inet(r0, &(0x7f0000000340)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) 03:37:49 executing program 2: r0 = socket$netlink(0x10, 0x3, 0xf) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r0, 0x10e, 0x8, &(0x7f00000000c0)=0x7fffffff, 0x4) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x300000003}, 0xc) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) 03:37:49 executing program 2: r0 = socket$netlink(0x10, 0x3, 0xf) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r0, 0x10e, 0x8, &(0x7f00000000c0)=0x7fffffff, 0x4) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x300000003}, 0xc) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) 03:37:49 executing program 4: r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, 0x0, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f00000005c0)={0x80000000000000, 0x7}, 0x4) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000280)=0x32, 0x4) connect$inet(r0, &(0x7f0000000340)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) 03:37:49 executing program 1: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x20000000000104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x1) ptrace$cont(0x18, r1, 0x0, 0x0) ptrace$cont(0x1f, r1, 0x0, 0x3) 03:37:49 executing program 5: r0 = socket$netlink(0x10, 0x3, 0xf) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r0, 0x10e, 0x8, &(0x7f00000000c0)=0x7fffffff, 0x4) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/loop-control\x00', 0x0, 0x0) r2 = ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, r2) 03:37:49 executing program 2: r0 = socket$netlink(0x10, 0x3, 0xf) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r0, 0x10e, 0x8, &(0x7f00000000c0)=0x7fffffff, 0x4) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/loop-control\x00', 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, 0x0) 03:37:49 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) rt_sigtimedwait(&(0x7f00005a1000), 0x0, 0x0, 0x8) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='task\x00') getdents(r1, &(0x7f0000000080)=""/103, 0x67) getdents(r1, &(0x7f0000000100)=""/181, 0x20) 03:37:49 executing program 4: r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, 0x0, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f00000005c0)={0x80000000000000, 0x7}, 0x4) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000280)=0x32, 0x4) connect$inet(r0, &(0x7f0000000340)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) 03:37:49 executing program 1: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x2f) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="053fd7a35cf454dcc73cb00040efb7ef735f84eb61e12a5720992d00000000000000009fbacda7b9cd7c4f262ff205a4cc0a1c72d56d71a5ff"], 0x39) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r0, 0x0, 0x0) 03:37:49 executing program 3: r0 = creat(&(0x7f0000000340)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x4002) io_setup(0x103, &(0x7f0000000080)=0x0) ftruncate(r0, 0x48280) r2 = open(&(0x7f000000fffa)='./bus\x00', 0x141446, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x3, 0x11, r2, 0x0) io_submit(r1, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 03:37:49 executing program 2: r0 = socket$netlink(0x10, 0x3, 0xf) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r0, 0x10e, 0x8, &(0x7f00000000c0)=0x7fffffff, 0x4) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/loop-control\x00', 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, 0x0) 03:37:49 executing program 5: r0 = socket$netlink(0x10, 0x3, 0xf) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r0, 0x10e, 0x8, &(0x7f00000000c0)=0x7fffffff, 0x4) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/loop-control\x00', 0x0, 0x0) r2 = ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, r2) 03:37:49 executing program 4: r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) r1 = socket$packet(0x11, 0x0, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f00000005c0)={0x80000000000000, 0x7}, 0x4) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000280)=0x32, 0x4) connect$inet(r0, &(0x7f0000000340)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) 03:37:49 executing program 1: 03:37:49 executing program 1: 03:37:49 executing program 1: 03:37:49 executing program 5: r0 = socket$netlink(0x10, 0x3, 0xf) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r0, 0x10e, 0x8, &(0x7f00000000c0)=0x7fffffff, 0x4) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/loop-control\x00', 0x0, 0x0) r2 = ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, r2) 03:37:49 executing program 2: r0 = socket$netlink(0x10, 0x3, 0xf) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r0, 0x10e, 0x8, &(0x7f00000000c0)=0x7fffffff, 0x4) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/loop-control\x00', 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, 0x0) 03:37:50 executing program 1: 03:37:50 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) rt_sigtimedwait(&(0x7f00005a1000), 0x0, 0x0, 0x8) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='task\x00') getdents(r1, &(0x7f0000000100)=""/181, 0x20) 03:37:50 executing program 4: r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) r1 = socket$packet(0x11, 0x0, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f00000005c0)={0x80000000000000, 0x7}, 0x4) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000280)=0x32, 0x4) connect$inet(r0, &(0x7f0000000340)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) 03:37:50 executing program 2: r0 = socket$netlink(0x10, 0x3, 0xf) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x300000003}, 0xc) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/loop-control\x00', 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, 0x0) 03:37:50 executing program 3: 03:37:50 executing program 5: r0 = socket$netlink(0x10, 0x3, 0xf) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r0, 0x10e, 0x8, &(0x7f00000000c0)=0x7fffffff, 0x4) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/loop-control\x00', 0x0, 0x0) r2 = ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, r2) 03:37:50 executing program 3: 03:37:50 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) r1 = memfd_create(&(0x7f0000000100)='t\bnu\x00\x00\x00\x00\x85nG\x13g\xa6\x05', 0x0) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(0xffffffffffffffff, 0xc0145401, 0x0) 03:37:50 executing program 4: r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) r1 = socket$packet(0x11, 0x0, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f00000005c0)={0x80000000000000, 0x7}, 0x4) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000280)=0x32, 0x4) connect$inet(r0, &(0x7f0000000340)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) 03:37:50 executing program 3: 03:37:50 executing program 3: 03:37:50 executing program 2: r0 = socket$netlink(0x10, 0x3, 0xf) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x300000003}, 0xc) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/loop-control\x00', 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, 0x0) 03:37:50 executing program 3: 03:37:51 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) rt_sigtimedwait(&(0x7f00005a1000), 0x0, 0x0, 0x8) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='task\x00') getdents(r1, &(0x7f0000000100)=""/181, 0x20) 03:37:51 executing program 5: 03:37:51 executing program 3: 03:37:51 executing program 4: r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f00000005c0)={0x80000000000000, 0x7}, 0x4) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000280)=0x32, 0x4) connect$inet(r0, &(0x7f0000000340)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) 03:37:51 executing program 1: 03:37:51 executing program 2: r0 = socket$netlink(0x10, 0x3, 0xf) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x300000003}, 0xc) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/loop-control\x00', 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, 0x0) 03:37:51 executing program 3: 03:37:51 executing program 5: 03:37:51 executing program 1: 03:37:51 executing program 5: 03:37:51 executing program 1: 03:37:51 executing program 3: 03:37:52 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) rt_sigtimedwait(&(0x7f00005a1000), 0x0, 0x0, 0x8) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='task\x00') getdents(r1, &(0x7f0000000100)=""/181, 0x20) 03:37:52 executing program 3: 03:37:52 executing program 5: 03:37:52 executing program 1: 03:37:52 executing program 2: setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(0xffffffffffffffff, 0x10e, 0x8, &(0x7f00000000c0)=0x7fffffff, 0x4) bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x300000003}, 0xc) r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/loop-control\x00', 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) 03:37:52 executing program 4: r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f00000005c0)={0x80000000000000, 0x7}, 0x4) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000280)=0x32, 0x4) connect$inet(r0, &(0x7f0000000340)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) 03:37:52 executing program 3: 03:37:52 executing program 1: 03:37:52 executing program 3: 03:37:52 executing program 5: socket$inet(0x10, 0x0, 0x0) ioctl$VT_WAITACTIVE(0xffffffffffffffff, 0x5607) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x82) r2 = memfd_create(&(0x7f0000000100)='t\bnu\x00\x00\x00\x00\x85nG\x13g\xa6\x05', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) sendfile(r1, r1, 0x0, 0x20002000005) ioctl$LOOP_CLR_FD(r1, 0x4c01) socketpair$unix(0x1, 0x0, 0x0, 0x0) openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_REFRESH(r0, 0x2402, 0x6946) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, r3, 0x0) write(0xffffffffffffffff, &(0x7f00000001c0), 0x7ba27d3a) 03:37:52 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x82) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) r1 = memfd_create(&(0x7f0000000100)='t\bnu\x00\x00\x00\x00\x85nG\x13g\xa6\x05', 0x0) pwritev(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(0xffffffffffffffff, r0, 0x0, 0x20002000005) ioctl$LOOP_CLR_FD(r0, 0x4c01) openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(0xffffffffffffffff, 0xc0145401, 0x0) 03:37:52 executing program 3: socket$inet(0x10, 0x0, 0x0) ioctl$VT_WAITACTIVE(0xffffffffffffffff, 0x5607) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x82) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) r2 = memfd_create(&(0x7f0000000100)='t\bnu\x00\x00\x00\x00\x85nG\x13g\xa6\x05', 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f0000000040)}], 0x1, 0x81805) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) ioctl$LOOP_CLR_FD(r1, 0x4c01) socketpair$unix(0x1, 0x0, 0x0, 0x0) openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(0xffffffffffffffff, 0xc0145401, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_REFRESH(r0, 0x2402, 0x0) write(0xffffffffffffffff, &(0x7f00000001c0), 0x7ba27d3a) [ 555.581766] kasan: CONFIG_KASAN_INLINE enabled [ 555.586575] kasan: GPF could be caused by NULL-ptr deref or user memory access [ 555.598471] general protection fault: 0000 [#1] PREEMPT SMP KASAN NOPTI [ 555.605310] Modules linked in: [ 555.608543] CPU: 1 PID: 27894 Comm: syz-executor.5 Not tainted 4.14.107+ #33 [ 555.615724] task: ffff88819f0f1780 task.stack: ffff8881c1978000 [ 555.621908] RIP: 0010:kobject_uevent_env+0x62/0xc60 [ 555.627117] RSP: 0018:ffff8881c197fab0 EFLAGS: 00010206 [ 555.632474] RAX: 0000000000000018 RBX: 0000000000000002 RCX: 0000000000000f9e [ 555.639755] RDX: ffffffff82803576 RSI: ffffc9000072a000 RDI: 00000000000000c0 [ 555.647626] RBP: ffff8881bc0a9850 R08: 0000000000000001 R09: 0000000000000001 [ 555.654902] R10: ffff88819f0f1fd8 R11: 0000000000000001 R12: 00000000000000a0 [ 555.662176] R13: dffffc0000000000 R14: ffff8881bc0a97c8 R15: 00000000000000a0 [ 555.669556] FS: 00007f4261512700(0000) GS:ffff8881d7700000(0000) knlGS:0000000000000000 [ 555.677890] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 555.683863] CR2: 00007f42614f0db8 CR3: 000000019d568005 CR4: 00000000001606a0 [ 555.693467] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 555.700830] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 [ 555.708284] Call Trace: [ 555.710897] loop_clr_fd+0x49e/0xac0 [ 555.719791] lo_ioctl+0x813/0x1970 [ 555.723540] ? __lock_acquire+0x56a/0x3fa0 [ 555.728504] ? loop_clr_fd+0xac0/0xac0 [ 555.732939] blkdev_ioctl+0x4d9/0x1810 [ 555.737254] ? blkpg_ioctl+0x910/0x910 [ 555.741541] ? perf_trace_lock_acquire+0x122/0x4e0 [ 555.746611] block_ioctl+0xd9/0x120 [ 555.750260] ? blkdev_fallocate+0x3b0/0x3b0 [ 555.754697] do_vfs_ioctl+0xabe/0x1040 [ 555.758598] ? trace_hardirqs_on_caller+0x37b/0x540 [ 555.763641] ? ioctl_preallocate+0x1e0/0x1e0 [ 555.768048] ? retint_kernel+0x2d/0x2d [ 555.771967] ? security_file_ioctl+0x7c/0xb0 [ 555.776558] SyS_ioctl+0x7f/0xb0 [ 555.780019] ? do_vfs_ioctl+0x1040/0x1040 [ 555.784178] do_syscall_64+0x19b/0x4b0 [ 555.788068] ? entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 555.793424] Code: 03 42 80 3c 28 00 0f 85 7c 0a 00 00 4d 8b 64 24 18 4d 85 e4 0f 84 4f 02 00 00 e8 6a 70 b0 fe 49 8d 7c 24 20 48 89 f8 48 c1 e8 03 <42> 80 3c 28 00 0f 85 48 0a 00 00 49 8b 6c 24 20 48 85 ed 74 b0 [ 555.812978] RIP: kobject_uevent_env+0x62/0xc60 RSP: ffff8881c197fab0 [ 555.820575] ---[ end trace e0a588d81f0c2559 ]--- [ 555.825414] Kernel panic - not syncing: Fatal exception [ 555.832317] Kernel Offset: 0x9c00000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) [ 555.843171] Rebooting in 86400 seconds..