D(0xffffffffffffffff, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000480)={@fda={0x66646185, 0x2, 0x0, 0x32}, @flat=@binder={0x73622a85, 0xa, 0x3}, @fda={0x66646185, 0x0, 0x0, 0x30}}, &(0x7f0000000080)={0x0, 0x20, 0x38}}}], 0x0, 0x73b000, 0x0}) setsockopt$inet_sctp_SCTP_AUTO_ASCONF(0xffffffffffffffff, 0x84, 0x1e, &(0x7f0000000400)=0x3, 0x4) r6 = dup2(r5, r4) ioctl$BINDER_SET_CONTEXT_MGR(r6, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$sock_inet_SIOCSIFNETMASK(r3, 0x891c, &(0x7f0000000180)={'batadv0\x00', {0x2, 0x4e24, @private=0xa010103}}) bind$bt_sco(r6, &(0x7f0000000000)={0x1f, @fixed={[], 0x12}}, 0x8) [ 233.900746] binder: 13334:13341 ioctl c0306201 20000200 returned -22 [ 233.920884] CPU: 0 PID: 13331 Comm: syz-executor.1 Not tainted 4.14.184-syzkaller #0 [ 233.928820] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 233.938895] Call Trace: [ 233.941536] dump_stack+0x1b2/0x283 [ 233.945374] should_fail.cold+0x10a/0x154 [ 233.949647] should_failslab+0xd6/0x130 [ 233.949679] binder: 13334:13341 unknown command 0 [ 233.953637] kmem_cache_alloc_node+0x25f/0x400 [ 233.953660] __alloc_skb+0x9a/0x4c0 [ 233.953681] ? __kmalloc_reserve.isra.0+0xd0/0xd0 [ 233.953697] ? netlink_has_listeners+0x1ff/0x310 [ 233.953716] kobject_uevent_env+0x6d1/0xc50 [ 233.953750] kvm_uevent_notify_change.part.0+0x2b9/0x420 [ 233.953767] ? kvm_vm_release+0x50/0x50 [ 233.953777] kvm_put_kvm+0x96/0xa90 [ 233.953800] ? kvm_vm_release+0x50/0x50 [ 233.953812] kvm_vcpu_release+0x77/0xa0 [ 233.953826] __fput+0x25f/0x7a0 [ 233.986305] binder: 13334:13341 ioctl c0306201 200001c0 returned -22 [ 233.986976] task_work_run+0x113/0x190 [ 233.991564] binder_alloc: 13347: binder_alloc_buf, no vma [ 233.994564] exit_to_usermode_loop+0x1ad/0x200 [ 233.994584] do_syscall_64+0x4a3/0x640 [ 233.994609] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 233.994619] RIP: 0033:0x45ca59 [ 233.994626] RSP: 002b:00007fe725021c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000021 [ 233.994639] RAX: 0000000000000006 RBX: 00000000004dbb20 RCX: 000000000045ca59 [ 233.994646] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000005 [ 233.994652] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 233.994660] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000007 [ 233.994668] R13: 00000000000000a2 R14: 00000000004c35b5 R15: 00007fe7250226d4 [ 234.053465] binder: 13334:13351 unknown command 1074029337 [ 234.070995] binder: 13350:13353 unknown command 116327127 [ 234.090484] binder: 13334:13351 ioctl c0306201 20000280 returned -22 07:10:20 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_IRQ_LINE(r1, 0x4008ae61, &(0x7f0000000040)={0x0, 0x400}) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = dup3(r0, r1, 0x0) dup2(r3, r2) [ 234.107353] binder: BINDER_SET_CONTEXT_MGR already set [ 234.112953] binder: 13334:13346 ioctl 40046207 0 returned -16 07:10:20 executing program 1 (fault-call:5 fault-nth:11): perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = dup3(r0, r1, 0x0) dup2(r3, r2) [ 234.150502] binder: 13334:13346 unknown command 1074029337 [ 234.186788] binder: 13334:13346 ioctl c0306201 20000280 returned -22 [ 234.191976] binder: 13350:13353 ioctl c0306201 20000200 returned -22 07:10:20 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) r1 = socket$kcm(0x10, 0x2, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) dup2(r1, r2) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$KVM_GET_REG_LIST(r3, 0xc008aeb0, &(0x7f0000000040)={0x8, [0x1200000000000000, 0x8, 0xba, 0x40, 0xf9, 0x4, 0x20, 0x7f]}) [ 234.235775] binder: BINDER_SET_CONTEXT_MGR already set [ 234.244318] binder: 13350:13353 ioctl 40046207 0 returned -16 [ 234.317603] FAULT_INJECTION: forcing a failure. [ 234.317603] name failslab, interval 1, probability 0, space 0, times 0 [ 234.351065] binder: BINDER_SET_CONTEXT_MGR already set [ 234.361662] CPU: 1 PID: 13366 Comm: syz-executor.1 Not tainted 4.14.184-syzkaller #0 [ 234.369589] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 234.370967] binder: 13347:13376 ioctl 40046207 0 returned -16 [ 234.378951] Call Trace: [ 234.378978] dump_stack+0x1b2/0x283 [ 234.379001] should_fail.cold+0x10a/0x154 [ 234.379022] should_failslab+0xd6/0x130 [ 234.379041] kmem_cache_alloc_node_trace+0x25a/0x400 [ 234.404497] __kmalloc_node_track_caller+0x38/0x70 [ 234.409455] __kmalloc_reserve.isra.0+0x35/0xd0 [ 234.414277] __alloc_skb+0xca/0x4c0 [ 234.417927] ? __kmalloc_reserve.isra.0+0xd0/0xd0 [ 234.422792] ? netlink_has_listeners+0x1ff/0x310 [ 234.427574] kobject_uevent_env+0x6d1/0xc50 [ 234.431941] kvm_uevent_notify_change.part.0+0x2b9/0x420 [ 234.437416] ? kvm_vm_release+0x50/0x50 [ 234.441410] kvm_put_kvm+0x96/0xa90 [ 234.445072] ? kvm_vm_release+0x50/0x50 [ 234.449068] kvm_vcpu_release+0x77/0xa0 [ 234.453062] __fput+0x25f/0x7a0 [ 234.456408] task_work_run+0x113/0x190 [ 234.460327] exit_to_usermode_loop+0x1ad/0x200 07:10:20 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = shmat(0x0, &(0x7f0000ff7000/0x1000)=nil, 0x6000) shmdt(r1) shmdt(r1) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r5 = dup2(r4, r3) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) sendmsg$rds(r5, &(0x7f0000002f80)={&(0x7f0000000080)={0x2, 0x4e23, @broadcast}, 0x10, &(0x7f00000000c0)=[{&(0x7f00000002c0)=""/4096, 0x1000}], 0x1, &(0x7f0000002d80)=[@mask_cswp={0x58, 0x114, 0x9, {{0x80000001, 0xff}, &(0x7f0000000100)=0x1000, &(0x7f0000000140)=0x20, 0xffffffff, 0x80d8, 0x3, 0x6f, 0x14, 0x7fffffff}}, @cswp={0x58, 0x114, 0x7, {{0x9}, &(0x7f0000000180), &(0x7f00000001c0)=0xbbd, 0x6, 0x800, 0x9, 0x8, 0x20, 0x7}}, @rdma_args={0x48, 0x114, 0x1, {{0x0, 0x9}, {&(0x7f0000001780)=""/4096, 0x1000}, &(0x7f0000000240)=[{&(0x7f00000012c0)=""/210, 0xd2}], 0x1, 0x3, 0x2}}, @zcopy_cookie={0x18, 0x114, 0xc, 0x8e}, @fadd={0x58, 0x114, 0x6, {{0x80, 0x5}, &(0x7f00000013c0)=0x6f, &(0x7f0000001400)=0x80000001, 0x0, 0x6, 0x2, 0x0, 0x46, 0x549}}, @rdma_args={0x48, 0x114, 0x1, {{0x7, 0x7}, {&(0x7f0000001440)=""/13, 0xd}, &(0x7f0000002c00)=[{&(0x7f0000001480)=""/26, 0x1a}, {&(0x7f00000014c0)=""/116, 0x74}, {&(0x7f0000001540)=""/202, 0xca}, {&(0x7f0000001640)=""/47, 0x2f}, {&(0x7f0000001680)=""/177, 0xb1}, {&(0x7f0000002780)=""/227, 0xe3}, {&(0x7f0000002fc0)=""/193, 0xc1}, {&(0x7f0000002980)=""/215, 0xd7}, {&(0x7f0000002a80)=""/240, 0xf0}, {&(0x7f0000002b80)=""/104, 0x68}], 0xa, 0x5, 0x3}}, @rdma_map={0x30, 0x114, 0x3, {{&(0x7f0000002cc0)=""/91, 0x5b}, &(0x7f0000002d40), 0x24}}], 0x1e0, 0x90}, 0x48000) r6 = dup2(r2, r0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="07630440"], 0x0, 0x0, 0x0}) 07:10:20 executing program 3: r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000080)='/dev/null\x00', 0x0, 0x0) setsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r0, 0x84, 0xc, &(0x7f00000000c0)=0x7, 0x4) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={0xffffffffffffffff, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096}, 0x20) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = dup2(r2, r1) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) setsockopt$TIPC_GROUP_LEAVE(r0, 0x10f, 0x88) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$PERF_EVENT_IOC_PERIOD(r4, 0x40082404, &(0x7f0000000140)=0x2) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x18, &(0x7f00000000c0)=ANY=[@ANYBLOB="852a62770100000001000000000000000000000000000000852a687307080000000000000000000000000010000000008561646600"/80], &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) arch_prctl$ARCH_MAP_VDSO_64(0x2003, 0x9) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000002640)=ANY=[@ANYRES32], 0x32600) 07:10:20 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) r1 = socket$kcm(0x10, 0x2, 0x0) openat$nvram(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nvram\x00', 0x200000, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) r3 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r5 = dup2(r4, r3) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$RTC_PLL_GET(r5, 0x80207011, &(0x7f0000000040)) dup2(r1, r2) [ 234.464941] do_syscall_64+0x4a3/0x640 [ 234.468877] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 234.474086] RIP: 0033:0x45ca59 [ 234.477289] RSP: 002b:00007fe725021c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000021 [ 234.485018] RAX: 0000000000000006 RBX: 00000000004dbb20 RCX: 000000000045ca59 [ 234.492305] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000005 [ 234.499612] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 234.506907] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000007 [ 234.514222] R13: 00000000000000a2 R14: 00000000004c35b5 R15: 00007fe7250226d4 [ 234.519176] binder_alloc: 13380: binder_alloc_buf, no vma [ 234.540157] binder: BINDER_SET_CONTEXT_MGR already set [ 234.548963] binder: 13378:13379 ioctl 40046207 0 returned -16 [ 234.564250] binder: BINDER_SET_CONTEXT_MGR already set [ 234.574097] binder: 13378:13379 ioctl 40046207 0 returned -16 [ 234.583444] binder_alloc: 13382: binder_alloc_buf, no vma [ 234.606926] binder: BINDER_SET_CONTEXT_MGR already set [ 234.612386] binder: 13382:13384 ioctl 80207011 20000040 returned -22 07:10:20 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) socket$can_bcm(0x1d, 0x2, 0x2) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="07630440"], 0x0, 0x0, 0x0}) [ 234.628938] binder: 13378:13386 ioctl 40046207 0 returned -16 [ 234.653738] binder: BINDER_SET_CONTEXT_MGR already set [ 234.664652] binder: 13378:13386 ioctl 40046207 0 returned -16 [ 234.694309] binder_alloc: 13382: binder_alloc_buf, no vma [ 234.700053] binder: 13382:13387 ioctl 80207011 20000040 returned -22 07:10:21 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x80000000}, 0x0, 0x0, 0xffffffffffffffff, 0x2) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) r1 = socket$kcm(0x10, 0x2, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) dup2(r1, r2) 07:10:21 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="07630440"], 0x0, 0x0, 0x0}) r3 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendto$inet(r3, &(0x7f0000000140)="092a62263436c1c4c9377148af6dab73c626b1f227e8d9cfc724402bee2c6fb7e6dc506e3fa8b80133f6610a93cbe01def93d99da9362820cc477784d91e3014ba5b9cee8ddd12430c5db289c641619a6a0140002e4c02e3fcffe2379c6a898244dd7435fe909a638b6dff0fe182f943298cfcd7a46b586f58c821fb2466abe342309e7eceffde505640835efdd4d6ef959f0c0d0e6e4bf56715", 0x9a, 0xc0, &(0x7f00006f7000)={0x2, 0x0, @multicast1}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000000080)={0x2, [0x0, 0x0]}, &(0x7f0000a8a000)=0xc) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r3, 0x84, 0x6c, &(0x7f000059aff8)={r4}, &(0x7f000034f000)=0x2059b000) setsockopt$inet_sctp6_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000a40)=@assoc_value={r4}, 0x8) perf_event_open(&(0x7f0000001300)={0x1, 0x70, 0x9, 0x4, 0x4, 0xda, 0x0, 0x74, 0x3210, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x2, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x6, 0x1, @perf_bp={&(0x7f0000000240), 0xf}, 0x10148, 0x6, 0x81, 0x5, 0x0, 0x3b8fb906, 0x1ff}, 0x0, 0xc, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(0xffffffffffffffff, 0x84, 0x6c, &(0x7f00000002c0)={r4, 0x1000, "bda9c5ec7d5abed805a55f9d2045d05d117e24b9bb8be87dd02ca64e64c633ca8d402b353940f6e54414548efa16420af9db3895cfddc811a702727f5f82d84b05f47f1d0d8689b78d5ba7b32471f153c09039ad5920973dea0ec9f969245fe208c6cd24d5e79d458e89624eab2ccde41c3d4da55a3501e964a2bf0cb861e9f5bd054c4b08c6f91da794dab703329dbe1b59eb3eed2e6e790d44217e8a1949147728d08378d671da60eb107bb6b2cb4d2a7ad04c410795bb5918b269d3e5bd98250fb051727fdb50fd8753f973787853c3dead2aea1252a107372d3695870e9e964f947c69b4a0a18d04723725889cf15cd90b6d73d2ef5951d32530b98c255c6f5412306ab88cc2b793573073edf5ac61e6d12e809bb32245c6482f5ebf1f5b53ffcb868a292c2f1a7a6a061802a3088077f327ddd8197dcf81718983d834ea5ab695533f66d31ee08f0300fa1462d128841ddce15d3f9ceecc45e1d1fe074ceffa24658cb976e60a56686ad099845bf83a86787c27aacb0bb2c88a047ee3a9fd6ff9a4b31eb5a439ccf9f7b44debea65bf3577fd923d84542eebea64360890fb38b8d6bb48ceec10d4742083102b3e6fcd81fcb1622c2a6a51e8c5ba553ff820793bce0e113bcecb52cfc8c9ad456a61ae91b3ce4f6deab8c0358be1a753a34e88f23946b270aec2670d27e9c5bd86bb3f5c9971d49083805ca1d17c7bba59578290de3e705e5b1bf7329e3ad5c11d1f6b7c382ec886d479f0adce8b94af8244c4ba00c4c08de7207bb1018c42b120a757a6b11949a565aff424e16370364deca73c73104a9d8a0bc597dd7f5011216f1d928a510c185ab0e903760fae711f7aed709a37a03644424e696526a25c19cb14b4e0f175374613b1a4cc300364119b246fbfb8720ceedf5f41c2a14689dd853505c9827b2f5ca6ab4c59798d99f0dee5dd42fe874acae0fce2105b558ac92135e612f65285b8fadacdde45e3f234053df156e44ea8bbb3cca093f287395b366d1e95030ffb9f708b5f882ab3a3026fadf99a7ac76c147e937739be7f666ffc3ac6e068b52b7ef2e3e6984033da35af8bc2d470e3aef16f91d8578447c9e5d427ced1e5d42bb874cd600684f86de62cd0bdeeb70a19835ccce9204604e87260f2efa4121761951e4db146889be147703bd41065baeb326a212c4a6aff619226f814b046ffa3ee5e30f55169a4ac8075824dfd43decfcfed071a7664045ad2064b1bf035eac37b0a8a7ec72546fdb018979b3e091da551c07db8bdcfd40be5898e4b4d98d2f0db7051e9c59bd631e4931a88452f559a10eba9ac466ddb5ec174fcc2bea03d23399726ddb30e63a27ac3459a73cc6c39900f63449d78ca3eeb6e8bb56e7e8e1ab36e7c57a512d53037cb2f12d2b4b8b3346c6a8213d5159e08c1a525f72cb74cc1426a7ddc70c70f61a8b510812937a23c53670469a86b724a03318874379d0d1943575692adc440e95e0ff5dde321a2f70b439529b3c963cf94be848b3e24f4d1449158cbc89aa736fb532c355782c524fd2c749b0c46229c87cdd445e4f63d6b8f0bf3a8c62559b915b7d75320a45bbee591cf30262bc2ccecf2ba7cc6cab248bf9bd5a50b13879f97c04be0b0c3d1e3f7bc8b0b09d667a407bf48b488ae835445e55f1b2e0521f78cc5025b97355cfca0072e6816acf8a00226a5da5147b04afaee20bcf5dffbd8afe496f95fd6816687018b04556b7c6e8e77258ce803b34c42b42f75a0dddcd90fde4b6ee18a7dfa12b03ff9eb9cb2b56cd1f8944ee41559e0b8c3fca16e057dee9ee8237e77822dbd257ad931fa9030968fc707d4aff09c1720464a4d9ba07787f5876dc2df58c1e6e3eb4819e71f76577da5f9ecdec013836acbc0dd56ccd37d8e58fe53ab387365bcca164a2e0aa371c13394eb8301b808e3c5b5cee77bd1284aa2452893e7acfc676377ef8f0a2ee1e489bc274c5dcf8b459754289411ee9ca9e17186df4e0f15a9bc1caaf386e79286655ef81159f031a80314a6ea1ed8dfdbcfae6e73e1ed767130ca1b909847f0a076485b3a23ba2d9658980dc32d6d225024e9b820179d52146584c150b20124cbd5cbe422518cf105c8b14b531b940529b62faa8e5474cafa72fe49acc265675b2be340d266ed4bfc75dacf1c8046d0f51727eae9f500038cff31d8ff307a79b05d8861a2b019539bd8893cd3745376310293740e40ff005cbebe148b870e023c6305fbdd93c73d3d88fe1e4a1eeba5694f59b29f132c7e057ea1d57b5f8d78a28585b6a06d7bdee3983add5a8fb25882435ccc8dc0541f0c4d6e2041327f02b1bedae236ac2a0453f9113b2f79693ed7c16cddca446812216f4a1d8b63a6ad203520967bb193a06d7484b65129813abebcbce1bd36561da644105ac887a6a5b421b3a4acdf71f96a19f7ef744aadffc7f496edb6f9094bfcc67fc3cf8f1a60ddcceab46b69d73927ba709848ef49c170ac868fb60648497d11d288b2f723534dde3ede2de3995a2a15a0046ba44e2b6ab7c3189cce07f579648b87c7bd826d76d0686f9a33efef2348f411d4d8e05f0fa9bc5ee308381adfa02ef4b84102cb9cbdeb96275a82b330d15f9bf16496ed4eab459079d7a6777d36749ad0008bbd9efe9e3ec7f9f3e542021f10dbf94d2c60c603fc38cd2aa059bcca346d8a26412089180bbc2ad77565579a09c0b8b9748a1e81b93bf7920eef9c13f85ba5d0e6e3d0ae4b9edec7d2dee14da0e95ee034051f88cbcfef164f6b84bfb2c0f59b436d53a73fe2753e3ae25b13f7d69aaff047f94a478c59dcd95de10986faa22b9288841ce34a85854fe250ef13d5be2cc3424f52c9027a7e80f54364641e2f82d026cea497e8a737f14c91b7bda78ad7ff23fb4db2c01b590b8af430319db394efa1b213fd3c57fb9e4e12724fb535e0d3916088898738850455a80944c3d5fcac34db8edfb070f93ee390eb81104c472c81cb6779ea9c257c262f1b0b5d56ccf21831eb17f76723a2ed5806911b17d180d4c6e88733c8fc80e573db1f405672fd8ae927a5ad5220c679e2f99ea9c1015744b3fd264bbc2a3333246c2690cfbbf6d8901a5e4d0235cf96edba5e16474b3a363d834d5fcb5ccd5180b7c90077d683ba8bd628384bcdf9e8a5611942734e1d87ca1f340037954b88517b5429559d60ae21dc80f3b75d30d36e1d38ff63e10253f462e627b298a6bf2d6e7a777c6b4df862e5cd7a951becf57afab68ea069408ce3af62ce3ec4dd355cec80454d2f8b20d7a0fa913114c32582e4a57b4bb25ce3379fc9f746a2f865ced541decf96bd9f7b14f3f35e71adbfc64051340d976d58ba6a44e5f9b9774fb6199d7934a0940abfaa955c84f64f91c63386afac8137a9dc4a88e6ff5d9d0678e0cd4e9e8448503d3682bb22b720c8d985aff721b581a747480baee56c0066a8d7b1e0ab8c9d152f4a2581cd705a0593c05d8b27bc09a11d219336f37ab2060b888b5ea105e938d47b4a4752b09ecf709093c24da43749be870ef663eb26b6b2dacfa468b56ea69fd6dc5ed7adfba2235a3c0de3ca277e30db177786c54dcce66779ded04ac4d3014000c5ef8577880cce58d958b1716c812eb5bd90e58670b52dbaab29e3d794332392d70c79a7384854c21af43d77856b1e2d536d0a72a52e08de48a7dd3ae0ff1bea4f7c95854954e2ab000a92d80cf145166e72df67f1232a5e81b6ddbe3bfd5252eb1cea05090673c0285133c39057716ab0b68f8144c2f8d139449b22e9bcd986dfe29dacaf78c795032e7116a8d9c7bdba41270dc8d21e4885f4cdea5c3627f87ba82350915129e8fe27d70d687da934c1a64a9689209e1db45819d53b8c3518fa5995670b0c9ca3a22f22daaf205baf1344d39512ab8fd1e9344b2e217064356116296508af508390a5c0f922a3c52198880be01f0f49eb0cc8d9a3b8988e281aad555c3a86447ec1290a8002564f9fcb21bcd7f740d5ced0b0db6bfc43aa66008a8acd2cd2ce702efa466ba2b46823ca6d5701f9b49d7e18b855ec9962eb11e4b19ddde1c367084229aa312f43e6439de82355b3b8cf5a276c588b3af2bfbfac895ed5e2ebdab8feebf769a1eb5f2191b0fa2062f587b80e58dd549a3051039cc57ab4032968731ceba07e5a8986d1cd82da027a85baa66499ec1091bccdba1c2ceee6d3082452551c6126a5c77a0cf1341f7206aaefa31c9fbbe1cd131206b9b7f6dc5dbda74eca358fc3b185151b1858f79ce0ebdaea4127777317e6a317d2cb659b6f975a87f29eb6f376697b121ace17900de061302f1d42d5296cc946ef09e21174df6dd413c9d27bc1d92cc51c94605c67c211a320c61343547ea197f27cc08c4788d3971c74e724298451a0caebb0408007a173d9e368ed0a7891c6fb7768fa2453f1aa61e3dfd41d747a6397aafe6ac4483c45d98cee7d337043ab322260ab618110a8b2d8dec50d68a77d509110cf8a0fa686e1e2c28c9dc47e372d0b583269b6b8a2ad4ccf63bfb85ea571a6371fe30c07b01afa26817e7573d64d630824575d30bbb1f771f902d6d33b2cfc93e00afd67a50932da9d24f81a6629dc3928797a6b17f550624c393f7ec2bc49393b9e558ee192655779808b0cf4fdb504a615a780dd19b33d204cdea35e58f9d82d6e8de0df7bbf8913299d61f7bb3d1ea8e237c85f57072bab52d2a18aed399f6c3213fd212c2c9f0d08f6f2271fb1fc6b690466b4d342a0c364b02db4dbc512d338d759bdcc68a308958db9b2b7f451b9f0d08b321999dc8a91d0992a4e065887096e3ffd733b86986dac9d9410ed0739f009c6fd6fe40cf1d4820f0fcdeff958ec3750e1588e44db08b7cfa707db5f3ca1597fd480284d644005e848a5850c51e70634d15a023969c5abca42560f8419e34a1449d9c42b55c464b910bf70b8bbdc26b758280982acebc2967fc58bd175cbe4b66690019c7c888419ab1723fc9b1e00337970d2a5fd7d8b421a8837fd3c6407c8abcc33e4b202075dd976d8b87e2ccf4ee47606c3cfdc1a99c08a47dfab3692e035fcdce62edaa4aa532bdbb02552d1dbe5fe13e9f8bf65d85a42e315fc29d961c756bcef51931d120a7f164ddc5643eea8db4bb6b8a907c7ff7f4061816b925e4b5c825b1a7111a0d480ce845e9a5101ba505b6e05f75a1789333118cc67764252c745b747719971b929714a6ffc02ace7c48227616f751a018c8e7c41e0bfcf6c563fb36e6059579993b81cdf4343cd58b7e81558dcd1cce3bf0d7f31a5d8b196b43ad756de3f0e62ed557949611f90eed5c8425fc50810eb331f1c1a3dedce693106ce8f15933fe711d55b5c85716b9849538d3a4106bc46b770566552d6a3e1c5403565b5db30b3c1bf57e1496cb7e3a5f3b5622875ddaa3c7ffc10db5c8bffdbe8ffc6a6af56c6bc1e27eaa99e37e968d7790a27f40bd32f650329a0bee9d036615f22373d2795a37b1eb451b7baf42cae3570dd9f1110c083bd6284d720085b196b03974d6520f9576ecf0f4b72d90be59585b7d3085b119f76669663b159c17b07c1d898e404c3d29d4adf64986f7f6653bf3e64c0916b25dcb37362b7802965458b129d29f5c79e61b419397d9bd5fa4849fb1a0c0f8de4720cb0cf76e6f29473a62876fb1bea1795899fe5d524d23bd244027bd41f50f48e6a52281dffd2e2b916e2d518dddb2d7808518ece26f875e2d647e43a47c27012fdb60546ebc096b8cd40294f61cbc3c13d6c86a7fee4fea9fa10801d87c346d83a2b5db591a8d149"}, &(0x7f0000000080)=0x1008) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r2, 0x84, 0x17, &(0x7f00000000c0)={r5, 0x6, 0x3a, "d83692b5b3095e94eb893c2f1b528d93f2cf6004c8ea0553028e40a023f72b01222ad33759a2dc5edcad7a57b0cda1b883bb1a63872811603777"}, 0x42) 07:10:21 executing program 1 (fault-call:5 fault-nth:12): perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = dup3(r0, r1, 0x0) dup2(r3, r2) 07:10:21 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="45630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$UI_SET_KEYBIT(r2, 0x40045565, 0x64) r3 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BLKTRACETEARDOWN(r2, 0x1276, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$TIOCGETD(0xffffffffffffffff, 0x5424, &(0x7f0000000180)) r4 = socket$kcm(0x10, 0x2, 0x0) r5 = socket$kcm(0x10, 0x2, 0x0) dup2(r4, r5) 07:10:21 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f0000000440)=ANY=[@ANYBLOB="852a7470007e770000000000000000000000000000000000852a687300000000000000000000000000000000000000008561b892e61b04a9101bfc646800000000000000000000000000000000000200"/89], &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, &(0x7f00000002c0)={0x0, 0x80000, 0xffffffffffffffff}) ioctl$FS_IOC_GETFLAGS(r2, 0x80086601, &(0x7f0000000300)) r3 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r5 = dup2(r4, r3) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r5, 0x40505330, &(0x7f00000001c0)={{0x4, 0x81}, {0x1}, 0x1, 0x2, 0x2}) r6 = dup3(r0, r1, 0x0) r7 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000400)="2e00000011008108040f80ecdb4cb92e0a480e0a586781569e91fe00d5782c2b565b000000e3bd6efb250009000e000d40400000ffed000500120100", 0xfffffffffffffd68}, {&(0x7f0000000180)="499a0a2c92cfdf85097cb4322794f8bdb7677887b3f381a3432763d342d0bc781328aea8558f66208ad9291f91d673c48121b7c23f0c17cc41bc", 0x3a}], 0x2}, 0x48001) dup2(r6, r7) 07:10:21 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) r3 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r5 = dup2(r4, r3) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) r6 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r6, 0x40046207, 0x0) r7 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000140)=ANY=[], 0x0, 0x0, 0x0}) [ 234.966658] FAULT_INJECTION: forcing a failure. [ 234.966658] name failslab, interval 1, probability 0, space 0, times 0 [ 234.992945] binder: 13407:13409 unknown command 1074029381 [ 235.000149] binder: 13407:13409 ioctl c0306201 20000280 returned -22 [ 235.011032] CPU: 1 PID: 13403 Comm: syz-executor.1 Not tainted 4.14.184-syzkaller #0 [ 235.019217] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 235.028786] Call Trace: [ 235.031411] dump_stack+0x1b2/0x283 [ 235.031668] binder_alloc: 13411: binder_alloc_buf, no vma [ 235.035170] should_fail.cold+0x10a/0x154 [ 235.035191] should_failslab+0xd6/0x130 [ 235.035206] kmem_cache_alloc_node+0x25f/0x400 [ 235.045450] binder: 13407:13414 ioctl 40045565 64 returned -22 [ 235.048871] __alloc_skb+0x9a/0x4c0 [ 235.048887] ? __kmalloc_reserve.isra.0+0xd0/0xd0 [ 235.062489] binder: BINDER_SET_CONTEXT_MGR already set [ 235.063466] ? netlink_has_listeners+0x1ff/0x310 [ 235.063486] kobject_uevent_env+0x6d1/0xc50 [ 235.063543] kvm_uevent_notify_change.part.0+0x2b9/0x420 [ 235.069548] binder: 13411:13413 ioctl 40046207 0 returned -16 [ 235.073670] ? kvm_vm_release+0x50/0x50 [ 235.073680] kvm_put_kvm+0x96/0xa90 [ 235.073704] ? kvm_vm_release+0x50/0x50 [ 235.073715] kvm_vcpu_release+0x77/0xa0 [ 235.073728] __fput+0x25f/0x7a0 [ 235.080768] binder: 13407:13414 ioctl 1276 0 returned -22 [ 235.082936] task_work_run+0x113/0x190 [ 235.082960] exit_to_usermode_loop+0x1ad/0x200 [ 235.094415] binder: 13411:13413 unknown command 0 [ 235.098451] do_syscall_64+0x4a3/0x640 [ 235.098476] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 235.108089] binder: 13411:13413 ioctl c0306201 200000c0 returned -22 [ 235.108291] RIP: 0033:0x45ca59 [ 235.112511] binder_alloc: 13410: binder_alloc_buf, no vma [ 235.115620] RSP: 002b:00007fe725021c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000021 [ 235.115634] RAX: 0000000000000006 RBX: 00000000004dbb20 RCX: 000000000045ca59 [ 235.115640] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000005 [ 235.115647] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 235.115654] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000007 [ 235.115661] R13: 00000000000000a2 R14: 00000000004c35b5 R15: 00007fe7250226d4 07:10:21 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB='\x00\x00 \x00'], 0x0, 0x0, 0x0}) r2 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r4 = dup2(r3, r2) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x18, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda={0x66646185, 0x40000}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) ioctl$vim2m_VIDIOC_TRY_FMT(r4, 0xc0d05640, &(0x7f0000000080)={0x6, @vbi={0x6c, 0x401, 0x8536, 0x51424752, [0x100, 0x101], [0x5, 0x8000], 0x108}}) r5 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="07630440"], 0x0, 0x0, 0x0}) 07:10:21 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) r1 = socket$kcm(0x10, 0x2, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) r3 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r5 = dup2(r4, r3) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$TIOCNOTTY(r5, 0x5422) dup2(r1, r2) [ 235.214224] binder: 13410:13412 ioctl 40505330 200001c0 returned -22 [ 235.224873] binder: 13407:13414 unknown command 1074029381 [ 235.229269] binder: 13407:13418 ioctl 40045565 64 returned -22 [ 235.236207] binder: 13407:13414 ioctl c0306201 20000280 returned -22 [ 235.241192] binder: 13407:13419 ioctl 1276 0 returned -22 07:10:21 executing program 1 (fault-call:5 fault-nth:13): perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = dup3(r0, r1, 0x0) dup2(r3, r2) [ 235.319150] binder: 13424:13427 unknown command 2097152 [ 235.340428] binder: 13424:13427 ioctl c0306201 20000200 returned -22 [ 235.367733] binder: BINDER_SET_CONTEXT_MGR already set [ 235.373597] binder_alloc: 13429: binder_alloc_buf, no vma [ 235.385375] binder: 13424:13432 ioctl 40046207 0 returned -16 [ 235.391720] binder: 13429:13430 ioctl 5422 0 returned -22 [ 235.402719] binder: BINDER_SET_CONTEXT_MGR already set [ 235.408824] binder_alloc: 13429: binder_alloc_buf, no vma [ 235.413847] binder: 13424:13427 ioctl 40046207 0 returned -16 [ 235.429126] binder: 13424:13427 ioctl c0d05640 20000080 returned -22 [ 235.453174] binder: 13424:13432 unknown command 2097152 [ 235.454752] binder: 13429:13430 ioctl 5422 0 returned -22 [ 235.458770] binder: 13424:13432 ioctl c0306201 20000200 returned -22 [ 235.472328] FAULT_INJECTION: forcing a failure. [ 235.472328] name failslab, interval 1, probability 0, space 0, times 0 [ 235.477554] binder: BINDER_SET_CONTEXT_MGR already set [ 235.500199] CPU: 1 PID: 13434 Comm: syz-executor.1 Not tainted 4.14.184-syzkaller #0 [ 235.508123] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 235.512735] binder: 13424:13427 ioctl 40046207 0 returned -16 [ 235.517489] Call Trace: [ 235.517513] dump_stack+0x1b2/0x283 [ 235.517540] should_fail.cold+0x10a/0x154 [ 235.517561] should_failslab+0xd6/0x130 [ 235.538295] kmem_cache_alloc_node+0x25f/0x400 [ 235.542909] __alloc_skb+0x9a/0x4c0 [ 235.546567] ? __kmalloc_reserve.isra.0+0xd0/0xd0 [ 235.551440] ? netlink_has_listeners+0x1ff/0x310 [ 235.556235] kobject_uevent_env+0x6d1/0xc50 [ 235.560600] kvm_uevent_notify_change.part.0+0x2b9/0x420 [ 235.566077] ? kvm_vm_release+0x50/0x50 [ 235.570076] kvm_put_kvm+0x96/0xa90 [ 235.573759] ? kvm_vm_release+0x50/0x50 [ 235.577755] kvm_vcpu_release+0x77/0xa0 [ 235.581747] __fput+0x25f/0x7a0 [ 235.585068] task_work_run+0x113/0x190 [ 235.588987] exit_to_usermode_loop+0x1ad/0x200 [ 235.593595] do_syscall_64+0x4a3/0x640 [ 235.597516] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 235.602722] RIP: 0033:0x45ca59 [ 235.606097] RSP: 002b:00007fe725021c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000021 [ 235.613831] RAX: 0000000000000006 RBX: 00000000004dbb20 RCX: 000000000045ca59 [ 235.621115] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000005 [ 235.628425] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 235.635711] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000007 [ 235.643219] R13: 00000000000000a2 R14: 00000000004c35b5 R15: 00007fe7250226d4 [ 235.651101] binder: BINDER_SET_CONTEXT_MGR already set [ 235.656721] binder: 13424:13439 ioctl 40046207 0 returned -16 07:10:21 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) r1 = socket$kcm(0x10, 0x2, 0x0) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r0, 0x40505412, &(0x7f0000000000)={0x2, 0x7fd, 0x0, 0x0, 0xd}) r2 = socket$kcm(0x10, 0x2, 0x0) dup2(r1, r2) [ 235.669310] binder: 13424:13432 ioctl c0d05640 20000080 returned -22 07:10:22 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) ioctl$sock_SIOCINQ(r3, 0x541b, &(0x7f00000001c0)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="07630440"], 0x0, 0x0, 0x0}) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ttyS3\x00', 0x0, 0x0) fchmod(r4, 0x8) r5 = add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) request_key(&(0x7f0000000080)='encrypted\x00', &(0x7f00000000c0)={'syz', 0x2}, &(0x7f0000000280)='selinux.\x00', r5) add_key(&(0x7f0000000100)='encrypted\x00', &(0x7f0000000140)={'syz', 0x2}, &(0x7f0000000540), 0x0, r5) keyctl$reject(0x13, 0x0, 0xffffffffffff4e6c, 0x10000, r5) 07:10:22 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) r1 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0xee6, 0x400000) r2 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendto$inet(r2, &(0x7f0000fa3fff)='\t', 0x1, 0x0, &(0x7f00006f7000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000000080)={0x2, [0x0, 0x0]}, &(0x7f0000a8a000)=0xc) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r2, 0x84, 0x6c, &(0x7f000059aff8)={r3}, &(0x7f000034f000)=0x2059b000) setsockopt$inet_sctp6_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000a40)=@assoc_value={r3}, 0x8) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r1, 0x84, 0x6, &(0x7f0000000040)={r3, @in6={{0xa, 0x4e22, 0x4, @empty, 0x29b}}}, &(0x7f0000000180)=0x84) r4 = socket$kcm(0x10, 0x2, 0x0) r5 = socket$kcm(0x10, 0x2, 0x0) dup2(r4, r5) r6 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r7 = dup2(r6, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r7, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) mq_getsetattr(r7, &(0x7f00000001c0)={0x2a2239b1, 0x40, 0x40, 0x7}, &(0x7f0000000200)) 07:10:22 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) dup2(r1, r0) setsockopt$RDS_GET_MR(r0, 0x114, 0x2, &(0x7f00000001c0)={{&(0x7f0000000000)=""/41, 0x29}, &(0x7f00000000c0), 0x1c}, 0x20) r2 = socket$kcm(0x10, 0x2, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) dup2(r2, r3) 07:10:22 executing program 0: perf_event_open(&(0x7f0000000100)={0x5, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) timer_create(0x1, &(0x7f0000000000)={0x0, 0x9, 0x2, @thr={&(0x7f0000000180)="d45bbc005e1e0e0e45f3d520657353560ff76781f8aea3968e7fe8b163b9b88bd8ede3016c68a70bc69b2a8f61c7fb5c020de24dbf23fd48c2f43c20b9072e0846a192e4ec24989e977d4d4cac8741cea5e806ae058ef5a61e380daeb69d71231f0e2d15427b0e26d0920192ae2d8afcc0f48b7415d2cdc3fc17f6379bf12c923f2d65fe0958f290b0a8dd14f439dc47d3885105cbdef3a24c2d7a40aa4448ff9060b1155bbdabddf35f2d040cad44", &(0x7f0000000240)="f29e8949a5e3640f961eed86844e12454c7870923c4ecd7c6723437f2dfb129e6bebe6c5fef74f99cebd3e80da32ec94b917813b9d03e9cc31fbeac9634000e1ed4407e4dbd78bf4031af2c613e69f090fa5d6583a1fec737743098b0d03a657f9d86ab529281116ab1291d896369c9c0e02372a134bb40c9ccebf2216c46322754c03d2ec8be0c846d144452f8529b8095c7f9617d3f6afc9a74b2e90be081d3b49b6640abee5239567d93fdb5fb77e9377fa2cd87ede8be580dc33fbf43aa9d3165c61fd68f568947e878834b402ec0ca4"}}, &(0x7f00000000c0)) r3 = dup3(r0, r1, 0x0) dup2(r3, r2) [ 235.958524] binder: 13410:13412 ioctl 40505330 200001c0 returned -22 07:10:22 executing program 1 (fault-call:5 fault-nth:14): perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = dup3(r0, r1, 0x0) dup2(r3, r2) 07:10:22 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) r1 = socket$kcm(0x10, 0x2, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) prctl$PR_SET_MM_AUXV(0x23, 0xc, &(0x7f0000000000)="3c7ab352408ed0faa140caa3d3bc9aacd22f8cc1a62701a24af9cc02bd664a4df42ef91839d885b67845d5201edfdca506a186be80429df8daa972160ec8858b0e092d9915acfde3bc93a54672c56e171f02f1b031cc7ecff82e7f9919a560bc5a3c406ccca6094857cebfffa38f5b5d37df", 0x72) dup2(r1, r2) [ 236.132729] FAULT_INJECTION: forcing a failure. [ 236.132729] name failslab, interval 1, probability 0, space 0, times 0 [ 236.163627] CPU: 1 PID: 13463 Comm: syz-executor.1 Not tainted 4.14.184-syzkaller #0 [ 236.171559] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 236.180939] Call Trace: [ 236.183554] dump_stack+0x1b2/0x283 [ 236.187212] should_fail.cold+0x10a/0x154 [ 236.191388] should_failslab+0xd6/0x130 [ 236.195388] kmem_cache_alloc_node_trace+0x25a/0x400 [ 236.201659] __kmalloc_node_track_caller+0x38/0x70 [ 236.206619] __kmalloc_reserve.isra.0+0x35/0xd0 [ 236.211447] __alloc_skb+0xca/0x4c0 [ 236.215108] ? __kmalloc_reserve.isra.0+0xd0/0xd0 [ 236.219983] ? netlink_has_listeners+0x1ff/0x310 [ 236.224780] kobject_uevent_env+0x6d1/0xc50 [ 236.229152] kvm_uevent_notify_change.part.0+0x2b9/0x420 [ 236.234633] ? kvm_vm_release+0x50/0x50 [ 236.238660] kvm_put_kvm+0x96/0xa90 [ 236.242323] ? kvm_vm_release+0x50/0x50 [ 236.246450] kvm_vcpu_release+0x77/0xa0 [ 236.250449] __fput+0x25f/0x7a0 [ 236.253853] task_work_run+0x113/0x190 [ 236.257826] exit_to_usermode_loop+0x1ad/0x200 [ 236.262461] do_syscall_64+0x4a3/0x640 [ 236.266379] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 236.271583] RIP: 0033:0x45ca59 [ 236.274784] RSP: 002b:00007fe725021c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000021 [ 236.282604] RAX: 0000000000000006 RBX: 00000000004dbb20 RCX: 000000000045ca59 [ 236.289890] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000005 [ 236.297439] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 236.304726] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000007 [ 236.312033] R13: 00000000000000a2 R14: 00000000004c35b5 R15: 00007fe7250226d4 07:10:22 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="13ccf2ee62a204400067abcfbecae095d53c"], 0x0, 0x0, 0x0}) r3 = dup2(r2, r1) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001880)=ANY=[@ANYBLOB="0000400000000000000000000000000010200000", @ANYRES32=r4, @ANYBLOB="0000000000000000040000000a00010072737670360000001800020014000200200100"/48], 0x48}}, 0x0) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f00000003c0)='TIPCv2\x00') sendmsg$TIPC_NL_UDP_GET_REMOTEIP(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000440)={0x158, r5, 0x200, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_MEDIA={0x10, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}]}]}, @TIPC_NLA_BEARER={0x80, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x9}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5efc3560}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7f}, @TIPC_NLA_PROP_MTU={0x8}]}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x2}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e22, 0x7f, @mcast2, 0x3ff}}, {0x14, 0x2, @in={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}}}}]}, @TIPC_NLA_BEARER={0xb4, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_NAME={0x15, 0x1, @l2={'eth', 0x3a, 'veth1_to_hsr\x00'}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffff0001}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}]}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e20, @loopback}}, {0x14, 0x2, @in={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x2e}}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x20}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x80000000}]}]}, 0x158}, 0x1, 0x0, 0x0, 0x4}, 0x80) sendmsg$TIPC_NL_MEDIA_GET(r0, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x28000110}, 0xc, &(0x7f00000001c0)={&(0x7f00000005c0)={0x3f4, r5, 0x2, 0x70bd29, 0x25dfdbfb, {}, [@TIPC_NLA_SOCK={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x2}]}, @TIPC_NLA_NODE={0xc, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ADDR={0x8}]}, @TIPC_NLA_NET={0x3c, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0x7380000}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x9}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x4}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x101}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x8}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x1}]}, @TIPC_NLA_MEDIA={0x8c, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x44, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1f}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}]}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}]}, @TIPC_NLA_NODE={0x4}, @TIPC_NLA_LINK={0x64, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x54, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1ff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfffffffe}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}]}]}, @TIPC_NLA_NODE={0x298, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x1}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x7fffffff}, @TIPC_NLA_NODE_ID={0x9f, 0x3, "dbe12a12370416a887cf4fec2e65d3aefec7ecc2a3fc262f2b798641924ee2efb21dd12abd906f2e4ce73e118c16778f2d6ba39088093337765db3b5f16ad63f57a1c4c99d954922f5e546bba1b5c3eef92d82e50af6d255ecd320149e3248cf1ba4ea1dab616c0defab1f0fa0bcf0b1097428fe28f8626ea28179caa481b4619d0a1e5d31adf856dec471d0707301dc7a571377001045540c059f"}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ID={0xb9, 0x3, "789bab6de9f2cf881e1cf17764e49252fc485adc45fc643ae9f1438289fb83612375f637677f5417561173d0ed6b33b1016d86f1e165678d9f92bd39f914f31edde20b190805d0d24d029a0606f0741fc13e7803890e0ac4a7f20b5d78e88dc5c374e50549d5b94c44c7fb2cc574dad0dc95c6477a5f1a4652ee3eda27b447845f5441f6a46fee0b6df4c65a795e5ae202a07221a6dfc34aa62f39291d44cf57345b337b7b674581685e0e10ef3e48944b893d27b4"}, @TIPC_NLA_NODE_KEY={0x3e, 0x4, {'gcm(aes)\x00', 0x16, "2a6071d97b1c96da56909668d12186b67a5f342bff21"}}, @TIPC_NLA_NODE_ID={0x2a, 0x3, "d6ef39f8086b1f0a0bf52d4a4cb3422d2ceb7f46c130d0d2e6662043e7d802948aa4c6ee33ef"}, @TIPC_NLA_NODE_ID={0xb1, 0x3, "9c51d9b38b827c83ab0d8d7caa3197fec1e5932dcf28cc514983f1b8d42a20825b8819c08a73e50653a78135f606278c554d432557548eaaa4d307e5134e03981c493c7ac3b51f6f903424c6079fe642ee88f13af779fd5b1d5a7bac410c016946f3defe7c3e92fede945d78fa6b9cb3093164933f0b35051141f4bf8e3911db9e876f78e68413205955d22e0cd347f12d32a7f692986b69cea3b481858096c517fc21ab3149bb71ab496b3215"}]}]}, 0x3f4}, 0x1, 0x0, 0x0, 0x20044001}, 0x8000) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) sendmsg$NFT_MSG_GETCHAIN(r3, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x24, 0x4, 0xa, 0x101, 0x0, 0x0, {0x0, 0x0, 0x2}, [@NFTA_CHAIN_TYPE={0x8, 0x7, 'nat\x00'}, @NFTA_CHAIN_POLICY={0x8, 0x5, 0x1, 0x0, 0xffffffffffffffff}]}, 0x24}, 0x1, 0x0, 0x0, 0x8045}, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) r6 = socket$kcm(0x10, 0x2, 0x0) r7 = socket$kcm(0x10, 0x2, 0x0) dup2(r6, r7) [ 236.456127] binder: 13475:13476 unknown command -286077933 [ 236.475722] binder: 13475:13476 ioctl c0306201 20000200 returned -22 [ 236.549727] binder: 13475:13476 unknown command -286077933 [ 236.561965] binder: 13475:13476 ioctl c0306201 20000200 returned -22 07:10:22 executing program 1 (fault-call:5 fault-nth:15): perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = dup3(r0, r1, 0x0) dup2(r3, r2) 07:10:22 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x18200, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = dup3(r0, r1, 0x0) r4 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r6 = dup2(r5, r4) ioctl$BINDER_SET_CONTEXT_MGR(r6, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0540"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) r7 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendto$inet(r7, &(0x7f0000fa3fff)='\t', 0x1, 0x0, &(0x7f00006f7000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000000080)=ANY=[@ANYBLOB="02006a00", @ANYRES32=0x0, @ANYRES32=0x0], &(0x7f0000a8a000)=0xc) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r7, 0x84, 0x6c, &(0x7f000059aff8)={r8}, &(0x7f000034f000)=0x2059b000) setsockopt$inet_sctp6_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000a40)=@assoc_value={r8}, 0x8) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r6, 0x84, 0x6f, &(0x7f0000000000)={r8, 0xbc, &(0x7f0000000180)=[@in={0x2, 0x4e20, @broadcast}, @in6={0xa, 0x4e24, 0x81, @loopback, 0xfffffffc}, @in6={0xa, 0x4e22, 0x6, @remote, 0x8}, @in={0x2, 0x4e24, @multicast2}, @in6={0xa, 0x4e24, 0xc8, @mcast2}, @in={0x2, 0x4e24, @empty}, @in6={0xa, 0x4e20, 0x80000001, @mcast1, 0x8000}, @in6={0xa, 0x4e21, 0x0, @local, 0x81}]}, &(0x7f0000000040)=0x10) dup2(r3, r2) [ 236.721223] FAULT_INJECTION: forcing a failure. [ 236.721223] name failslab, interval 1, probability 0, space 0, times 0 [ 236.757534] CPU: 0 PID: 13485 Comm: syz-executor.1 Not tainted 4.14.184-syzkaller #0 [ 236.765469] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 236.774862] Call Trace: [ 236.777471] dump_stack+0x1b2/0x283 [ 236.781169] should_fail.cold+0x10a/0x154 [ 236.785349] should_failslab+0xd6/0x130 [ 236.789345] kmem_cache_alloc_node+0x25f/0x400 [ 236.793956] __alloc_skb+0x9a/0x4c0 [ 236.797597] ? __kmalloc_reserve.isra.0+0xd0/0xd0 [ 236.802467] ? netlink_has_listeners+0x1ff/0x310 [ 236.807256] kobject_uevent_env+0x6d1/0xc50 [ 236.811627] kvm_uevent_notify_change.part.0+0x2b9/0x420 [ 236.817108] ? kvm_vm_release+0x50/0x50 [ 236.821114] kvm_put_kvm+0x96/0xa90 [ 236.824779] ? kvm_vm_release+0x50/0x50 [ 236.828776] kvm_vcpu_release+0x77/0xa0 [ 236.832804] __fput+0x25f/0x7a0 [ 236.836123] task_work_run+0x113/0x190 [ 236.840057] exit_to_usermode_loop+0x1ad/0x200 [ 236.844682] do_syscall_64+0x4a3/0x640 [ 236.848613] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 236.853820] RIP: 0033:0x45ca59 [ 236.857020] RSP: 002b:00007fe725021c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000021 [ 236.861083] binder: 13488:13489 unknown command 16389 07:10:23 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0xffffffffffffffe0}, 0x0, 0x9, r2, 0x0) r3 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) prctl$PR_GET_THP_DISABLE(0x2a) r4 = socket$kcm(0x10, 0x2, 0x0) r5 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendto$inet(r5, &(0x7f0000fa3fff)='\t', 0x1, 0x0, &(0x7f00006f7000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000000080)={0x2, [0x0, 0x0]}, &(0x7f0000a8a000)=0xc) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r5, 0x84, 0x6c, &(0x7f000059aff8)={r6}, &(0x7f000034f000)=0x2059b000) setsockopt$inet_sctp6_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000a40)=@assoc_value={r6}, 0x8) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(r3, 0x84, 0x71, &(0x7f0000000000)={r6, 0x7f}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, &(0x7f0000000080)={r7}, &(0x7f00000000c0)=0xc) r8 = socket$kcm(0x10, 0x2, 0x0) dup2(r4, r8) [ 236.866060] RAX: 0000000000000006 RBX: 00000000004dbb20 RCX: 000000000045ca59 [ 236.866068] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000005 [ 236.866074] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 236.866082] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000007 [ 236.866089] R13: 00000000000000a2 R14: 00000000004c35b5 R15: 00007fe7250226d4 [ 236.991596] binder: BINDER_SET_CONTEXT_MGR already set [ 236.998002] binder: 13490:13492 ioctl 40046207 0 returned -16 07:10:23 executing program 1 (fault-call:5 fault-nth:16): perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = dup3(r0, r1, 0x0) dup2(r3, r2) 07:10:23 executing program 2: r0 = perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) r3 = fcntl$dupfd(r2, 0x406, r1) setsockopt$inet6_group_source_req(r3, 0x29, 0x36c6feef856578d7, &(0x7f0000000280)={0x400, {{0xa, 0x4e23, 0x100, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x7}}, {{0xa, 0x4e20, 0xfffff04e, @private2={0xfc, 0x2, [], 0x1}, 0x101}}}, 0x108) socket$kcm(0x10, 0x2, 0x0) socket$kcm(0x10, 0x2, 0x0) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) dup2(r0, r5) [ 237.080585] binder: 13488:13489 ioctl c0306201 20000280 returned -22 [ 237.120547] binder: BINDER_SET_CONTEXT_MGR already set [ 237.153126] binder: 13488:13501 ioctl 40046207 0 returned -16 [ 237.160818] FAULT_INJECTION: forcing a failure. [ 237.160818] name failslab, interval 1, probability 0, space 0, times 0 [ 237.173772] binder: 13488:13489 unknown command 16389 [ 237.181402] binder: 13488:13489 ioctl c0306201 20000280 returned -22 [ 237.192173] CPU: 0 PID: 13497 Comm: syz-executor.1 Not tainted 4.14.184-syzkaller #0 [ 237.200095] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 237.209463] Call Trace: [ 237.212085] dump_stack+0x1b2/0x283 [ 237.215743] should_fail.cold+0x10a/0x154 [ 237.219918] should_failslab+0xd6/0x130 [ 237.223921] kmem_cache_alloc_node_trace+0x25a/0x400 [ 237.229142] __kmalloc_node_track_caller+0x38/0x70 [ 237.234099] __kmalloc_reserve.isra.0+0x35/0xd0 [ 237.238825] __alloc_skb+0xca/0x4c0 [ 237.242478] ? __kmalloc_reserve.isra.0+0xd0/0xd0 [ 237.247351] ? netlink_has_listeners+0x1ff/0x310 [ 237.252147] kobject_uevent_env+0x6d1/0xc50 [ 237.256526] kvm_uevent_notify_change.part.0+0x2b9/0x420 [ 237.262005] ? kvm_vm_release+0x50/0x50 [ 237.266005] kvm_put_kvm+0x96/0xa90 [ 237.269667] ? kvm_vm_release+0x50/0x50 [ 237.273670] kvm_vcpu_release+0x77/0xa0 [ 237.277777] __fput+0x25f/0x7a0 [ 237.281087] task_work_run+0x113/0x190 [ 237.285006] exit_to_usermode_loop+0x1ad/0x200 [ 237.289620] do_syscall_64+0x4a3/0x640 [ 237.293552] entry_SYSCALL_64_after_hwframe+0x46/0xbb 07:10:23 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x20000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) getsockopt$IPT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x41, &(0x7f0000000240)={'filter\x00', 0x66, "76d5313d1c14e16036bebf56b9761213cbf4de1258174df43b19820f0d2522862f10702d56de94eda267103501ecd299e57b4dca9428dc61a8c838fab91c449767d1b88525673877774668667e46bf7d7224e45c44a4ea40f8d97e984a8309abc08d3e000000"}, &(0x7f00000000c0)=0x8a) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) dup2(r3, r2) [ 237.301023] RIP: 0033:0x45ca59 [ 237.304231] RSP: 002b:00007fe725021c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000021 [ 237.311971] RAX: 0000000000000006 RBX: 00000000004dbb20 RCX: 000000000045ca59 [ 237.319690] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000005 [ 237.327062] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 237.334351] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000007 [ 237.341639] R13: 00000000000000a2 R14: 00000000004c35b5 R15: 00007fe7250226d4 07:10:23 executing program 1 (fault-call:5 fault-nth:17): perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = dup3(r0, r1, 0x0) dup2(r3, r2) 07:10:23 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000080)='fou\x00') sendmsg$FOU_CMD_GET(r0, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000200)={0x1c, r1, 0x400, 0x70bd2d, 0x25dfdbfe, {}, [@FOU_ATTR_TYPE={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x8001) r2 = socket$kcm(0x10, 0x2, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) ioctl$PPPIOCATTACH(r0, 0x4004743d, &(0x7f0000000000)=0x2) dup2(r2, r3) 07:10:23 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630000"], 0x0, 0x0, 0x0}) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) syz_init_net_socket$ax25(0x3, 0x5, 0xc3) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0xffffffffffffffd1, &(0x7f00000000c0)={@ptr={0x70742a85, 0x0, &(0x7f0000000480)=""/143, 0x81, 0x2, 0x20}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/100, 0x62, 0x0, 0xffffffffffffffff}, @fda={0x66646185, 0x2}}, &(0x7f0000000080)={0x50, 0x28, 0x50}}}], 0x0, 0x73b000, 0x0}) socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$smc(&(0x7f0000000140)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000640)={0x38, 0x0, 0x8, 0x0, 0x25dfdbfb, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'veth1_macvtap\x00'}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x2}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x2}]}, 0x38}}, 0x24048040) sendmsg$SMC_PNETID_GET(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000140)={&(0x7f0000000680)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="00022dbd7000fbdbdf25010000000900010073797a310000000014000200626174616476300000000000000000000900030073797a32000000001400020077673000000000000000000000000000090002007465616d5f736f6176655f3000000000050004000200000055e0187774a2b1"], 0x70}, 0x1, 0x0, 0x0, 0x10}, 0x4001) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r4 = dup2(0xffffffffffffffff, r0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="07630440"], 0x0, 0x0, 0x0}) ioctl$SIOCX25GSUBSCRIP(0xffffffffffffffff, 0x89e0, &(0x7f0000000700)={'team_slave_0\x00', 0x400, 0x9}) setsockopt$inet6_mreq(r4, 0x29, 0x0, &(0x7f0000000000)={@private2}, 0x14) setsockopt$RDS_GET_MR_FOR_DEST(0xffffffffffffffff, 0x114, 0x7, &(0x7f00000003c0)={@xdp={0x2c, 0x2, 0x0, 0x21}, {&(0x7f0000000300)=""/143, 0x8f}, &(0x7f00000001c0), 0x5}, 0xa0) 07:10:23 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) signalfd(r1, &(0x7f0000000000)={[0x8]}, 0x8) r2 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r4 = dup2(r3, r2) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$PERF_EVENT_IOC_RESET(r4, 0x2403, 0x10000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) r5 = socket$kcm(0x10, 0x2, 0x0) r6 = socket$kcm(0x10, 0x2, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f00000001c0)=0x1) dup2(r5, r6) [ 237.551132] FAULT_INJECTION: forcing a failure. [ 237.551132] name failslab, interval 1, probability 0, space 0, times 0 [ 237.599822] CPU: 0 PID: 13518 Comm: syz-executor.1 Not tainted 4.14.184-syzkaller #0 [ 237.607774] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 237.617318] Call Trace: [ 237.619931] dump_stack+0x1b2/0x283 [ 237.623587] should_fail.cold+0x10a/0x154 [ 237.628194] should_failslab+0xd6/0x130 [ 237.632272] kmem_cache_alloc_node_trace+0x25a/0x400 [ 237.637404] __kmalloc_node_track_caller+0x38/0x70 [ 237.642355] __kmalloc_reserve.isra.0+0x35/0xd0 [ 237.647069] __alloc_skb+0xca/0x4c0 [ 237.650721] ? __kmalloc_reserve.isra.0+0xd0/0xd0 [ 237.655681] ? netlink_has_listeners+0x1ff/0x310 [ 237.656971] binder: 13528:13530 unknown command 25349 [ 237.660466] kobject_uevent_env+0x6d1/0xc50 [ 237.670080] kvm_uevent_notify_change.part.0+0x2b9/0x420 [ 237.675559] ? kvm_vm_release+0x50/0x50 [ 237.679552] kvm_put_kvm+0x96/0xa90 [ 237.683208] ? kvm_vm_release+0x50/0x50 [ 237.687203] kvm_vcpu_release+0x77/0xa0 [ 237.691367] __fput+0x25f/0x7a0 [ 237.694680] task_work_run+0x113/0x190 [ 237.696035] binder: 13528:13530 ioctl c0306201 20000200 returned -22 [ 237.698599] exit_to_usermode_loop+0x1ad/0x200 [ 237.698618] do_syscall_64+0x4a3/0x640 [ 237.714424] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 237.719631] RIP: 0033:0x45ca59 [ 237.722835] RSP: 002b:00007fe725021c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000021 [ 237.731000] RAX: 0000000000000006 RBX: 00000000004dbb20 RCX: 000000000045ca59 [ 237.738310] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000005 07:10:24 executing program 0: r0 = perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0xfffffffffffffffe) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) ioctl$VIDIOC_TRY_EXT_CTRLS(0xffffffffffffffff, 0xc0205649, &(0x7f00000001c0)={0xa00000, 0x7, 0x401, r4, 0x0, &(0x7f0000000180)={0xa00964, 0x5e, [], @value64=0xc10}}) connect$l2tp(0xffffffffffffffff, &(0x7f00000002c0)={0x2, 0x0, @loopback, 0x1}, 0x10) r6 = dup3(r1, r2, 0x0) dup2(r6, r3) r7 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r7, 0x40046207, 0x0) r8 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r8, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r9 = dup2(r8, r7) ioctl$BINDER_SET_CONTEXT_MGR(r9, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r9, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00780f000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r9, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x18, &(0x7f00000003c0)=ANY=[@ANYBLOB="852a747000000000fff70000000040000000000000000000852a687300000000000000000000000000000000000000008561646600000000000000000000000000000000000000000000020000000000180fe58578851edeee17ad3be5650a8c95790a755628c352710fded0a59f058404a93301c4caa309773b6ebecd356e9f6e19fc", @ANYRESDEC=r0, @ANYRES64=r5, @ANYRES64=r8, @ANYRESDEC=r8], &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) ioctl$SNDRV_RAWMIDI_IOCTL_DROP(r9, 0x40045730, &(0x7f0000000000)=0x800) 07:10:24 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x800) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="07630440"], 0x0, 0x0, 0x0}) [ 237.745627] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 237.753095] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000007 [ 237.759789] binder: BINDER_SET_CONTEXT_MGR already set [ 237.760522] R13: 00000000000000a2 R14: 00000000004c35b5 R15: 00007fe7250226d4 [ 237.766917] binder: 13528:13530 unknown command 25349 [ 237.779579] binder: 13528:13529 ioctl 40046207 0 returned -16 [ 237.789822] binder: 13528:13530 ioctl c0306201 20000200 returned -22 [ 237.814559] binder_alloc: 13533: binder_alloc_buf, no vma [ 237.833886] binder: 13533:13534 ioctl 2403 10000 returned -22 [ 237.855333] binder_alloc: 13533: binder_alloc_buf, no vma [ 237.873642] binder: 13533:13534 ioctl 2403 10000 returned -22 [ 237.892239] binder: 13537:13538 unknown command 1013760 07:10:24 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) r1 = socket$kcm(0x10, 0x2, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) r3 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r5 = dup2(r4, r3) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r5, 0x40045542, &(0x7f0000000000)=0x9) dup2(r1, r2) 07:10:24 executing program 1 (fault-call:5 fault-nth:18): perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = dup3(r0, r1, 0x0) dup2(r3, r2) 07:10:24 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) r3 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r5 = dup2(r4, r3) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r5, 0xc0bc5310, &(0x7f0000000080)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="07630440"], 0x0, 0x0, 0x0}) [ 237.911681] binder: 13537:13538 ioctl c0306201 20000280 returned -22 [ 237.922625] binder: 13537:13538 ioctl 40045730 20000000 returned -22 [ 237.974837] binder_alloc: 13548: binder_alloc_buf, no vma [ 237.990581] binder: 13548:13550 ioctl 40045542 20000000 returned -22 [ 238.000053] binder_alloc: 13553: binder_alloc_buf, no vma [ 238.008693] binder: 13537:13538 unknown command 1013760 [ 238.015781] binder: 13553:13554 ioctl c0bc5310 20000080 returned -22 [ 238.019290] binder: 13537:13538 ioctl c0306201 20000280 returned -22 [ 238.030371] binder_alloc: 13548: binder_alloc_buf, no vma [ 238.042138] binder: 13548:13550 ioctl 40045542 20000000 returned -22 [ 238.056245] binder: BINDER_SET_CONTEXT_MGR already set [ 238.079073] FAULT_INJECTION: forcing a failure. [ 238.079073] name failslab, interval 1, probability 0, space 0, times 0 [ 238.090929] binder: 13553:13562 ioctl 40046207 0 returned -16 [ 238.104520] binder: 13553:13554 ioctl c0bc5310 20000080 returned -22 [ 238.126831] CPU: 1 PID: 13556 Comm: syz-executor.1 Not tainted 4.14.184-syzkaller #0 [ 238.134757] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 238.144215] Call Trace: [ 238.146839] dump_stack+0x1b2/0x283 [ 238.150849] should_fail.cold+0x10a/0x154 [ 238.155122] should_failslab+0xd6/0x130 [ 238.159115] kmem_cache_alloc_trace+0x2b7/0x3f0 [ 238.163805] ? kobject_create_and_add.cold+0x3f/0x3f [ 238.168937] call_usermodehelper_setup+0x73/0x2e0 [ 238.173803] kobject_uevent_env+0xa79/0xc50 [ 238.178212] kvm_uevent_notify_change.part.0+0x2b9/0x420 [ 238.183686] ? kvm_vm_release+0x50/0x50 [ 238.187675] kvm_put_kvm+0x96/0xa90 [ 238.191332] ? kvm_vm_release+0x50/0x50 [ 238.195493] kvm_vcpu_release+0x77/0xa0 [ 238.199509] __fput+0x25f/0x7a0 [ 238.202820] task_work_run+0x113/0x190 [ 238.206732] exit_to_usermode_loop+0x1ad/0x200 [ 238.211338] do_syscall_64+0x4a3/0x640 [ 238.215257] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 238.220461] RIP: 0033:0x45ca59 07:10:24 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) r1 = socket$kcm(0x10, 0x2, 0x0) r2 = socket(0x10, 0x803, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r5 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$SIOCX25SCALLUSERDATA(r5, 0x89e5, &(0x7f0000000640)={0x32, "cb5829ba4e553ff116423e63190ede717fe2eda745282ebef749b01956557948da053a633c442c1c0168abcca1e7761fa40d0983c5e2d0861e38cb508782dbaedff4785adcfeb73bf5ad0358921a5cd72941b4a220e62796a112a01203ea309cb3a952c0d61295e3ef4b70c4e528ff3feda15af90238e3cbef9e1dcf770feddc"}) sendmsg$nl_route_sched(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001880)=ANY=[@ANYBLOB="0000000000000000000000000000000010200000", @ANYRES32=r3, @ANYBLOB="0000000000000000040000000a00010072737670360000001800020014000200200100"/48], 0x48}}, 0x0) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f00000003c0)='TIPCv2\x00') sendmsg$TIPC_NL_UDP_GET_REMOTEIP(r2, &(0x7f0000000600)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000700)={0x150, r6, 0x200, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_MEDIA={0x10, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}]}]}, @TIPC_NLA_BEARER={0x7c, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x9}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5efc3560}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7f}, @TIPC_NLA_PROP_MTU={0x8}]}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x2}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e23, @remote}}, {0x20, 0x2, @in6={0xa, 0x4e23, 0xa27, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x8}}}}]}, @TIPC_NLA_BEARER={0xb0, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_NAME={0x15, 0x1, @l2={'eth', 0x3a, 'veth1_to_hsr\x00'}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffff0001}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}]}, @TIPC_NLA_BEARER_NAME={0xc, 0x1, @l2={'eth', 0x3a, 'nr0\x00'}}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e20, @loopback}}, {0x14, 0x2, @in={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x2e}}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x20}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x80000000}]}]}, 0x150}, 0x1, 0x0, 0x0, 0x4}, 0x80) sendmsg$TIPC_NL_KEY_SET(r0, &(0x7f0000000080)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000040)={&(0x7f0000000280)={0x14c, r6, 0x200, 0x70bd29, 0x25dfdbfb, {}, [@TIPC_NLA_MON={0x24, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x5710659a}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x16}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x7fffffff}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x9}]}, @TIPC_NLA_LINK={0xac, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xb40}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x80000000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xd70}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x54, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffffa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xc}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1a}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xd}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x80}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3f80}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}]}]}, @TIPC_NLA_NET={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x7}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x2}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x87}]}, @TIPC_NLA_MON={0xc, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x2}]}, @TIPC_NLA_NET={0x38, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x101}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x25}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8, 0x1, 0xffff}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x7}, @TIPC_NLA_NET_ID={0x8, 0x1, 0xffffffff}]}]}, 0x14c}, 0x1, 0x0, 0x0, 0x4000810}, 0x20008010) r7 = socket$kcm(0x10, 0x2, 0x0) dup2(r1, r7) 07:10:24 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = dup3(r0, r1, 0x0) dup2(r3, r2) setsockopt$inet_MCAST_LEAVE_GROUP(r3, 0x0, 0x2d, &(0x7f0000000180)={0xffffffff, {{0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x2f}}}}, 0x88) 07:10:24 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) r2 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r4 = dup2(r3, r2) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r1, 0xc00c642d, &(0x7f0000000080)={0x0, 0x0, r4}) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r5, 0xc04064a0, &(0x7f00000001c0)={&(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000100)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000140)=[0x0, 0x0, 0x0], &(0x7f0000000180)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0xa, 0x6, 0x3, 0x6}) r6 = syz_open_dev$binderN(0x0, 0x0, 0x2) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r7 = dup2(r6, r0) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="07610440"], 0x0, 0x0, 0x0}) [ 238.223662] RSP: 002b:00007fe725021c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000021 [ 238.232167] RAX: 0000000000000006 RBX: 00000000004dbb20 RCX: 000000000045ca59 [ 238.239483] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000005 [ 238.247293] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 238.254609] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000007 [ 238.261897] R13: 00000000000000a2 R14: 00000000004c35b5 R15: 00007fe7250226d4 [ 238.339331] binder: BINDER_SET_CONTEXT_MGR already set [ 238.349459] binder: 13569:13572 ioctl 40046207 0 returned -16 [ 238.358715] binder: BINDER_SET_CONTEXT_MGR already set 07:10:24 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) ioctl$sock_inet_SIOCGIFDSTADDR(r0, 0x8917, &(0x7f0000000000)={'veth0_to_hsr\x00', {0x2, 0x4e21, @rand_addr=0x64010102}}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = dup3(r1, r2, 0x0) dup2(r4, r3) 07:10:24 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) r1 = socket$kcm(0x10, 0x2, 0x0) r2 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="04630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180)='nl80211\x00') socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) getpeername$packet(r6, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0xa) sendmsg$NL80211_CMD_GET_WIPHY(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x1c, r4, 0x321, 0x0, 0x0, {}, [@NL80211_ATTR_IFINDEX={0x8, 0x3, r7}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_REQ_SET_REG(r2, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0x78, r4, 0x8, 0x70bd27, 0x25dfdbfd, {}, [@NL80211_ATTR_USER_REG_HINT_TYPE={0x8}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}, @NL80211_ATTR_DFS_REGION={0x5, 0x92, 0x3}, @NL80211_ATTR_DFS_REGION={0x5, 0x92, 0x1}, @NL80211_ATTR_REG_RULES={0x44, 0x22, 0x0, 0x1, [@NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0xfffffff9}, @NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8, 0x5, 0x401}, @NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0x7fffffff}, @NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8, 0x5, 0x200}, @NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0x9a07}, @NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0x5}, @NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8, 0x5, 0x810a}, @NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8}]}]}, 0x78}, 0x1, 0x0, 0x0, 0x40080}, 0x8000) setsockopt$PNPIPE_HANDLE(r0, 0x113, 0x3, &(0x7f0000000000), 0x4) r8 = socket$kcm(0x10, 0x2, 0x0) r9 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r9, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) dup2(r1, r8) [ 238.386868] binder: 13569:13572 ioctl 40046207 0 returned -16 [ 238.421976] binder: BINDER_SET_CONTEXT_MGR already set [ 238.441384] binder: BINDER_SET_CONTEXT_MGR already set [ 238.457461] binder: 13569:13583 ioctl 40046207 0 returned -16 [ 238.472826] binder: 13569:13572 ioctl 40046207 0 returned -16 07:10:24 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) r1 = socket$kcm(0x10, 0x2, 0x0) ioctl$UFFDIO_ZEROPAGE(r0, 0xc020aa04, &(0x7f0000000000)={{&(0x7f0000ffe000/0x1000)=nil, 0x1000}}) r2 = socket$kcm(0x10, 0x2, 0x0) dup2(r1, r2) 07:10:24 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = dup2(r2, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)=ANY=[@ANYBLOB="852a7470000000000000000000000000000000000000000093f0df2000000000000000000000000000000000000000008561646600000000000000006398a5e0f600"/80], &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) setsockopt$inet_sctp6_SCTP_HMAC_IDENT(r3, 0x84, 0x16, &(0x7f00000000c0)={0x6, [0x80, 0x1f, 0x3ff, 0x80, 0x5, 0x0]}, 0x10) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) dup2(r4, r1) pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) r6 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r7 = dup2(r6, r0) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="01000000"], 0x0, 0x0, 0x0}) 07:10:24 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) stat(&(0x7f0000000040)='./file0\x00', &(0x7f0000000180)) r3 = dup3(r0, r1, 0x0) r4 = dup2(r3, r2) ioctl$TIOCL_SCROLLCONSOLE(r4, 0x541c, &(0x7f0000000000)={0xd, 0x208a}) 07:10:24 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYRES32=r2], 0x0, 0x0, 0x0}) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(r3, 0x84, 0x65, &(0x7f00000000c0)=[@in={0x2, 0x4e20, @multicast2}, @in6={0xa, 0x4e21, 0x81, @loopback, 0x5}], 0x2c) [ 238.603495] binder: 13601:13602 unknown command 1 [ 238.615113] binder: 13601:13602 ioctl c0306201 20000280 returned -22 07:10:24 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0xcf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x2, @perf_bp={0x0, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = dup2(r2, r1) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="e3a30623"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$KVM_SET_XCRS(r3, 0x4188aea7, &(0x7f0000000f00)=ANY=[@ANYBLOB="0200000000000100060cf12d8b3adf000000000000000000000000c00f0009000000000000000600000000000000"]) r4 = socket$kcm(0x10, 0x2, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000a80)={@flat=@binder={0x70742a85, 0x0, 0x2}, @fda={0x66646185, 0x4, 0x1, 0x29}, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x38}}}], 0x0, 0x73b000, 0x0}) sendmmsg$nfc_llcp(0xffffffffffffffff, &(0x7f0000001140)=[{&(0x7f0000000180)={0x27, 0x0, 0x2, 0x2, 0x3f, 0x4, "18efc35f632c2587d8f74e1cd8cbcebff45dd45dff91538137e0468533e0c6e1364b15272940d236717af63f713c654bd5fce313addcbe70885093a097f660", 0x100000013}, 0x60, &(0x7f0000000480)=[{&(0x7f00000002c0)="ce3e80f2fc7f49d3d2fc156e7bb3133d8a6b457bfeb8a4614a36696b71365badef68de3f7e8982021cf1ffc2b8f2abf5a07bcf1c64d40a7d8c3b1d65", 0x3c}, {&(0x7f0000000300)="98933fee664ab41e8d262ce7d8e3320a9585aa1959ba153e9d0e89f7dba5302464f156fba1ff685613502c08693e2072a61ff4437a39e7b7ccfac91df12940445f027445e84bb8ced2ce915a9596a8deb0dd1222eff169fb2ae585", 0x5b}, {&(0x7f0000000380)="69124e95a08f00a668f98c48333a870706042cbabb16da9ac1b5570246033e4f1c8a04a89129a8b3da937d6d8f2200c1c0aa68065bf62f83404b3e3f01da271c5fedc90fd9a2fb26a8992ac5aa73447c5b84bc1a0d0545600a4c2a66a5cb08bb9bac21f227e37718f936e69311fdd9d6cc01ae270c80fd593f585c612c9ecf472afb9aa275ff233e007a5ae76c95d9e690fbb565baa401bec0785a66f03e041f373b799c411efe0365a6a9e7490892a8ef041059b31153b39b93bae09920f3aa4db4c3f84adc63a1256aa3f602d7", 0xce}], 0x3}, {&(0x7f00000004c0)={0x27, 0x0, 0x2, 0x4, 0x1, 0x2, "b9570cd4ab4f8acf8ffa4b71e6132c14958c197e334c5eb9f70d3770e3f175779d8291681f596fa1ae3e4b38a6c701196b518c1997dfe71405b279dc8d8a1c", 0x2f}, 0x60, &(0x7f00000006c0)=[{&(0x7f00000005c0)="8f78887ee4a76998a481e003ebe4b31d00df81d509cb981a653c7290de8a4dae2201292a74c2582f6ccdcf593ed1e355c4d6a11a1fc32b5530e9f946f73d2261aec450ca00d74fbc4d9d2cb961bdf1507e0a4220d555c505744b8f8111ad680f580af1f5d7f6094d93bc5c6e14ccfd75a787ce1934387f5f34902d7d31b406dc032cd24ed9a60ed2fc6e66b7f5079ca7bd8b3e2e3dc5da1c4686b4d9606d48ca927041384e40a5f81ca381d0d7bb9a71ae3ff85cda4cf582bd9170be4e80e9ef661b", 0xc2}], 0x1, 0x0, 0x0, 0x40}, {&(0x7f0000000700)={0x27, 0x1, 0x1, 0x4, 0x1, 0xa0, "62d8dfceb1f1589b0a7b535209591460fcd83e45f7d8df01d004f1a500d9dc6d5bfd0b78a040559ba0d499d394ce666641d1b21c304f7522650a720113f284", 0x1a}, 0x60, &(0x7f0000000800)=[{&(0x7f0000000780)="5d1ae4c3d0155d7c2100e0c87e3344c77606e9ae578868f7fee30c17cbacc12f5b8f088cdd2e9389da513d481a1cc2d07c6d9e9e113af5562ac3941524fefa1d571499be2201391c889922c979f5fc", 0x4f}], 0x1, &(0x7f0000000840)={0xf0, 0x10e, 0x0, "b153dfcfd7ff4d2b59d09255c54fc7a3582db32d6104da96a06e216f3954d8c547d6fbdc50ff65707609720fdcdbd1ac27db3a7bd84f5b296678b9c7e128d9f3777548e098f0b402307994f82a0c0175c7d8416d9027f4156fad8f94d7712279010c62605baf176bb77eb12de1db292792fc882bb82e66368d8a2fec24e3c146872fb4cf8a5bfd7aab28673deaf756e9875381b03561b251c81bc51f38dfe98c1341ea99038c0469324cf44779a5dc8c5916bdfeada1e9337ca2b72a622e9bdc6d539ad931f97c14c5afbefe38b98e5b9495b0532ac80011e88fc91246a7"}, 0xf0, 0x88006}, {&(0x7f0000000940)={0x27, 0x1, 0x1, 0x5, 0x40, 0x2, "54b71f944ceb581232504715ced2e6780209f2667825262180cfd848ade3b73dadf2e69d9221cce41e3e0c5182587b411072fa3784eb56e4aa6ecebe2b05c6", 0x3f}, 0x60, &(0x7f0000001000)=[{&(0x7f00000009c0)="95d2ca8cb4f5160647ac6d7bca490dfddda20392ba395ba20654ccbaed87556dc75389681fefd6d5203bebf7a74cd8afd6144adddb5573f1e8f8d19675835fcaf0acfb37e018800780e02c69de855fff7e601185ed4d2e000f0965aa217eaecd274856cee4f4213851ffaa4247dd9f9068a72673bb6f239fcbd6f955f0320bbc0ab05aceb0303684edfe5ccf774fd09ac563d72aa6e0842d5a5cfed4", 0x9c}, {&(0x7f00000014c0)="565697b69b81a282e91e6d3187b17e75dcf41d5214edf728612e2eeb2eb918c9127b80795164da3d8312ae9cd9c886a5bb2a995317ec023bd385600417376017d6f99cddc308b637cb4afa375144ce1e3ac6a5734cd2703ebcc273cd9f0f955eb5f9a19ddd59a59525ed3c9646f3fb3e34eb5c7623ba6823780a22430eeaecb94752b6684b69b615aba16bc542c45f9631489800b1445a6aaf247c6452706013bad8af08c15223360ce19cfa0210097b8ad6f122c3102285112f74f69c166d1a3670a0d9129250ae8ab026751d28d2ab8fa8516fe8ca6d20da67b83638cd77c9c4732aeeada2703fadfbc950a57d5770f6b3619ae12232e06b", 0xf9}, {&(0x7f0000000b80)="25ea3c6e0979afefea6b907a87ba5ec5312023fe72fb32230fb23fa12f8a07a1ad2a68a9d80b8ff9c06788d1595aaa42b0dd781601cb09dc0ee7142e674b13bf85689199ec6205ca123510e996be68", 0x4f}, {&(0x7f0000000c00)="272559da45619a04a2778a170fdca069a4a13bad131437306b2967be42d65c002912fc22333acb59ad5cb4ba3a27ef58254b8549b92f5c9bbd7115de83486a306abb918fff9a", 0x46}, {&(0x7f0000000c80)="a9fb49348d9127e29ea382cbf17bf354cc64e7a967bb36", 0x17}, {&(0x7f0000000cc0)="7804b4ce86a1122577cfbe63ea7fa5115ca17ed6b82728cdbe9df0c0e5246af8d87333944bedf2b4de7ce163a57d4073e232b98ed7a142411552b0dd84a5269fd8bd07c903166127a6cd5fc528dc2160a2af997bf9a33a614c12092eab493cec6a8a35dd38999189911f08e7b0cef026ba52010804d377f32f354ae88acaf812803103b42f8b279c30540033e3e83421b226d88d3e1d981b65a8e237d4392b5e4f3a2f70f3b93e43f2bd3c39cc3f7e7bf091e1e33d868b95f749968d1edf819658ff27022f58cc5796a9718f74c93c8d7d9b859ea696316f635613f075fee1761f", 0xe1}, {&(0x7f0000000dc0)="5ed790f775e29a7fca4740b52d6dc3a2d6bfe2f4f68085d25f461d", 0x1b}, {&(0x7f0000000e00)="17c3ec32108fd8b448765095d0c88315e10e741bc7ff62ef01abdaad9e6bbdae40be9c4a60989420a3bfa6c23cae880ce2e4fee9425067bd7aa5203e9860ff4fe07e5aed392243c3a1d070cfa466f852c572a99d7fb56ad642ae209cc580ac8c439cc72de62441b0063d30ba5c5e99772a3bcc7524addeab666d185f548e6c3c6edea6246f38226580f97d8a53dee7834c07fac01f897dbbb5cecd744243a50d3f259a016d41f8a2b8ee5d5ccbb27aad14219322dfb6169d98f6c1f6c8b78d2551c08f8a01b22602d95a4f078bcb079659aa6db2d4fe7d8223dc7c810eea447be9af072c486d4f00"/246, 0xf6}, {&(0x7f0000001240)="e1afefa01bfb8f08c7444d4afa03d220ee770182ca785d2e472f1599ced2ae1148a06391f3fcbde13abbd0d0813a89fd6dd8abaefd4a9d2f60f6b1f17db7376bdc446830fbbc486047b3f35ce1c9ae35e78861df3153fd5ed852b5a637102435db3b0e7ad80303af05fbff5f9a128204baef75b5c399d19c2bd0c64c7307c603944407bd5920bfd8e7b4209a02be9269e2adfacf40cc31b9136db865c3315c44f2bd86f3662a4337e1bc8696dff0c546215aacb481971cc8019efa80d58fc4e47917b02fad2f421c5d3492f7d218aa9f9f2b4cf26dcdaf1da5669ad2e54ce881818befda37bf2906f01ab29de27b020c3d3729ad7d2d6fe6241bdfc95980c03616c6c1a4064609c56581536557183ee5803e985dbbf1cc0a4a4358d4a70c16da5afb8ae56997087b93c914797e4bb900e1d5195c16a59ecf2a5f53d5036274809791162430ca356aa60914c8ac19f432cff3f9537a79a3455b1002642e18fbf91690d2a018a64d70962403e681db3a5b56078586bd2c8a2fea5f52236f09d2924611dde4876839ef0e5cce69c256b4cafb8156fe9db74923e5d6a5d608e859335e26c4a019ed714630845190eb25823ef896b0703f8557b2f05fa332172efda03ce903ffd3bbd01fcdf4f143384ba6950c0f92a051c0c6bf008cf8edb173e18fe61963a52f7e69dc64c08efe8ed6d882898257fcf5304773b3b89105f68946f7ae99247a7adcdc857b258b7b853ed7e235962bcec66dff0fd22a88fcf17d7bc9b4bf6bde5a923942388854cacab29b501be94b2fd7abda8facbe68c980865add808cb0f532", 0x245}], 0x9, &(0x7f00000010c0)=ANY=[@ANYBLOB="80000000000000003a7eaa5aa2c06b8c600c9cb9c520256a91acdc73454dd0e342439a603fcef997605ea0fc6b2f78433e8612dcf00f8f825b87d0ec4033d84d7a726cb921cd9a1bb98e3787a8676052b63623851e5e687feb360696e853614f80952da6c628286bc14a0a63447fec589b86000000000000"], 0x80}], 0x4, 0x80) ioctl$TIOCMBIS(0xffffffffffffffff, 0x5416, &(0x7f0000000000)=0x7) fdatasync(r3) r5 = socket$kcm(0x10, 0x2, 0x0) dup2(r4, r5) [ 238.699934] binder: 13612:13615 unknown command 3 [ 238.715203] binder: 13612:13615 ioctl c0306201 20000280 returned -22 [ 238.744117] binder: 13612:13615 unknown command 3 [ 238.757638] binder: 13612:13615 ioctl c0306201 20000280 returned -22 [ 238.778813] binder: 13619:13622 unknown command 587637731 07:10:25 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/btrfs-control\x00', 0x420000, 0x0) ioctl$DRM_IOCTL_RM_MAP(r2, 0x4028641b, &(0x7f0000000040)={&(0x7f0000ffc000/0x1000)=nil, 0x6, 0x1, 0x92, &(0x7f0000ffc000/0x1000)=nil, 0x4}) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$SCSI_IOCTL_STOP_UNIT(r2, 0x6) r4 = dup3(r0, r1, 0x0) dup2(r4, r3) 07:10:25 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = dup3(r0, r1, 0x0) dup2(r3, r2) ioctl$VHOST_SET_VRING_NUM(r3, 0x4008af10, &(0x7f0000000000)={0x1, 0x401}) 07:10:25 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="086b00004cea7448dcf510cddec1cd33cfb93f43763d49c7812846c2558eb1efd850f10d13262ea3f08695c31144c881228204685c8f3f437e708513d7aa40fd8c3e61788504a49ed2734132dffb3c6d1ef46f0088d3d39e9c2f5dd19f72f058be5f84383dfad50f9970463eb2d02d09"], 0x0, 0x0, 0x0}) r3 = dup2(r2, r1) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)=ANY=[@ANYBLOB="852a74700000000000000000000000000000000000000000852a6873000a0000000000000000000000000000000000008561646600"/80], &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) setsockopt$inet_udp_int(r3, 0x11, 0xb, &(0x7f0000000040)=0x80, 0x4) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$BATADV_CMD_GET_MESH(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={0x0, 0x8}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="38000000100039af00"/20, @ANYRES32=0x0, @ANYBLOB="001500009b0000001800128008000100736974000c00028008000100", @ANYRES32=r6], 0x38}}, 0x0) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000000)={@private2, r6}, 0x14) setsockopt$RDS_GET_MR_FOR_DEST(0xffffffffffffffff, 0x114, 0x7, &(0x7f0000000300)={@xdp={0x2c, 0x1, r6, 0x39}, {&(0x7f00000001c0)=""/7, 0x7}, &(0x7f00000002c0)}, 0xa0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) dup2(r4, r0) [ 238.821945] binder: 13619:13622 ioctl c0306201 20000280 returned -22 [ 238.834543] binder: 13619:13623 ioctl 4188aea7 20000f00 returned -22 [ 238.878683] binder: 13619:13622 unknown command 587637731 [ 238.884546] binder: 13619:13623 ioctl 4188aea7 20000f00 returned -22 [ 238.896264] binder: 13619:13622 ioctl c0306201 20000280 returned -22 [ 238.902423] binder: BINDER_SET_CONTEXT_MGR already set [ 238.919418] binder: 13627:13632 ioctl 40046207 0 returned -16 [ 238.941083] binder: 13627:13632 unknown command 27400 07:10:25 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x2}, 0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffff7}, 0x0, 0x4, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000180)={0x0}, &(0x7f00000001c0)=0xc) prctl$PR_SET_PTRACER(0x59616d61, r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x200, 0x116) perf_event_open(&(0x7f0000000080)={0x5, 0x70, 0xde, 0x91, 0x81, 0x20, 0x0, 0x94, 0x3801, 0x6, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0xd7, 0x0, @perf_bp={&(0x7f0000000040), 0xc}, 0xa000, 0x6, 0x3, 0x9, 0x7, 0x7fff, 0xff2e}, r1, 0x3, r2, 0x1) r3 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) r4 = socket$kcm(0x10, 0x2, 0x0) r5 = socket$kcm(0x10, 0x2, 0x0) dup2(r4, r5) [ 238.961484] binder: 13627:13632 ioctl c0306201 20000200 returned -22 [ 238.992037] binder: BINDER_SET_CONTEXT_MGR already set [ 239.020917] binder: 13627:13643 ioctl 40046207 0 returned -16 [ 239.057969] binder: BINDER_SET_CONTEXT_MGR already set [ 239.063932] binder: 13627:13643 unknown command 27400 07:10:25 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nvram\x00', 0x10500, 0x0) ioctl$VHOST_GET_VRING_BASE(r0, 0xc008af12, &(0x7f0000000040)) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) dup3(r1, r2, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) dup2(r1, r3) [ 239.069398] binder: 13627:13632 ioctl 40046207 0 returned -16 [ 239.072319] binder: BINDER_SET_CONTEXT_MGR already set [ 239.087316] binder: 13627:13643 ioctl c0306201 20000200 returned -22 [ 239.103884] binder: 13627:13652 ioctl 40046207 0 returned -16 07:10:25 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_KEY_STATUS(r2, 0xc080661a, &(0x7f0000000000)={{0x3, 0x0, @descriptor="6eecde383766206c"}}) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) openat$uhid(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uhid\x00', 0x2, 0x0) r4 = dup3(r0, r1, 0x0) dup2(r4, r3) 07:10:25 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x800) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="07630440"], 0x0, 0x0, 0x0}) 07:10:25 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r4 = dup2(r3, r2) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$LOOP_CLR_FD(r4, 0x4c01) r5 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r6 = dup3(r0, r1, 0x0) dup2(r6, r5) [ 239.374840] binder_alloc: 13679: binder_alloc_buf, no vma [ 239.382926] binder: 13679:13681 ioctl 4c01 0 returned -22 07:10:25 executing program 4: setxattr$security_ima(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='security.ima\x00', &(0x7f0000000340)=ANY=[@ANYBLOB="b3423103ed633147c0cfed8b272917f90592d8b34bae45a452136ff75bab4c866542349b88bf0800000000000000dfdb27e8e8b73a36f3000000006fa83bbc18bde949b8fc8269e324d2ddbf03c6be715b9467077011d7d9caa5b2f8aa1d344eae70e0010022d94205d90286356675b626e8a2f174b2e6576f6e34b9b8f6400f56b80a24ec6047549bca6ac8b2e2f8"], 0x15, 0x1) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000240)=ANY=[], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="b8f05bc35491f9a348e600000000000000daeffc6eabbd677e3cbd57"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180)='nl80211\x00') socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) r6 = dup(0xffffffffffffffff) getpeername$packet(r6, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0xa) sendmsg$NL80211_CMD_GET_WIPHY(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x1c, r5, 0x321, 0x0, 0x0, {}, [@NL80211_ATTR_IFINDEX={0x8, 0x3, r7}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_SET_BEACON(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x14, r5, 0x400, 0x70bd25, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x84}, 0x4000000) [ 239.474080] binder_alloc: 13679: binder_alloc_buf, no vma [ 239.479792] binder: 13679:13681 ioctl 4c01 0 returned -22 07:10:25 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r4 = dup2(r3, r2) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$SNDCTL_DSP_GETTRIGGER(r4, 0x80045010, &(0x7f0000000000)) r5 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r6 = dup3(r0, r1, 0x0) dup2(r6, r5) 07:10:25 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = dup3(r0, r1, 0x0) dup2(r3, r2) r4 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$sock_bt_cmtp_CMTPCONNADD(r4, 0x400443c8, &(0x7f0000000040)={r3, 0x100}) [ 239.605510] binder: 13694:13696 unknown command 0 [ 239.619287] binder: 13694:13696 ioctl c0306201 20000140 returned -22 [ 239.637888] binder_alloc: 13693: binder_alloc_buf, no vma [ 239.662513] binder: 13694:13703 unknown command 20 [ 239.668752] binder: 13693:13695 ioctl 80045010 20000000 returned -22 [ 239.677887] binder: 13694:13703 ioctl c0306201 20000140 returned -22 07:10:26 executing program 1: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0xd5, 0x80, 0x0, 0x0, 0x0, 0x0, 0x900, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x2, 0x1000, 0x6, 0x0, 0x40000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = dup3(r0, r1, 0x0) dup2(r3, r2) [ 239.818074] binder: 13693:13695 ioctl 80045010 20000000 returned -22 07:10:26 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, @perf_config_ext={0x800, 0x100000001}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = dup3(r0, r1, 0x0) dup2(r3, r2) 07:10:26 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = dup3(r0, r1, 0x0) dup2(r3, r2) 07:10:26 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = dup3(r0, r1, 0x0) dup2(r3, r2) r4 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r6 = dup2(r5, r4) ioctl$BINDER_SET_CONTEXT_MGR(r6, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) getsockopt$packet_int(r6, 0x107, 0x11, &(0x7f0000000000), &(0x7f0000000040)=0x4) [ 240.242073] binder_alloc: 13748: binder_alloc_buf, no vma 07:10:26 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f0000000000)={0x0, 'wg0\x00', {0x1}, 0x3}) perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r4 = dup2(r3, r2) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000340)={@flat=@binder={0x70742a85}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0), 0x0, 0x1, 0x1a}, @fda={0x66646185, 0x0, 0x0, 0xfffffffffffffffe}}, &(0x7f0000000080)={0x0, 0x18, 0x40}}}], 0x0, 0x73b000, 0x0}) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r4, 0xc0105303, &(0x7f00000000c0)={0x9, 0x0, 0x1f}) r5 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f00000005c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000440)=ANY=[@ANYBLOB="852a74700000000000f7ffffffffffffff00000000000000852a687300000000000000000080000000000000003252d60838293100000085616466000000000000000000000000000009000000000000227669f45f45c298fa44680436a350693a2ed4d497cbe171fea06f2546988bfbfc0d2e526b49214c893e8982fb341019d69702e59d159adec4fa991664989dabdc5cf778d3a472ce28f73b4bf876476abacf639d3dc5ecb6a200a92191883a57549ef2b790a2e10c97748e"], &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) sendmsg$can_raw(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f00000001c0), 0x10, &(0x7f0000000300)={&(0x7f00000002c0)=@can={{0x0, 0x0, 0x1, 0x1}, 0x7, 0x1, 0x0, 0x0, "0699b6c5c3bb84c6"}, 0x10}, 0x1, 0x0, 0x0, 0x40800}, 0x480d0) r7 = dup3(r1, r5, 0x0) dup2(r7, r6) [ 240.297082] binder: BINDER_SET_CONTEXT_MGR already set [ 240.305810] binder: 13748:13755 ioctl 40046207 0 returned -16 07:10:26 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = dup2(r2, r1) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) r6 = dup3(r0, r4, 0x0) dup2(r6, r5) [ 240.367436] binder_alloc: 13761: binder_alloc_buf, no vma [ 240.384704] binder: 13761:13762 ioctl c0105303 200000c0 returned -22 [ 240.470190] binder: BINDER_SET_CONTEXT_MGR already set [ 240.478934] binder_alloc: 13770: binder_alloc_buf, no vma [ 240.481432] binder: 13761:13771 ioctl 40046207 0 returned -16 [ 240.491903] binder: 13770:13772 ioctl ae01 0 returned -22 [ 240.509204] binder_alloc: 13770: binder_alloc_buf, no vma [ 240.511917] binder: 13761:13769 ioctl c0105303 200000c0 returned -22 [ 240.515129] binder: 13770:13773 ioctl ae01 0 returned -22 07:10:26 executing program 0: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000000, 0x6}, 0x1a08}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r5 = dup2(r4, r3) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000780)=ANY=[@ANYRES16=r3, @ANYRES16=r0, @ANYRESDEC=r6, @ANYRES16=r1, @ANYRESHEX, @ANYBLOB="03b2921131105837ce1e78bd8ec9990eaea69fb276f93f938d5c32ad0dd7e1b5ae3786034b306b19c41361ed24ca6ba66bc3c6826e367e4ead52e5a7b2fddc0ec380fbc2d08c37e028a518c4ed6f58f1bcf720247d94e17e20e097070f83b4ad047f1f614991a9a3a9fa00000000", @ANYBLOB="ec0ca5739aeec2b7310284656df78362b9be189aad34b7d918ba7076a0e7e90df780191ac1f5e2a5520c3bde69035c65a6a97ca7f91327dedfbd56563b35ac239d2844a420c764492b6d8f3754508a85a1ffa400bbe48ded5ce05113a2dd8fab1eacfd443b9b2199eb107ee49444edee3c4b26e46e99f439da3b00a2b5fb5468b11ed71a4930d89907d95a785964bd6fed27ec75709a2d4f87beddd7b0c36ddff6e8ddce95f002681b473153fb00ce6a0684c2a869f57655e5763d6e65882236cf08c03d1fa2a374816ffcdc3902cae11290dc4f57b88dc9f50a18ae0845ad8af56468daf3a3f60884f75e243a3736fc92fb0be814adc195b8247e8041364d113980a0b37d0807a6ae482ec6e40b62542de375f76b88f676d8ec14d461e940bd"], 0x4c, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000540), 0x0, 0x73b000, 0x0}) write$UHID_GET_REPORT_REPLY(r5, &(0x7f0000000000)={0xa, {0x4, 0x0, 0x7f}}, 0xa) r7 = dup3(r0, r1, 0x0) dup2(r7, r2) r8 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vcsa\x00', 0x101000, 0x0) r9 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000300)='NLBL_CIPSOv4\x00') sendmsg$NLBL_CIPSOV4_C_LIST(r8, &(0x7f0000000440)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000400)={&(0x7f0000000340)={0xa0, r9, 0x8, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}, @NLBL_CIPSOV4_A_MLSCATLST={0x54, 0xc, 0x0, 0x1, [{0x2c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x9301}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x7d5b9f6c}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x7154}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xd857}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x2f42510e}]}, {0x24, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x73ee}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x14db099}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x61d1224f}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x5817f3b6}]}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}, @NLBL_CIPSOV4_A_MLSCATLST={0x20, 0xc, 0x0, 0x1, [{0x1c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xf56b}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x7942}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x56c4e682}]}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x3}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4}, 0x800) [ 240.678550] binder: 13781:13783 unknown command 262151 [ 240.684047] binder: 13781:13783 ioctl c0306201 20000280 returned -22 07:10:27 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = dup3(r0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r5 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) r6 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000000080)={0x2, [0x0, 0x0]}, &(0x7f0000a8a000)=0xc) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r6, 0x84, 0x6c, &(0x7f000059aff8)={r7}, &(0x7f000034f000)=0x2059b000) setsockopt$inet_sctp6_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000a40)=@assoc_value={r7}, 0x8) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r5, 0x84, 0x6c, &(0x7f0000000180)={r7, 0x83, "f639a358c80b73067417ef68cbdc50e3b4504b368853da7589345c08c413d62d0a3f5b1aa93e65f13239412757fa922639041b0c8f3480517ffe252238238d0ba8fc13aad19fc41284d73602bc39e8f81034ad2c8378ffba0803c6fe2e13f7dc2fe33fb5736ac8942dae6c95153d3de73a19d16a95614afb3f70fdc76a46f04128be73"}, &(0x7f0000000000)=0x8b) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000040)={r8, 0x5}, 0x8) dup2(r3, r2) 07:10:27 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = dup3(r0, r1, 0x0) dup2(r3, r2) r4 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r6 = dup2(r5, r4) ioctl$BINDER_SET_CONTEXT_MGR(r6, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$SIOCRSGCAUSE(r6, 0x89e0, &(0x7f0000000000)) [ 240.934949] binder_alloc: 13800: binder_alloc_buf, no vma [ 240.948367] binder: 13800:13802 ioctl 89e0 20000000 returned -22 [ 241.017546] binder: BINDER_SET_CONTEXT_MGR already set [ 241.023391] binder: 13800:13802 ioctl 40046207 0 returned -16 [ 241.023431] binder: 13800:13815 ioctl 89e0 20000000 returned -22 07:10:27 executing program 1: r0 = perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x1}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = dup3(0xffffffffffffffff, r1, 0x0) dup2(r3, r2) r4 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="05d404876655f603f8847d"], 0x0, 0x0, 0x0}) r6 = dup2(r5, r4) ioctl$BINDER_SET_CONTEXT_MGR(r6, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="f3dc91fa"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) r7 = socket$kcm(0x10, 0x2, 0x0) fsetxattr$security_capability(r0, &(0x7f0000000340)='security.capability\x00', &(0x7f0000000400)=@v3={0x3000000, [{0xcf, 0x3}, {0x0, 0x7fc0000}]}, 0x18, 0x2) sendmsg$kcm(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) fsetxattr$trusted_overlay_nlink(0xffffffffffffffff, &(0x7f0000000380)='trusted.overlay.nlink\x00', &(0x7f00000003c0)={'L-'}, 0x16, 0x1) r8 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) ioctl$sock_bt_hidp_HIDPCONNADD(r6, 0x400448c8, &(0x7f0000000280)={r7, r8, 0x8, 0xfa, &(0x7f0000000180)="813a4fefe1ea6537bd3c0112944afa11ce7c91f1ed1558226abac792c9028ea63fe1b18b9f070af2d043db6b69d0341cc49001385807eeeb4c0d8e0c3b13bb5b4b3db329fecbab0bf025521e3be7a310e5ba03ce64a404a938f476c81a6fdc0ee272ffb0a1f51e45b88bf8132a2f5026d9b6a0337562e68e07f729e5a1af164f9e059e7927d40f910d30a27f34f91308dffb7d724885cc75b0cb8f691aa34d6ebabd14c7501635cdbfb8537eeaaa934a7729309dfa07d68ea3d84e1d0295df1dcf7b69437c65fe71176743a098e068ae45949013ae31f5ddb40284b301a1271ac627411e1915bc9d60fbbba3aeecdc7e0bf938c629a745e22f57", 0x3, 0x3, 0x3, 0x631c, 0x80, 0x2, 0x10000, 'syz0\x00'}) [ 241.246504] binder: 13820:13821 unknown command -2029726715 [ 241.262268] binder: 13820:13821 ioctl c0306201 20000200 returned -22 [ 241.270120] binder: 13820:13821 unknown command -91104013 [ 241.281448] binder: 13820:13821 ioctl c0306201 20000280 returned -22 [ 241.291154] binder: 13820:13821 ioctl 400448c8 20000280 returned -22 [ 241.304811] binder: 13820:13822 unknown command -2029726715 [ 241.310702] binder: 13820:13822 ioctl c0306201 20000200 returned -22 [ 241.323367] binder: 13820:13821 unknown command -91104013 [ 241.329162] binder: 13820:13821 ioctl c0306201 20000280 returned -22 07:10:27 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = dup3(r0, r1, 0x0) dup2(r3, r2) r4 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/btrfs-control\x00', 0x200, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180)='nl80211\x00') socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = dup(r7) getpeername$packet(r8, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0xa) sendmsg$NL80211_CMD_GET_WIPHY(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x1c, r6, 0x321, 0x0, 0x0, {}, [@NL80211_ATTR_IFINDEX={0x8, 0x3, r9}]}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_SET_BEACON(r4, &(0x7f0000000a40)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000000c0)={&(0x7f0000000180)={0x8b0, r6, 0x400, 0x70bd2d, 0x25dfdbfd, {}, [@NL80211_ATTR_IE_RIC={0x374, 0xb2, "742b994af01595b3db28215c6f1ebca8d167f800b6bf87bbfca9439e6927ca14b97e703b667799d876427d53faba6d3ad5f12cec5c1de1923666bed9fc966ccf325c82ba636c6c7d6fad3933273c25b7b240f086d3c33ef4c8a8a7440f25f29c8ecd9d1cdfa9ea8916c5c7965725f03fda0f746650370958fa77eb91bf36496ca00588382464ca3436b3e8a6258aefca8cf81a4a6536a13abee27025e8ae5105ebe10c1ad757db5d0d612e7d8ff3706f6c1f0b13af1b25a826a3b4c71a981ebb1df026a75441f18f436e7409621f23fad66dff91f9707f7c614286b802136d4ddd9484d793746f6c5a01b5d229ea583ccdcef50760fcd8f1d63a8d076236eec36da7086f1442c478c90d49b0be5751793cb52edfb3e26f922b4fb61227b9d6fb346cab282b28e6dbd24f196f2e2c035e7bc78193279bbaec3277deb89173ffb038a3b3b0379a4c873aaebae80feaafc09b4e93211651d9f1af29f7dba3f48684ed5d1a353070b7e4d3dca32b8324e29e95b0049d321e9c8e0f1de179878f07e8cd28599c52feb1ed2e151e13b9bef20500502752ee4ea185e1b2458e2e42b6fd60aa1dd6fadd363e9092d3252c922c36c7b37dc0699f1a59be5b78b9a1cfb62c9b2b669248129e82d933f4c2fcc7a0ff61879f62fb35b4cb5cb23f4cb516ffd6d726c520b6ce325d9f334547c8dd9935764188a0d0875fc2945650cdeb34a63fd3dedda388a4d9d9b38d54b179bacf98b55c754f8f2bee7c1215d9a951eac43be57cfdca6587e34f12fa6cb05d936da73adc6ecbb4ed6bd3502e9a7c352019c05259af12c05e1b3b9a54ddf0899c5cb6d135e2088774c1af3873329701f30b24ec35988437ac04b419d08566fa609d58ebe65ed1f5b72cb48e167b0c524d399b1c05ec6a14cbf713d18c70dc34f4c9dddafa14b6b93491e854ecee1ba9258e2461820a8bbf5bcc11321ae56cca54fa683e5031f19939d2fee638d6e24b1f2ebb0365cf5d6a5429311f85f2cfdf920f913b0f91b6ca516a99f9c5c4b3f946334105eabfc3c6c569eb7e455964d6a4e18bcef1702a575808f1400f582ef51ae38517825c60f7ace46c23c2d4dfc15ca3135fdef28cbfae4cff7c68556e4a9775ec88db03ca9181ba31eb861f3cc974e49ba8e50ef63ae503459198b26ec3cbe14b3bbfb30240235ac5d40501c4678e5de68f48610f0f984ff276275c3f267860ca5ed9a4f64a4bec8abd8124f1ef526d48"}, @NL80211_ATTR_CIPHER_SUITES_PAIRWISE={0xc, 0x49, [0xfac05, 0xfac08]}, @NL80211_ATTR_FTM_RESPONDER={0x10c, 0x10e, 0x0, 0x1, [@NL80211_FTM_RESP_ATTR_LCI={0xfd, 0x2, "dc93fe03a786a93856acb4639e981306cfb8298aaf44015034a502808eab4b5105bbcb960ed5fd0658e52973f4a421dc984c7b3a29f6896151d8e8c658866162511da5db8a635a062dbdc36c0802017b06e3384f01ff795ee67bddb995abe4b57b3f99ae18d87d72eb4b34912c3cae12674b4b9dc3d387a78ca14136ecc86b078e969983133585c12150ab389543c5ff1205a3c89b7c76af77883e3ec5713a9e5e302633702a5136ea97d774273dfeff464c17e42ad2d452c84abbc16d06c4c56c42a379d7df7b4b5d01578dc36084899fe6ef1b24d3edf80ece30c56cece9b4e871037fcad9d6faf5101526d329342138c8ffa0962b75dbb3"}, @NL80211_FTM_RESP_ATTR_ENABLED={0x4}, @NL80211_FTM_RESP_ATTR_ENABLED={0x4}]}, @NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, 0x101}, @NL80211_ATTR_TWT_RESPONDER={0x4}, @NL80211_ATTR_BEACON_HEAD={0x3e9, 0xe, "527e679fce9eacea7638629632bf12b5f33fc9a6d6f1117dd15f0c79dbcee14d664cc08ff1e9feaac4ce24297b198e05acbc5697b6a840c9dac8587217cd721ab4c4c0de336e28c455d7ce4b6518476393869c3381a30010acb69cb8fb09de797d6682309edca1f5df9167dd62a4da8d7dd15af580a5efdc541108f2ad1929442529ba6b5b08bf09c44ed07c3b8c09f729ebf7232398692c9cc134eb04c46931ca5c3d8fa978335419ad32985e1cce5e83b2d106d4952fe218dae92358306e0c09b1f004944a9c212d0fb7f8ac9700e8ee6bd439236d70e299f12a9ebbb5dc6ab485bfd3f4e9c04e3538d2ce1f5fd79087e9dddf440c21d9b3566235a3e7d12983e82f628c4a2739a6476e22c0f1c214817adaa7c646ff774850dd59e07eac9c727563bb95295e5a56ec7359e0820d1152362f6dafc245d06e5bdeae2258ac8d09544200d00c54f42c79606c79e6859ca46309c12e67142b45e3831a9d6ad413faa25c9a39da892a83a15abe9494565ab3a75d0b91f0b489bb3818c83fb3c27f690734b4fcad62b3485c14096eb3fc6293272834ca42839cc25afab532b7cca2a642c475960fe39ebec9fee2fd6b0fb4ce8e30c536351a748a05769d9fecb267e196e757c7f6e5da1bad1daf236a3612d4a52d66b30cd3db60f380f2960ac7271b5e96266f0e044856c12f299d0101f44fdf589325bc347c10a33f97938ca27a095fc9582ba10e796677b6e6bf43cdc045a8bc1c5b9a1858fe123358d6a963c5934b54b1a1bc57149e1c79117b1946ac3c09a0d99649b7b11e2ed1ed2d2b785e3dc3b771ad3d3adc7fa2bea22587078fbaa779feca222353023f2bb9df9bf1d81a0c03d760db518a63a879b5daaf20c852c348328b4b575b89901a368c75e1bca674374ef5909a7858e06194e1ceb96f3bc09eea5c3c773d7ba1cf2bd7e1ceb12653055ba3f306d87491a65fce791b602943754618961f90545a81faecdce58d1a50becfa1d82bfa06f1e3d9427a7a30383b8c68fcb7d339eb23a0cac94dae5c3b8f11896e72159729316fbc7fa002f1121382babed93aa10a8aad33ed0733cc518c6e010c58104e2a433b9db462ea252ddb659dee5a842654509b0f172e4fd77235ac5066f8bb4667b60adfefd79251316885771e129ef106c8ba35c65783fb31fcdc95c35798eceaf1fcf14d04bc00481aa2fb7ecf16ed33e1d8628af7b08a78e90a0549f15cc99a7161ecaba1af7253f5b4c91e60529ada41015a33874c923db67ede5ce9a5ae47fdeafbb8998633f2d6e1e7103b6009d4368e84ec8e5bc3c37ec06ef7b031a3b7dc0e48125c7d7214301533c3b71e4bbcf7ab43caa38c150285ddaf20a1c1a332af19158e42369834775c4fc05661e7321fba238d04f9e3376df08915"}, @NL80211_ATTR_P2P_OPPPS={0x5, 0xa3, 0x1}, @NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, 0x4bd5}, @NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, 0x8}]}, 0x8b0}, 0x1, 0x0, 0x0, 0x4}, 0x40) 07:10:27 executing program 5: r0 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x4, 0x20000000007ffd, 0x7c, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100]}, 0x2c) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$BATADV_CMD_GET_MESH(r3, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={0x0, 0x8}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB='\x00', @ANYRES32=0x0, @ANYBLOB="001500009b0000001800128008000100736974000c00028008000100", @ANYRES32=r4], 0x38}}, 0x0) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x15, &(0x7f0000000000)={@private0, r4}, 0x14) ioctl$sock_inet6_SIOCSIFDSTADDR(r1, 0x8918, &(0x7f00000000c0)={@empty, 0x66, r4}) r5 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x1000) delete_module(&(0x7f0000000080)='(@]([\x00', 0x200) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r0, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096}, 0x20) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r6 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r6, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$DRM_IOCTL_AGP_ALLOC(r5, 0xc0206434, &(0x7f0000000140)={0xf5, 0x0, 0x10000, 0x7}) ioctl$DRM_IOCTL_AGP_UNBIND(r6, 0x40106437, &(0x7f0000000180)={r7, 0x2}) 07:10:27 executing program 2: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x400, 0x2}, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) r1 = socket$kcm(0x10, 0x2, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) dup2(r1, r2) r3 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) r5 = socket$kcm(0x10, 0x2, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYRES32=r5], 0xffffffffffffffe3, 0x0, 0x0}) r6 = dup2(r4, r3) ioctl$BINDER_SET_CONTEXT_MGR(r6, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="f8ec7f4881222a0e25bae6031cea16e496fa7880663f33f08006b007e0872203d4f11e1dea57bee746fe7f92a679408af64c635480cab57445cf84e5996d58034950b91ed28eeb969ec479ae1bd949bc99b049872766fd02744681ba9e7cd5af8ce289a83f63e83ecf95060692ee72b6ad1e563997b809667ccc8c49f106efc4056341d4248f68ab7c60d2f24fed8fe73d2691a800129b6d10705145ab75b04b09993f7cedcca66be60786eb30ef6073add8bd411ada31a8a397bfb806e4fa92d5615cc88ed2c9ab61a33f0045264500d88a6ee6d4b3"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) r7 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000009c0)='/dev/loop-control\x00', 0x0, 0x0) r8 = ioctl$LOOP_CTL_GET_FREE(r7, 0x4c82) ioctl$LOOP_CTL_REMOVE(r7, 0x4c81, r8) ioctl$LOOP_CTL_ADD(r0, 0x4c80, r8) ioctl$RTC_VL_CLR(r6, 0x7014) [ 241.489714] binder: 13830:13833 unknown command 8 [ 241.511312] binder: 13830:13833 ioctl c0306201 20000200 returned -22 [ 241.540303] binder: 13830:13837 unknown command 1216343288 07:10:27 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x4) r3 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r5 = dup2(r4, r3) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$NBD_DO_IT(r5, 0xab03) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x1000, 0x1d38, r5}) r6 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r7 = dup3(r0, r1, 0x0) dup2(r7, r6) 07:10:27 executing program 5: r0 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x4, 0x20000000007ffd, 0x7c, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100]}, 0x2c) r1 = socket$inet6(0xa, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r2 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendto$inet(r2, &(0x7f0000fa3fff)='\t', 0x1, 0x0, &(0x7f00006f7000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000000080)=ANY=[@ANYBLOB="02f8ff00", @ANYRES32=0x0, @ANYRES32=0x0], &(0x7f0000a8a000)=0xc) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r2, 0x84, 0x6c, &(0x7f000059aff8)={r3}, &(0x7f000034f000)=0x2059b000) setsockopt$inet_sctp6_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000a40)=@assoc_value={r3}, 0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x1f, &(0x7f0000000080)={r3, @in6={{0xa, 0x4e21, 0xb1a8, @private1, 0x8}}, 0x4, 0x81}, 0x90) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r0, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096}, 0x20) r4 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r6 = dup2(r5, r4) ioctl$BINDER_SET_CONTEXT_MGR(r6, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$PPPIOCGFLAGS(r6, 0x8004745a, &(0x7f0000000140)) [ 241.561902] binder: 13830:13837 ioctl c0306201 20000280 returned -22 [ 241.641265] binder: 13830:13837 ioctl 7014 0 returned -22 [ 241.685014] binder_alloc: 13844: binder_alloc_buf, no vma [ 241.693364] binder: 13844:13845 ioctl 8004745a 20000140 returned -22 07:10:28 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$vimc1(0xffffffffffffff9c, &(0x7f0000000300)='/dev/video1\x00', 0x2, 0x0) ioctl$VIDIOC_G_AUDOUT(r1, 0x80345631, &(0x7f0000000340)) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="000000009a2c1d1c13cb4c82b90ec8dbd6a80613d50000000000000000000000967b7288271fc5c7514a7302ffb2ed5326638e4bf67d754e3446f46fbc6dbefe01b40ebc6e23bda81ece927c0462877399d09989a39958c51fc22402e114f069096e6b6ddcd43c9ac4bf612b006db53f0bfb03cab348947ac86d6f8532d9c88188f008301acbe0e52e4383fc37b38c27873d862f88d2785ab96b04c44e9d3ec2c36f55"], 0x0, 0x0, 0x0}) r3 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) r5 = dup2(r4, r3) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) r6 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040)='NLBL_MGMT\x00') sendmsg$NLBL_MGMT_C_LISTALL(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0x34, r6, 0x8, 0x70bd2c, 0x0, {}, [@NLBL_MGMT_A_DOMAIN={0x15, 0x1, 'posix_acl_access\x00'}, @NLBL_MGMT_A_IPV4MASK={0x8}]}, 0x34}}, 0x0) sendmsg$NLBL_MGMT_C_REMOVEDEF(r5, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x98, r6, 0x400, 0x70bd2b, 0x25dfdbfc, {}, [@NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @local}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @mcast1}, @NLBL_MGMT_A_CLPDOI={0x8, 0xc, 0x3}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @private0}, @NLBL_MGMT_A_DOMAIN={0x11, 0x1, '/dev/binder#\x00'}, @NLBL_MGMT_A_CLPDOI={0x8, 0xc, 0x1}, @NLBL_MGMT_A_CV4DOI={0x8}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @initdev={0xfe, 0x88, [], 0x1, 0x0}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4040004}, 0x44) r7 = dup2(r2, r0) ioctl$IOC_PR_PREEMPT(r7, 0x401870cb, &(0x7f0000000080)={0x100000000, 0x0, 0x4, 0x7f}) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="07630440"], 0x0, 0x0, 0x0}) 07:10:28 executing program 5: r0 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000080)={0xa, 0x0, 0x8002, 0x7c, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100]}, 0x40) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r0, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096}, 0x20) [ 241.746082] binder_alloc: 13844: binder_alloc_buf, no vma [ 241.751751] binder: 13844:13849 ioctl 8004745a 20000140 returned -22 [ 241.760520] binder: 13830:13837 unknown command 8 [ 241.768920] binder: 13830:13837 ioctl c0306201 20000200 returned -22 [ 241.819402] binder: 13830:13833 unknown command 1216343288 [ 241.823186] binder: BINDER_SET_CONTEXT_MGR already set [ 241.828007] binder: 13830:13833 ioctl c0306201 20000280 returned -22 [ 241.834333] binder: 13850:13851 ioctl 40046207 0 returned -16 07:10:28 executing program 5: r0 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x4, 0x20000000007ffd, 0x7c, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100]}, 0x2c) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r0, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096}, 0x20) r3 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r5 = dup2(r4, r3) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$sock_inet6_tcp_SIOCOUTQ(r5, 0x5411, &(0x7f0000000080)) [ 241.860168] binder: 13853:13859 unknown command 0 [ 241.867201] binder: 13850:13851 ioctl ab03 0 returned -22 [ 241.886370] binder: 13853:13859 ioctl c0306201 20000200 returned -22 [ 241.910897] binder: BINDER_SET_CONTEXT_MGR already set [ 241.925934] binder: 13853:13859 ioctl 40046207 0 returned -16 [ 241.945721] binder: BINDER_SET_CONTEXT_MGR already set 07:10:28 executing program 2: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) r1 = fcntl$getown(r0, 0x9) perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x7}, r1, 0x0, 0xffffffffffffffff, 0x0) r2 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0xfffffffffffffd02, 0x0, 0x0, 0x0, 0x73b000, 0x0}) setxattr$security_selinux(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='security.selinux\x00', &(0x7f00000001c0)='system_u:object_r:crond_unit_file_t:s0\x00', 0x27, 0x4) r3 = socket$kcm(0x10, 0x2, 0x0) r4 = socket$kcm(0x10, 0x2, 0x0) dup2(r3, r4) [ 242.003021] binder_alloc: 13850: binder_alloc_buf, no vma [ 242.004158] binder: 13853:13859 ioctl 40046207 0 returned -16 [ 242.008816] binder: 13850:13865 ioctl ab03 0 returned -22 [ 242.035218] binder: 13853:13863 ioctl 401870cb 20000080 returned -22 07:10:28 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={0xffffffffffffffff, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096}, 0x20) 07:10:28 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="07630440"], 0x0, 0x0, 0x0}) [ 242.062251] binder: BINDER_SET_CONTEXT_MGR already set [ 242.068771] binder: 13853:13859 unknown command 0 [ 242.073991] binder: 13853:13863 ioctl 40046207 0 returned -16 [ 242.094289] binder: 13853:13873 ioctl 401870cb 20000080 returned -22 [ 242.102101] binder: 13853:13859 ioctl c0306201 20000200 returned -22 07:10:28 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext={0x2, 0x4}, 0x0, 0x0, 0x0, 0x4}, 0x0, 0x2, 0xffffffffffffffff, 0x1a) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) r3 = dup3(r0, r1, 0x0) r4 = dup2(r3, r2) r5 = shmget$private(0x0, 0x2000, 0x1, &(0x7f0000ffd000/0x2000)=nil) r6 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r6, 0x40046207, 0x0) r7 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r8 = dup2(r7, r6) ioctl$BINDER_SET_CONTEXT_MGR(r8, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r8, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r8, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) sendmsg$NFNL_MSG_CTHELPER_GET(r8, &(0x7f0000000280)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000180)={0xd4, 0x1, 0x9, 0x401, 0x0, 0x0, {0x2, 0x0, 0x1}, [@NFCTH_NAME={0x9, 0x1, 'syz0\x00'}, @NFCTH_POLICY={0xc, 0x4, 0x0, 0x1, {0x8, 0x1, 0x1, 0x0, 0xfffff196}}, @NFCTH_QUEUE_NUM={0x8, 0x3, 0x1, 0x0, 0x40}, @NFCTH_STATUS={0x8, 0x6, 0x1, 0x0, 0x1}, @NFCTH_TUPLE={0x98, 0x2, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x6}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @initdev={0xac, 0x1e, 0x1, 0x0}}, {0x8, 0x2, @remote}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x21}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @ipv4={[], [], @multicast2}}, {0x14, 0x4, @local}}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @private=0xa010102}, {0x8, 0x2, @local}}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @empty}, {0x8, 0x2, @broadcast}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x84}}]}]}, 0xd4}, 0x1, 0x0, 0x0, 0x880}, 0x0) shmat(r5, &(0x7f0000ffd000/0x3000)=nil, 0x0) ioctl$USBDEVFS_RELEASEINTERFACE(r4, 0x80045510, &(0x7f0000000000)=0x81) 07:10:28 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$EVIOCSABS20(r2, 0x401845e0, &(0x7f0000000000)={0x8, 0xffff, 0x9, 0x2, 0x200, 0x761f}) r3 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) r4 = socket$kcm(0x10, 0x2, 0x0) r5 = socket$kcm(0x10, 0x2, 0x0) dup2(r4, r5) 07:10:28 executing program 5: fsetxattr$trusted_overlay_origin(0xffffffffffffffff, &(0x7f0000000080)='trusted.overlay.origin\x00', &(0x7f00000000c0)='y\x00', 0x2, 0x0) r0 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x4, 0x20000000007ffd, 0x7c, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100]}, 0x2c) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = dup(r1) r3 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r5 = dup2(r4, r3) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f00000000c0)={@flat=@handle={0x73682a85, 0x0, 0x1}, @flat=@handle, @fda={0x66646185, 0x5}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) ioctl$EVIOCSABS20(r5, 0x401845e0, &(0x7f0000000100)={0x9, 0x4, 0x1, 0x1, 0x2, 0x261}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r0, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096}, 0x20) 07:10:28 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="07630440"], 0x0, 0x0, 0x0}) r3 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="056304407032fb59e4ec07ca7a0520ab1512796cb5cffe271a99e389af3c844845030c2dd4937cd03d842cccfc5ac88f4341bbd4a3639fbfd49fc8b65be4"], 0x0, 0x0, 0x0}) r5 = dup2(r4, r3) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="76b3eeb1042357d7c4fe9f2bc849bcfb5562334a1d2ff7b4564f96b3ebf2fcb8e4f902ab4767183632884f828fc896c3fda038dd3f0be28145125db6d35ed7b7a4c74319db2867d7e6c606403020c92d4555a49fce841d8267fe00e501a4d81c81b109c15419eea532d4f236"], 0x0, 0x0, 0x0}) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f00000002c0)={@fda={0x66646185, 0xa, 0x1, 0x22}, @flat=@weak_handle={0x77682a85, 0x101e, 0x3}, @fda={0x66646185, 0xa}}, &(0x7f0000000080)={0x0, 0x20, 0x38}}}], 0x0, 0x73b000, 0x0}) setsockopt$inet_sctp_SCTP_ADAPTATION_LAYER(r5, 0x84, 0x7, &(0x7f0000000080)={0x2}, 0x4) [ 242.258097] binder_alloc: 13887: binder_alloc_buf, no vma [ 242.283493] binder: 13887:13891 ioctl 401845e0 20000000 returned -22 [ 242.291648] binder_alloc: 13884: binder_alloc_buf, no vma [ 242.299253] binder_alloc: 13888: binder_alloc_buf, no vma [ 242.318985] binder: 13888:13894 ioctl 401845e0 20000100 returned -22 [ 242.326805] binder_alloc: 13887: binder_alloc_buf, no vma [ 242.347366] binder: 13887:13891 ioctl 401845e0 20000000 returned -22 [ 242.350696] binder: 13884:13898 ioctl c0306201 20000240 returned -14 07:10:28 executing program 2: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20220, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x9}, 0x0, 0xe, 0xffffffffffffffff, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) open(&(0x7f0000000000)='./file0\x00', 0x0, 0xd2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000180)={0x0}, &(0x7f00000001c0)=0xc) prctl$PR_SET_PTRACER(0x59616d61, r2) ptrace$poke(0x4, r2, &(0x7f0000000040), 0xffffffffffff0000) r3 = socket$kcm(0x10, 0x2, 0x0) r4 = socket$kcm(0x10, 0x2, 0x0) dup2(r3, r4) r5 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) r6 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r7 = dup2(r6, r5) ioctl$BINDER_SET_CONTEXT_MGR(r7, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="f285695753bf53b59ba6a3f028444bdfe749db85da11f8d9740bac53877687e698c58607db48f5"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x2400, 0xfffffffffffffffd) [ 242.408434] binder: 13900:13906 unknown command -1309756554 [ 242.432668] binder: 13900:13906 ioctl c0306201 20000280 returned -22 [ 242.453183] binder: BINDER_SET_CONTEXT_MGR already set 07:10:28 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = dup3(r0, r1, 0x0) dup2(r3, r2) setsockopt$CAN_RAW_RECV_OWN_MSGS(r3, 0x65, 0x4, &(0x7f0000000000), 0x4) 07:10:28 executing program 5: r0 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x4, 0x20000000007ffd, 0x7c, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100]}, 0x2c) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r4 = dup2(r3, r2) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="aa2e0777"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$sock_inet6_udp_SIOCOUTQ(r4, 0x5411, &(0x7f0000000080)) r5 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r0, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096}, 0x20) [ 242.458502] binder: 13900:13906 ioctl 40046207 0 returned -16 [ 242.481446] binder: BINDER_SET_CONTEXT_MGR already set [ 242.482102] binder: 13900:13916 unknown command -1309756554 [ 242.486909] binder: 13900:13915 ioctl 40046207 0 returned -16 [ 242.523986] binder: 13917:13919 unknown command 1466533362 [ 242.530897] binder: 13900:13916 ioctl c0306201 20000280 returned -22 [ 242.554752] binder: 13917:13919 ioctl c0306201 20000280 returned -22 [ 242.577891] binder: 13917:13924 ioctl 2400 fffffffffffffffd returned -22 [ 242.587679] binder: 13921:13922 unknown command 1996959402 [ 242.605244] binder: 13921:13922 ioctl c0306201 20000280 returned -22 07:10:28 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="07630440"], 0x0, 0x0, 0x0}) [ 242.633769] binder: 13921:13922 ioctl 5411 20000080 returned -22 [ 242.641195] binder: 13917:13919 unknown command 1466533362 [ 242.647308] binder: 13917:13924 ioctl 2400 fffffffffffffffd returned -22 [ 242.661602] binder: 13917:13919 ioctl c0306201 20000280 returned -22 07:10:29 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) r1 = socket$kcm(0x10, 0x2, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) dup2(r1, r2) 07:10:29 executing program 5: r0 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x4, 0x20000000007ffd, 0x7c, 0x400, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100]}, 0x40) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = dup(r1) r3 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r5 = dup2(r4, r3) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$VIDIOC_SUBDEV_S_FRAME_INTERVAL(r5, 0xc0305616, &(0x7f0000000080)={0x0, {0x9, 0x3f}}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$MON_IOCQ_RING_SIZE(r2, 0x9205) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r0, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096}, 0x20) 07:10:29 executing program 2: perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0xd5, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x0, @perf_bp={0x0}, 0x4250b}, 0x0, 0x9, 0xffffffffffffffff, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) r1 = socket$kcm(0x10, 0x2, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) dup2(r1, r2) [ 242.829641] binder_alloc: 13938: binder_alloc_buf, no vma [ 242.843976] binder: 13938:13940 ioctl c0305616 20000080 returned -22 07:10:29 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000400)={0x1, 0x0, &(0x7f0000000440)=ANY=[@ANYRES64], 0x0, 0x0, 0x0}) r2 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="05734458e15b"], 0x0, 0x0, 0x0}) r4 = dup2(r3, r2) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x54, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$USBDEVFS_CLEAR_HALT(r4, 0x80045515, &(0x7f0000000080)={0x3}) r5 = dup2(r1, r0) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) finit_module(r6, &(0x7f0000000140)='\'*-\x00', 0x2) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000280)={0x1, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="07630440fd8ba40e60c62b9c864178dd87a62c13599fe56c0b16af30eabb7ea4450f07326fdc5995d372139f6550e5422a3dbc3506b4f668c81cacceb356987cb96ee05b88a9cc0721bc1a7275e25e942062541e8b"], 0x0, 0x0, 0x0}) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f00000001c0)={0x0, 0x10001}, &(0x7f00000002c0)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000000300)={0x4, 0x8, 0x208, 0x2, 0x7fff, 0x8001, 0x3, 0x8, r7}, 0x20) 07:10:29 executing program 5: r0 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x4, 0x20000000007ffd, 0x7c, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100]}, 0x2c) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$USBDEVFS_FREE_STREAMS(r2, 0x8008551d, &(0x7f0000000080)={0xd701, 0x11, [{0x1, 0x1}, {0x3, 0x1}, {0xa, 0x1}, {0x5, 0x1}, {0x6, 0x1}, {0x7, 0x1}, {0x3}, {0x4, 0x1}, {0x2}, {0x3, 0x1}, {0xd}, {0xb, 0x1}, {0x3}, {0x8, 0x1}, {0x9, 0x1}, {0x8, 0x1}, {0x4, 0x1}]}) r3 = inotify_add_watch(r2, &(0x7f00000000c0)='./file0\x00', 0xc0) inotify_rm_watch(r2, r3) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r0, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096}, 0x20) 07:10:29 executing program 2: r0 = perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) r2 = socket$kcm(0x10, 0x2, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f0000000000)={0x9, 0x6, 0x2, 0x0, 0x0, [{{r3}, 0x1ff}, {{r4}, 0x2}]}) r5 = socket$kcm(0x10, 0x2, 0x0) dup2(r2, r5) [ 242.981462] binder: 13947:13951 unknown command -1 [ 242.989385] binder: 13947:13951 ioctl c0306201 20000400 returned -22 [ 243.019124] binder: BINDER_SET_CONTEXT_MGR already set 07:10:29 executing program 5: r0 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x4, 0x20000000007ffd, 0x7c, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100]}, 0x2c) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r0, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096}, 0x20) creat(&(0x7f0000000080)='./file0\x00', 0x10) [ 243.030191] binder: 13947:13951 ioctl 40046207 0 returned -16 07:10:29 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) bind(r0, &(0x7f0000000000)=@ipx={0x4, 0x6, 0x4, "dba4228712d0", 0x8}, 0x80) r1 = socket$kcm(0x10, 0x2, 0x0) sendto$inet6(r0, &(0x7f0000000080)="29803da2e693efc8ad787e397b83afb4817663d7ca10483db84082d24b70", 0x1e, 0x4042, &(0x7f00000000c0)={0xa, 0x4e23, 0x3, @private2={0xfc, 0x2, [], 0x1}}, 0x1c) r2 = socket$kcm(0x10, 0x2, 0x0) dup2(r1, r2) [ 243.054767] binder: 13947:13951 unknown command 1480880901 [ 243.076175] binder: 13947:13951 ioctl c0306201 20000200 returned -22 [ 243.091541] binder: BINDER_SET_CONTEXT_MGR already set [ 243.117929] binder: 13947:13951 ioctl 40046207 0 returned -16 [ 243.137174] binder: 13947:13951 ioctl c0306201 20000280 returned -14 [ 243.155725] binder: 13947:13951 ioctl 80045515 20000080 returned -22 [ 243.218176] binder: BINDER_SET_CONTEXT_MGR already set [ 243.235964] binder: 13947:13951 ioctl 40046207 0 returned -16 07:10:29 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="07630440"], 0x0, 0x0, 0x0}) r3 = syz_open_dev$audion(&(0x7f0000000080)='/dev/audio#\x00', 0x2b5, 0x800) openat$audio1(0xffffffffffffff9c, &(0x7f0000000240)='/dev/audio1\x00', 0x30d000, 0x0) ioctl$SG_IO(r3, 0x2285, &(0x7f0000000380)={0x53, 0xfffffffffffffffd, 0x70, 0x3, @buffer={0x0, 0x79, &(0x7f00000000c0)=""/121}, &(0x7f0000000140)="662141d0a57b570f58cda0932afafbb05c279dc96aaafab4bea7c770f4beb9a2c47732eb6c7e81a01cf761074028f72630563eb4a15744e495b75cdad47af76d31335bb9b45fdac4f70509496278a2bd597097098adbfab2a9753c8196f12c283512ce82fc79d3e30fa65a9169fedc88", &(0x7f00000002c0)=""/129, 0xffffffff, 0x22, 0x0, &(0x7f00000001c0)}) sendmsg$AUDIT_SIGNAL_INFO(r3, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x10, 0x3f2, 0x400, 0x70bd29, 0x25dfdbfe, "", [""]}, 0x10}, 0x1, 0x0, 0x0, 0x20000000}, 0x80) ioctl$DRM_IOCTL_MODE_DIRTYFB(r3, 0xc01864b1, &(0x7f0000000540)={0x100000, 0x0, 0x3, 0x1, &(0x7f0000000500)=[{0x401, 0x7fff, 0x2, 0xdf01}]}) 07:10:29 executing program 5: r0 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cachefiles\x00', 0x1, 0x0) bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x17, 0x4, 0x7fff, 0x7c, 0x10, r0, 0x0, [0x0, 0x0, 0x0, 0x400100], 0x0, 0xffffffffffffffff, 0x1}, 0x40) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = dup(r1) r3 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) newfstatat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000) mount$9p_fd(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x2820084, &(0x7f0000000340)={'trans=fd,', {'rfdno', 0x3d, r3}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@dfltgid={'dfltgid', 0x3d, r4}}], [{@dont_hash='dont_hash'}, {@permit_directio='permit_directio'}, {@permit_directio='permit_directio'}, {@mask={'mask', 0x3d, 'MAY_APPEND'}}, {@hash='hash'}, {@audit='audit'}]}}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r5 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) r6 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r7 = dup2(r6, r5) ioctl$BINDER_SET_CONTEXT_MGR(r7, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f00000000c0)={r7, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096}, 0x20) 07:10:29 executing program 2: perf_event_open(&(0x7f00000002c0)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x3f, 0x0, 0x8000000000000, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0x5}, 0x0, 0xfffffffffffffffa}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) r1 = socket$kcm(0x10, 0x2, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r3 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$KVM_CREATE_DEVICE(r3, 0xc00caee0, &(0x7f0000000180)) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000000140)=ANY=[], 0x0, 0x0, 0x0}) r5 = dup2(r4, r2) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$SNDCTL_DSP_GETBLKSIZE(r5, 0xc0045004, &(0x7f0000000000)) r6 = socket$kcm(0x10, 0x2, 0x0) dup2(r1, r6) 07:10:29 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000000080)=[@register_looper, @decrefs={0x40046307, 0x2}, @decrefs={0x40046307, 0x1}], 0x1a, 0x0, &(0x7f00000000c0)="f718342297f51a4120107765b9cb94a74ff847cce0261586a1a1"}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="07630440"], 0x0, 0x0, 0x0}) [ 243.359705] binder: 13973:13974 ioctl c0045004 20000000 returned -22 [ 243.388309] binder: 13973:13974 ioctl c0045004 20000000 returned -22 07:10:29 executing program 2: shmget$private(0x0, 0xc00000, 0x400, &(0x7f00003ff000/0xc00000)=nil) perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40000, 0x40) setsockopt$nfc_llcp_NFC_LLCP_RW(r1, 0x118, 0x0, &(0x7f00000001c0)=0x7, 0x4) ioctl$sock_SIOCSIFVLAN_DEL_VLAN_CMD(r0, 0x8983, &(0x7f0000000000)={0x1, 'veth0_to_team\x00', {}, 0xa}) r2 = socket$kcm(0x10, 0x2, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) fallocate(r4, 0x8, 0x200, 0x2cd35c8c) dup2(r2, r3) 07:10:29 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) r1 = socket$kcm(0x10, 0x2, 0x0) ioctl$SNDRV_PCM_IOCTL_READI_FRAMES(0xffffffffffffffff, 0x80184151, &(0x7f0000000040)={0x0, &(0x7f0000000000)="bae9379a65e731555d", 0x9}) r2 = socket$kcm(0x10, 0x2, 0x0) r3 = dup2(r1, r2) sendmsg$IPSET_CMD_GET_BYINDEX(r3, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000180)={0x5c, 0xf, 0x6, 0x101, 0x0, 0x0, {0x0, 0x0, 0x2}, [@IPSET_ATTR_INDEX={0x6, 0xb, 0x2}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_INDEX={0x6}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_INDEX={0x6}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_INDEX={0x6, 0xb, 0x4}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x5c}, 0x1, 0x0, 0x0, 0x40014}, 0x20000000) 07:10:29 executing program 5: r0 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x4, 0x20000000007ffd, 0x7c, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100]}, 0x2c) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x1ffffffffffffe) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r0, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096}, 0x20) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/asound/seq/clients\x00', 0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000300)='batadv\x00') r6 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$sock_inet6_SIOCSIFADDR(r6, 0x8916, &(0x7f0000000200)={@initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x48, r7}) sendmsg$BATADV_CMD_GET_MESH(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000880)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r5, @ANYBLOB="050061000100000001b355bf53c035a44403a93d0004000000000000ba7171ce2af9bcf369065cd15c36f6fa23f2d96514f1ba69c283ae1d00000000020000", @ANYRES32=r7, @ANYBLOB], 0x1c}}, 0x0) r8 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendto$inet(r8, &(0x7f0000fa3fff)='\t', 0x1, 0x0, &(0x7f00006f7000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f00000003c0), &(0x7f0000000400)=0x4) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r8, 0x84, 0x6c, &(0x7f000059aff8), &(0x7f000034f000)=0x2059b000) setsockopt$inet_sctp6_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000a40)=@assoc_value, 0x8) getsockopt$inet_sctp_SCTP_MAXSEG(r3, 0x84, 0xd, &(0x7f0000000240)=@assoc_value={0x0, 0xfff}, &(0x7f00000002c0)=0x8) sendmsg$BATADV_CMD_SET_VLAN(r3, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r5, 0x100, 0x70bd2c, 0x25dfdbfd, {}, [@BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4804}, 0x20045040) 07:10:29 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = shmget(0x2, 0x2000, 0x40, &(0x7f0000ffe000/0x2000)=nil) dup2(r1, r0) r3 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r5 = dup2(r4, r3) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) r7 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) socket$kcm(0x10, 0x2, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x4, 0x0, &(0x7f0000000140)=ANY=[@ANYRES64, @ANYRESHEX=r6, @ANYRES32=r7, @ANYRES16=r6, @ANYRES32=r1, @ANYRESOCT=r2], 0x0, 0x0, 0x0}) [ 243.620890] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1551 sclass=netlink_route_socket pid=13990 comm=syz-executor.2 07:10:30 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) r1 = socket$kcm(0x10, 0x2, 0x0) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x0, 0x0) bind$l2tp(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PIO_UNIMAP(r3, 0x4b67, &(0x7f0000000200)={0x8, &(0x7f00000001c0)=[{0x5, 0x1}, {0xdf, 0x5}, {0x91, 0x3b}, {0x9, 0x401}, {0x5, 0x49a2}, {0x7, 0x9}, {0x69, 0xd5a}, {0x80, 0x4}]}) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) r6 = dup2(r4, r5) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r6, 0x40042409, 0x1) r7 = socket$kcm(0x10, 0x2, 0x0) dup2(r1, r7) [ 243.728034] binder_alloc: 13993: binder_alloc_buf, no vma [ 243.747611] binder: 13993:13995 unknown command -1 [ 243.762728] binder: 13993:13995 ioctl c0306201 200001c0 returned -22 07:10:30 executing program 5: r0 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x4, 0x20000000007ffd, 0x7c, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100]}, 0x2c) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r5 = dup2(r4, r3) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) r6 = socket(0x10, 0x803, 0x0) sendmsg$BATADV_CMD_GET_MESH(r6, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={0x0, 0x8}}, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="38000000100039af00"/20, @ANYRES32=0x0, @ANYBLOB="001500009b0000001800128008000100736974000c00028008000100", @ANYRES32=r7], 0x38}}, 0x0) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000000)={@private2, r7}, 0x14) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f0000000140)={@empty, 0x3d, r7}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$KVM_GET_DEVICE_ATTR(r5, 0x4018aee2, &(0x7f00000000c0)={0x0, 0x6, 0xd2e, &(0x7f0000000080)=0x6}) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r0, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096}, 0x20) [ 243.788635] binder: BINDER_SET_CONTEXT_MGR already set [ 243.805606] binder: 13993:13995 ioctl 40046207 0 returned -16 [ 243.818643] binder: BINDER_SET_CONTEXT_MGR already set [ 243.829826] binder: 13993:13998 ioctl 40046207 0 returned -16 07:10:30 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="07630440"], 0x0, 0x0, 0x0}) r3 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nvme-fabrics\x00', 0x20000, 0x0) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r3, 0x29, 0x41, &(0x7f00000000c0)={'security\x00', 0x3, [{}, {}, {}]}, 0x58) 07:10:30 executing program 5: r0 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x16, 0x4, 0x20000000007ffd, 0x7c, 0x8, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100]}, 0x40) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r0, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096}, 0x20) 07:10:30 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) r1 = socket$kcm(0x10, 0x2, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) dup2(r1, r2) ioctl$SOUND_MIXER_READ_STEREODEVS(0xffffffffffffffff, 0x80044dfb, &(0x7f0000000000)) 07:10:30 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = syz_open_dev$vcsn(&(0x7f0000000140)='/dev/vcs#\x00', 0x33d, 0x418000) getsockopt$inet_sctp_SCTP_HMAC_IDENT(r2, 0x84, 0x16, &(0x7f0000000180), &(0x7f00000001c0)=0x4) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="05f2774069138df90cae8c153b9ecb3853dc33d15b3684d6a6149fa30d4ae1e305f216437b85dca0a15f3dc1342f668b57ec402f46340046774e7a29ef9ce81519e04561f2cf15139643baded36c85ee84910ed584448c742c170f56"], 0x0, 0x0, 0x0}) r3 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="07630440"], 0x0, 0x0, 0x0}) ioctl$FS_IOC_GETVERSION(r0, 0x80087601, &(0x7f0000000100)) 07:10:30 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) r1 = socket$kcm(0x10, 0x2, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) write$binfmt_elf64(r0, &(0x7f0000000280)={{0x7f, 0x45, 0x4c, 0x46, 0x6, 0x7, 0x0, 0x6, 0x7, 0x0, 0x6, 0x4691, 0x23c, 0x40, 0x24b, 0x6, 0x8000, 0x38, 0x2, 0x40, 0x7, 0x6}, [{0x6, 0x5, 0x9, 0x5, 0x6f, 0x81, 0x1, 0x3}, {0x7, 0x6, 0x9, 0x690d, 0x8, 0x6, 0x3, 0x4d8}], "8b6c6b8ef2f5c3d1eb5741dc9fd4a60fe55d6e1e5f9ace011b1414d24dc9573b57ee32befda5ca470fb33a97a04b5e842cc259b6b4ab62f174dda72dbfa659386a4ebf5289b8042fb26048c908f09f77594e15a1ac8b654e2e529ce20a366f93d2681640b4734b64d2cd3b904e38272ada623403355bc63983ff694d2dc66e5f7cf2ffe3a02272e2fd6a3dbb946d867c09079cd9de252383d7beefb39150274e1ebaf696a5835704c5e09df409e5a3f6f05de145f232ebd86951b428f71ecb910266432f4347ad342bd84f2d82aa12c78d8b791ac57df4d8b0cc87814f0aec7d79bf78c397bf54a94319a1e60362dbabc215813d920c4162bf", [[]]}, 0x2a9) r3 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="7f5441fb95bb90c599d66069574bd38bb0a6cab2e67a6c0c90b05d4daa19ef9ad6788aa425ade93c80e8aba83cbc0e64d5b02df281a3a5bf9d60f8f3484e1fd4aa29671ce15e15c6eadab75bc91eb74840c7d5b46020134b9101fba1a9918f688205ee84f4f204c15113df10308d0e7b4748fba615d40503f0eec9219f71d25d39aaf9fbecf5f7b595fd3547d6d870ca848aaec3132521dcba"], 0x0, 0x0, 0x0}) r5 = dup2(r4, r3) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) accept4$rose(r5, &(0x7f0000000000)=@short={0xb, @remote, @netrom, 0x1, @default}, &(0x7f0000000040)=0x1c, 0x800) dup2(r1, r2) 07:10:30 executing program 5: r0 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x15, 0x20, 0x20000000007ffd, 0x7c, 0x400, 0x1, 0x100000, [0x0, 0x0, 0x0, 0x400100], 0x0, 0xffffffffffffffff, 0x0, 0x3, 0x3}, 0x40) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r0, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096}, 0x20) r3 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r5 = dup2(r4, r3) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r5, 0x4028af11, &(0x7f0000000180)={0x3, 0x0, &(0x7f0000000080)=""/16, &(0x7f00000015c0)=""/4096, &(0x7f00000000c0)=""/142, 0x2}) [ 244.070118] binder: 14020:14021 unknown command 1081602565 [ 244.092057] binder: 14020:14021 ioctl c0306201 20000200 returned -22 [ 244.107632] binder: 14020:14021 ioctl 80087601 20000100 returned -22 07:10:30 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) umount2(&(0x7f0000000080)='./file0\x00', 0x6) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) r3 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r5 = dup2(r4, r3) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$KVM_SET_MP_STATE(r5, 0x4004ae99, &(0x7f00000000c0)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="07630440"], 0x0, 0x0, 0x0}) [ 244.136195] binder: 14020:14023 ioctl 80087601 20000100 returned -22 [ 244.157909] binder: 14024:14025 unknown command -79604609 [ 244.181468] binder: 14024:14025 ioctl c0306201 20000200 returned -22 07:10:30 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$BATADV_CMD_GET_MESH(r1, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={0x0, 0x8}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="38000000100039af00"/20, @ANYRES32=0x0, @ANYBLOB="001500009b0000001800128008000100736974000c00028008000100", @ANYRES32=r2], 0x38}}, 0x0) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000000)={@private2, r2}, 0x14) r3 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x40, 0x20000000007ffd, 0x7c, 0x0, 0x1, 0x7, [0x0, 0x0, 0x0, 0x400100], r2, 0xffffffffffffffff, 0x0, 0x5}, 0x40) r4 = socket$inet6(0xa, 0x2, 0x0) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r3, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096}, 0x20) [ 244.215745] binder: 14024:14025 unknown command -79604609 [ 244.226019] binder: 14024:14025 ioctl c0306201 20000200 returned -22 [ 244.251962] binder_alloc: 14028: binder_alloc_buf, no vma [ 244.271994] binder: 14028:14033 ioctl 4004ae99 200000c0 returned -22 07:10:30 executing program 2: r0 = perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) r3 = socket$kcm(0x10, 0x2, 0x0) r4 = socket$kcm(0x10, 0x2, 0x0) dup2(r3, r4) [ 244.322154] binder: BINDER_SET_CONTEXT_MGR already set [ 244.335064] binder: 14028:14038 ioctl 4004ae99 200000c0 returned -22 [ 244.345599] binder: 14028:14033 ioctl 40046207 0 returned -16 07:10:30 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) socket$inet_dccp(0x2, 0x6, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$VIDIOC_S_JPEGCOMP(r2, 0x408c563e, &(0x7f00000000c0)={0xfc, 0x6, 0x9, "a8afa528975fa8f65e732076a278f06a5436e950e28b348a0aece200e477bf9bae8a7a10df0cfcf39ed3af9f114a3e2eda7a65bc198696f5135c5489", 0x20, "0869575aac003ba58c8b9043ba8a006483bdd264a0f171880638d6667f258f290a60eb41e1bbb9716f6da19f0db84edffdd188bac2cb8c52942e89eb", 0x20}) r3 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="07630440"], 0x0, 0x0, 0x0}) 07:10:30 executing program 5: r0 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x4, 0x20000000007ffd, 0x7c, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100]}, 0x2c) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) uname(&(0x7f0000000140)=""/136) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000340)={r4, &(0x7f00000002c0)="2a8057bbb5a1a70d", &(0x7f0000000300)=""/33}, 0x20) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r5 = dup2(r3, r2) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x18, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) ioctl$SOUND_PCM_READ_BITS(r5, 0x80045005, &(0x7f0000000080)) r6 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r0, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096}, 0x20) 07:10:30 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="07631240"], 0x0, 0x0, 0x0}) 07:10:30 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) setsockopt$inet_sctp6_SCTP_RECVNXTINFO(r0, 0x84, 0x21, &(0x7f00000000c0)=0x54, 0x4) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB='\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) sendmsg$AUDIT_DEL_RULE(r2, &(0x7f00000007c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000200)={&(0x7f0000000340)={0x450, 0x3f4, 0x1, 0x5, 0x25dfdbff, {0x0, 0x2, 0x29, [0x7fff, 0x1f, 0x4, 0x10, 0x3, 0x0, 0xff, 0x8, 0x2, 0x3ff, 0x200, 0x7, 0x3, 0xfff, 0x4, 0x1000, 0x0, 0x100, 0x2, 0x4, 0x9, 0x40, 0x0, 0xfffffff7, 0x6, 0x0, 0x9, 0x4, 0x80, 0x5, 0xffffffbe, 0xff, 0x7fffffff, 0x1, 0x1, 0xffffffff, 0x3, 0x9, 0xbde, 0x8, 0x296d, 0x7, 0x8001, 0x9, 0x1, 0x4, 0x7, 0x1f, 0x0, 0x8, 0x0, 0x0, 0x80, 0xffffff62, 0x0, 0x1, 0x7, 0x6, 0x7f, 0x7, 0x1000, 0x80000000, 0x0, 0x4], [0x7f, 0x3ff, 0x4, 0x48000, 0x400, 0x9, 0x5, 0x200, 0x8, 0x78, 0x4c01, 0x0, 0x8, 0x1, 0x400, 0x4, 0x3, 0x200, 0x53f, 0x8, 0x80000000, 0x1c1a, 0x368ef0a9, 0x3, 0x7ff, 0x101, 0xf, 0xfb, 0x9, 0x7fff, 0x7ff, 0x3, 0x10000, 0x9, 0x7, 0x2409, 0x3, 0xf8, 0x9, 0xe289, 0x4b, 0x137, 0x80000001, 0x0, 0x0, 0x7ff, 0x2, 0x8, 0x95a6, 0x8, 0x10001, 0x5, 0x81, 0x8a8d, 0x4, 0xff, 0x8, 0x2, 0x7, 0x7, 0x430, 0xfffffff9, 0x8b4d, 0x9], [0x7ff, 0x4, 0x5, 0x0, 0x7, 0x8, 0x6, 0x1, 0xfffffffe, 0x5, 0x2, 0x6, 0x2, 0x4, 0x1, 0x0, 0xffffff7f, 0x0, 0xb4b8, 0xfff, 0x5, 0x7f, 0x2, 0x1, 0xb8, 0x9, 0x1, 0x4cc, 0x650, 0x8000, 0x9d, 0x8, 0x80000001, 0x9, 0x9, 0x9, 0x400, 0x8, 0x1, 0x8, 0x8, 0xda43, 0x4, 0x6, 0x5, 0x7f, 0x7fffffff, 0x5, 0x7, 0x10001, 0x6, 0x8, 0x3f, 0x936, 0xe4, 0x7, 0x1, 0x75, 0x8, 0x101, 0x0, 0x0, 0x16d8, 0x2], [0xef, 0x1, 0x4, 0xfffffffb, 0x9d26, 0x1, 0x70000000, 0x6, 0x4, 0x0, 0x7b4, 0x9, 0x6, 0x1, 0x1f, 0x800, 0x6, 0x2, 0x3807, 0x0, 0x74, 0x29c, 0x5, 0x80, 0x80000000, 0x3, 0x7fffffff, 0x0, 0x6, 0x9, 0xd4d7, 0x1f, 0x5, 0x0, 0x1, 0x6, 0x3c87, 0x80, 0x3, 0x0, 0xf259, 0x1987, 0x4, 0x0, 0x58aa, 0x4, 0x3, 0xf2f, 0xffff0001, 0xade, 0x8, 0x0, 0x2, 0x1, 0x1, 0x6, 0xfffffff7, 0x1f, 0x1, 0x5, 0x0, 0xffff, 0x9, 0x1], 0x2d, ['/dev/urandom\x00', '$\x00', '/dev/urandom\x00', '[--\x00', '/dev/urandom\x00']}, ["", "", "", ""]}, 0x450}, 0x1, 0x0, 0x0, 0x40000d5}, 0x200080d4) socket$kcm(0x10, 0x2, 0x0) socket$kcm(0x10, 0x2, 0x0) r3 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000000)='/dev/urandom\x00', 0xa0, 0x0) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) dup2(r3, r5) keyctl$KEYCTL_CAPABILITIES(0x1f, &(0x7f0000000280)=""/150, 0x96) 07:10:30 executing program 2: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0xc}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) r1 = socket$kcm(0x10, 0x2, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) dup2(r1, r2) [ 244.548768] binder: 14055:14057 unknown command 1074946823 [ 244.554712] binder: 14055:14057 ioctl c0306201 20000280 returned -22 [ 244.564512] binder_alloc: 14048: binder_alloc_buf, no vma [ 244.570430] binder: 14048:14053 ioctl 80045005 20000080 returned -22 07:10:30 executing program 4: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) r1 = dup2(r0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="07630440"], 0x0, 0x0, 0x0}) 07:10:30 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$BATADV_CMD_GET_MESH(r1, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={0x0, 0x8}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYRESOCT, @ANYBLOB="8445dc1734e7324644a70adae1525ac9baf88be9357128008d7bd534e59d07b76d7d115cb8879789ac92629e9b1202fcb62eec2f2680295603f9d8a96bb344254be9d51bc05b02f335eeef2ab81d4173b2e7351fbd5fae878acf438120a134148559f493054e52e2ca6a", @ANYRES16=r1, @ANYRESDEC, @ANYRESHEX], 0x38}, 0x1, 0x0, 0x0, 0x40}, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) r4 = dup2(r3, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000002c0)=ANY=[@ANYBLOB="852a74700000000000000000000000000000000000000000852a687300000000000000000000000000000000000000008561646600000000000000000000000000000000000000000000000000000000be71dfbf8906b42ec7d1cba6632fe418de11e3e9e18b"], &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) sendto$inet(r4, &(0x7f0000000140)="0a67cfc1d4673b6fbadf9c4dbfdfcaecdc2c95086c1e33e4c6bbf622aeafa61f9737702023d79391baf4ca2aea8de41a739ae09e46c41f83e2a976a2cf82dbcd032976a66ce6daae5155db761133f90885965c3ca9d8788ac8946d060ee62f17749de134aef8af01c33eb171194b3d869a20", 0x72, 0x80, &(0x7f00000000c0)={0x2, 0x4e20, @remote}, 0x10) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000000)={@private2, r2}, 0x14) r5 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0xa, 0x2, 0x7ffa, 0x7c, 0x82, 0x1, 0x1a, [0x0, 0x0, 0x0, 0x400100], r2, 0xffffffffffffffff, 0x1}, 0x40) r6 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFVLAN_GET_VLAN_INGRESS_PRIORITY_CMD(r6, 0x8982, &(0x7f0000000080)) r7 = dup(r6) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r5, &(0x7f00000015c0)="c291392dc8c8d55bff6b7b4d9cbd518a1e82803894f6bb9d35b4b5706f299210548e7edfc2d496bd1f7bcc8127f96864f7e3b270d1387e6f9a67c8f1295c0cc45b41a09f0b287c19f91f0bec984d4b5b147e23abcee1cfa9be6e948d59ba6c5846bdb74517f1ffef197e6a0b13c13c628bf4ef99dc485a0b1fbe69f72c891ee2f41887ecfc3be334b2e6baf4a3b771c3848c3094f4e7521b19f49c89b7248fc0adafb19f017cf1", &(0x7f0000001680)=""/4102, 0x4}, 0x20) 07:10:30 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) r1 = socket$kcm(0x10, 0x2, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) sendmsg$kcm(r3, &(0x7f0000000700)={&(0x7f0000000000)=@pppol2tpv3in6={0x18, 0x1, {0x0, r4, 0x3, 0x0, 0x2, 0x1, {0xa, 0x4e23, 0x3, @private0={0xfc, 0x0, [], 0x1}, 0x8}}}, 0x80, &(0x7f0000000500)=[{&(0x7f0000000080)="a39231733af69276d440dc3b15295dbd273b25bc6396e00e59458b50243275f1cf", 0x21}, {&(0x7f00000000c0)="55999158cc81317081e8ce1f54d9f85bdc26b3d295033ba85df6c93f380c85", 0x1f}, {&(0x7f0000000180)="b95695e92858be2723a1a2ea681bff6917fd5845fd9323b8d2e275", 0x1b}, {&(0x7f00000001c0)="15cdabe8cf8558ec714574f43b777709d7a273553388d27d721a5bb9639862aed97d9a658a6ccf66cc74505411314f3546eb207b053ab4d528baa01001145756e9256ea948fa898d09087d33f6131e5318cadf4147077582c002", 0x5a}, {&(0x7f0000000280)="3c0fd0674ae5dde2a4f37e842c35c78526f5d6960ccfb4670cb95915b9b213839bfa63ac0892a1f0eca42cdc7674bb30c4a5ce6bcde3b46f9c3dd6eb10674aad59216aca239a616093468481d99c4ff5bb2f0ab2129723bc92df01063f42446f89677f1d5ed58f415918d7da056b6bb8d249dc26dce6b2", 0x77}, {&(0x7f0000000300)="7bf648c71d976d48d84da62ae62e1ab17f1daba7f2931c72074e78f40d7fba01d1d13748880c40a056a5548296a9132cec2e6546e39b05de7cd4e6b2f806f0abe111f9c4b4e97bfacd5077744fde55a7853c754bf419eeee3bd720707cc2d90d433eae1aeea1c4f194061030bfb41dc51a00eeed88b2359c77ddcdf93ebf93532ef69c9745bc5038438d24ecb93d866cc94220558c7ecce8f67a62f6c1646ddf32e70efb4c2a64c4208cbd156a8eec535110564d", 0xb4}, {&(0x7f00000003c0)="b641288f5481878b0e6e637d540a2a6c00db4ad095a8da", 0x17}, {&(0x7f0000000400)="2d9f81967669eb68633d80f34ad9d92fcbaf3807f5fc172e4bda846b8b14b5267de9fb6f4136a0218b6ce54c836c04da33e37c94b437a32119fc9190149882230c4aa4bf5314ac", 0x47}, {&(0x7f0000000480)="a5e1cbd24b02054dcc4a85c590acfee1eec94d5bf616fa2ff46fc332fc03ed8662dcdb3563501ea3561613d5253316663f7e7a38602dc9df18188de1d7d7f3044909531afe047c06b584019e3cec5690770565ea31cc6a6250bdd80ae0f0fe1d0e8905", 0x63}], 0x9, &(0x7f00000005c0)=[{0x98, 0x101, 0x7, "b6c8c31880c5736b91d2bc33590fe6007a20421003dee39dd9b925e07bc17415c7812d33d4aca737620d7e79990b0cad391aa443c27b0cb0674e3a996da06696389c7c10181876e1b04b1e48bf19a52912ddb04fd024493425f8d2853953b2491a62983d585d5c0077be2eebd3ae3a1b8eec78456ecae02ffc7e0b3c9a4d2a1d0dd5382898e151a7"}, {0x80, 0x103, 0x6, "6d3473955219757f7644e3c506751257cddca19cc106b4cf42bf9505ab5c2c5cfc563d7464f82ab11962c315a335f30c3e568a0e0ee85db14b10fd18eb482fb3577591fcb086d6b9257d1eea772405991bb023f848a173a68b644b9df7bf67bc0303b3ea5dfd7961854480b4b89c"}], 0x118}, 0x4000000) dup2(r1, r2) 07:10:31 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000200)={[], 0x1f000}) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x4000000000000, 0x40, &(0x7f00000004c0)=@raw={'raw\x00', 0x8, 0x3, 0x1c0, 0x0, 0x118, 0x3e020000, 0x0, 0x118, 0x15c, 0x1d0, 0x1d0, 0x15c, 0x1d0, 0x3, 0x0, {[{{@ip={@multicast1=0xe0005100, @multicast1, 0x0, 0x0, 'syzkaller0\x00', 'netpci0\x00'}, 0x0, 0x70, 0x90}, @unspec=@NOTRACK={0x20, 'NOTRACK\x00'}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@inet=@TCPMSS={0x28, 'TCPMSS\x00'}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x220) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x15}, &(0x7f0000000040)=0x0) timer_settime(r4, 0x0, &(0x7f0000000180)={{}, {0x0, 0x1c9c380}}, 0x0) timer_gettime(r4, &(0x7f0000000080)) r5 = syz_open_dev$binderN(0x0, 0x0, 0x802) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="07630440"], 0x0, 0x0, 0x0}) 07:10:31 executing program 5: r0 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x4, 0x20000000007ffd, 0x7c, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100]}, 0x2c) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r0, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096}, 0x20) 07:10:31 executing program 2: r0 = perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xa, 0xffffffffffffffff, 0x0) r1 = dup2(r0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) r2 = socket$kcm(0x10, 0x2, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, &(0x7f0000000040)={0x1, 0x0, [{0x6000, 0x2f, &(0x7f0000000000)=""/47}]}) dup2(r2, r3) 07:10:31 executing program 5: r0 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x4, 0x20000000007ffd, 0x7c, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100]}, 0x2c) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r0, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096}, 0x20) r3 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="bf1ac71bfd071c1e08256b5f034b0563049c32d1759f45297aeba2501ff056c67f6ce93e63d1b55a8eb4c1e4681ced251f486605d1b216f84e886472bdc4754a3aca109fcd81ccda4e33107f9fed44875d14049a8b7a13b2e55fe752660f34a0607e3bca8edcfdbab4d4360d7c066308abf23f6632fcad41d1b9d8284c895bed5c895bd1aea4b5e9bc55163f2d4333c72879429a8060321a6a7501a921d6a96226c2b117ac9f7ca14ea90573150828868c6de087d51b78805832f8d3e7463e5897746ab8cb59ea9b54d5b3a8995d01f165fc51b00aa86b67901f706de9871bacd12b4b1921d3d37a"], 0x0, 0x0, 0x0}) r5 = dup2(r4, r3) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r5, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r6 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r6, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="08854ed5f5e3aa67ea4ad7ac131a58000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) setsockopt$inet_sctp6_SCTP_INITMSG(r6, 0x84, 0x2, &(0x7f0000000140)={0x7, 0x9, 0x8, 0x9}, 0x8) 07:10:31 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) r1 = socket$kcm(0x10, 0x2, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) fdatasync(r3) dup2(r1, r2) r4 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0563a3eeb0cc2b0440"], 0x0, 0x0, 0x0}) r6 = dup2(r5, r4) ioctl$BINDER_SET_CONTEXT_MGR(r6, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$TCGETX(r6, 0x5432, &(0x7f0000000000)) [ 245.056651] binder: 14100:14102 unknown command -291282171 [ 245.081435] binder: 14100:14102 ioctl c0306201 20000200 returned -22 07:10:31 executing program 5: r0 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x3, 0x4, 0x20000000007ffd, 0x7c, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100]}, 0x40) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = dup(r1) r3 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r5 = dup2(r4, r3) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="a8c09205df80502efda60e4e69a13247069143da3bd9f764e978ccc08b8dfe833ebc2780b670078015c05696dba995beb4088170762de9d0929fd7146cada8f3619c31cb244e2856f660423891f916e460708a7bec87cb60e7f53ca3d34624dfb2940d4b347734aeea9985ba5d0e1d2dab3b6f9243deb584d7cad0c0db1fb232fa6f12ff147fb99ee55810f81d5d25f65cd097e9443be82f92210798dddb99a390e0b538a537578aaeda8668f882c93480689921ed8907e8d11e967976506b3e361b72235fd60d587e02dad4ea627f6327c66d55023c3d5f330684db32bd378060fdfda5797429b0c98c059a7ab3913e5d1dfa00"/256], 0x0, 0x0, 0x0}) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000002600)=[{&(0x7f0000002640)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff05000500120115ae3226eeca81914cd98413ccb16a374772e439318a199eccdce534bafb5302d4317fbddfd61c3502b5e9122ab2d2f4cef84d0add6334b90f285caf8b8588238513cc467337c7", 0xfffffe7f}, {&(0x7f0000000500)="740233cb2e2193ac6a32f76b810152f1a16888b5e7c8", 0x16}], 0x2}, 0x4000010) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000000380)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x18, &(0x7f00000000c0)={@flat=@binder={0x73622a85, 0x100b, 0x2}, @fda={0x66646185, 0x6, 0x0, 0x24}, @fd={0x66642a85, 0x0, r6}}, &(0x7f0000000340)={0x0, 0x18, 0x38}}, 0x400}], 0x0, 0x73b000, 0x0}) ioctl$SCSI_IOCTL_PROBE_HOST(r5, 0x5385, &(0x7f00000015c0)=ANY=[@ANYBLOB="0010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004000"/4100]) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$VIDIOC_TRY_EXT_CTRLS(0xffffffffffffffff, 0xc0205649, &(0x7f00000002c0)={0x9a0000, 0x3ff, 0x5, r3, 0x0, &(0x7f00000001c0)={0x98091b, 0x7fff, [], @string=&(0x7f0000000140)=0x20}}) ioctl$SIOCGETNODEID(r7, 0x89e1, &(0x7f0000000300)={0x2}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r0, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096}, 0x20) [ 245.102582] binder: 14100:14102 ioctl 5432 20000000 returned -22 07:10:31 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, @perf_bp={0x0}, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000000280)=ANY=[@ANYRES64=r1], 0x0, 0x0, 0x0}) dup2(r2, r1) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) write$P9_RSETATTR(0xffffffffffffffff, &(0x7f00000002c0)={0x7, 0x1b, 0x1}, 0x7) r3 = socket$kcm(0x10, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000040)={0xffffffffffffffff}, 0x111, 0x4}}, 0x20) r5 = dup2(0xffffffffffffffff, r3) write$RDMA_USER_CM_CMD_MIGRATE_ID(r0, &(0x7f00000000c0)={0x12, 0x10, 0xfa00, {&(0x7f0000000000), r4, r5}}, 0x18) r6 = socket$kcm(0x10, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f0000000180)={0x0}, &(0x7f00000001c0)=0xc) prctl$PR_SET_PTRACER(0x59616d61, r8) sched_getscheduler(r8) dup2(r3, r6) [ 245.136832] binder: 14100:14105 unknown command -291282171 [ 245.157381] binder: 14100:14105 ioctl c0306201 20000200 returned -22 [ 245.173922] binder: 14106:14107 unknown command 93503656 [ 245.179733] binder: 14106:14107 ioctl c0306201 20000280 returned -22 07:10:31 executing program 5: r0 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x4, 0x20000000007ffd, 0x7c, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100]}, 0x2c) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vcs\x00', 0x0, 0x0) ioctl$USBDEVFS_SETINTERFACE(r2, 0x80085504, &(0x7f00000000c0)={0x3, 0x7f}) r3 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x2400, 0x3) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='timerslack_ns\x00') ioctl$USBDEVFS_GET_SPEED(r4, 0x551f) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r0, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096}, 0x20) [ 245.209224] binder: 14106:14107 ioctl 5385 200015c0 returned -22 [ 245.253173] binder: 14109:14110 unknown command 3 [ 245.258061] binder: 14109:14110 ioctl c0306201 20000200 returned -22 [ 245.308328] binder: 14109:14110 unknown command 3 [ 245.317819] binder: 14109:14110 ioctl c0306201 20000200 returned -22 07:10:31 executing program 2: r0 = gettid() tkill(r0, 0xb) ptrace$setopts(0x4206, r0, 0x0, 0x0) perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0x46, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffcdfd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x5}, r0, 0x0, 0xffffffffffffffff, 0x0) r1 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) r2 = socket$kcm(0x10, 0x2, 0x0) clock_nanosleep(0x7, 0x0, &(0x7f0000000000), 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) dup2(r2, r3) 07:10:31 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r4 = dup2(r3, r2) r5 = mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000700)={0x9c, 0x0, &(0x7f0000000540)=[@transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@fd, @fd, @flat=@weak_binder={0x77622a85, 0xb, 0x3}}, &(0x7f00000003c0)={0x0, 0x18, 0x30}}, 0x400}, @free_buffer={0x40086303, r5}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x1, &(0x7f0000000400)=""/11, 0xb, 0x0, 0x38}, @flat=@handle={0x73682a85, 0x0, 0x1}}, &(0x7f0000000500)={0x0, 0x18, 0x40}}}], 0xeb, 0x0, &(0x7f0000000600)="2e84181cc27f46b53b7d1d3d140b78e70a8ad503471a05938b7913f53b390f63faaa12b0f4ab398c84ff279780f9f849f38c70ae9ec30671258ed50ec4da81b7e13f35127cf0abd9f52a7d1323c1844b764a318c1a588c361cd2c87383bc5e374d885f62631d3ca01d014180058579cea58dcdbd340c8f0861ae3a7313399a1a3e713dd2e4515e7e077374800dfc03e87dfe49538a23ba9bbbe296bcfbc7a658000a4e8f60a93271783ffd1155e3f382b2a15457a9daf24d02dd17022999381f5cea64668ddcca7fd254e0aad962f43dfc3d3027754656f4788480ba2115510687f4c86c10b2540d4d2a84"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x1c, 0x0, &(0x7f00000001c0)=[@request_death={0x400c630e, 0x2}, @free_buffer={0x40086303, r5}], 0xc6, 0x0, &(0x7f00000002c0)="56609a036553e3a8d907902a2a44f0ec847eb1eb9d7b93ae4d802b20c534923b260102c20e18d7d67ae16769504a835e4722350cb432064306fa9e1443651a3937f15391a40f3e0acea087581ffb314e9f959cc7c5407d138c32111230379da7793326f169ae19e96d4b1330a3933d378bf50b2be35d27ae08f63f7de0bc412bf2cf1ad504794be28f953e7716c307f8c3fb4838ef3dcf1fb8c1cd5101c7b3f962e1b928d0ef6c8b1cf60c04cbf65325a330cce271ff2209c737b6d8db452de5366c24c6c557"}) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$VHOST_GET_VRING_ENDIAN(r4, 0x4008af14, &(0x7f0000000000)={0x0, 0xc5a}) r6 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r7 = dup3(r0, r1, 0x0) dup2(r7, r6) 07:10:31 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) socket$inet6_sctp(0xa, 0x1863a9896614609f, 0x84) r1 = socket$kcm(0x10, 0x0, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) dup2(r1, r2) 07:10:31 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) r1 = socket$kcm(0x10, 0x2, 0x0) ioctl$KDSKBMODE(r0, 0x4b45, &(0x7f0000000000)=0x1) r2 = socket$kcm(0x10, 0x2, 0x0) dup2(r1, r2) [ 245.545177] binder_alloc: 14120: binder_alloc_buf, no vma [ 245.559152] binder: 14120:14131 ioctl 4008af14 20000000 returned -22 [ 246.306311] binder_alloc: 14120: binder_alloc_buf, no vma [ 246.312006] binder: 14120:14140 ioctl 4008af14 20000000 returned -22 07:10:34 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) setsockopt$packet_rx_ring(r2, 0x107, 0x5, &(0x7f0000000080)=@req3={0x5, 0xa64, 0x3, 0xfffffffe, 0xb2, 0x1a72, 0x1f}, 0x1c) openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput\x00', 0x2, 0x0) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000100)='/dev/snd/timer\x00', 0x100) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB='\ac\f@'], 0x0, 0x0, 0x0}) 07:10:34 executing program 2: r0 = perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x1, 0xffffffffffffffff, 0x0) r1 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) r2 = socket$kcm(0x10, 0x2, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) r4 = dup2(r3, r0) ioctl$EVIOCGREP(r4, 0x80084503, &(0x7f0000000000)=""/22) dup2(r2, r3) 07:10:34 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x4, 0x10001}, 0x0, 0x100000000}, 0x0, 0xffffffffffffffff, r2, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) r6 = dup3(r3, r4, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000002c0)={&(0x7f00000001c0)={0x14, 0xa, 0x6, 0x201, 0x0, 0x0, {0x0, 0x0, 0x1}}, 0x14}}, 0x4000004) dup2(r6, r5) [ 247.883371] binder: 14147:14150 unknown command 1074553607 [ 247.898338] binder: 14147:14150 ioctl c0306201 20000280 returned -22 [ 247.907490] binder_alloc: 14148: binder_alloc_buf, no vma [ 247.920669] binder: 14147:14154 unknown command 1074553607 [ 247.935909] binder: 14147:14154 ioctl c0306201 20000280 returned -22 [ 247.986069] binder: BINDER_SET_CONTEXT_MGR already set [ 247.991403] binder: 14148:14151 ioctl 40046207 0 returned -16 07:10:34 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) r1 = socket$kcm(0x10, 0x2, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) dup2(r1, r2) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x80000, 0x0) r4 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) fsetxattr$security_evm(r2, &(0x7f00000000c0)='security.evm\x00', &(0x7f0000000180)=@md5={0x1, "ba3e5e79fd894561c82199bf4e3b19d1"}, 0x11, 0x2) sendto$inet(r4, &(0x7f0000fa3fff)='\t', 0x1, 0x0, &(0x7f00006f7000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000000080)={0x2, [0x0, 0x0]}, &(0x7f0000a8a000)=0xc) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r4, 0x84, 0x6c, &(0x7f000059aff8)={r5}, &(0x7f000034f000)=0x2059b000) setsockopt$inet_sctp6_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000a40)=@assoc_value={r5}, 0x8) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r3, 0x84, 0x76, &(0x7f0000000040)={r5, 0x9}, &(0x7f0000000080)=0x8) 07:10:34 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$KDSETMODE(r3, 0x4b3a, 0x1) r4 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r6 = dup2(r5, r4) ioctl$BINDER_SET_CONTEXT_MGR(r6, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) setsockopt$IP_VS_SO_SET_DELDEST(r6, 0x0, 0x488, &(0x7f0000000000)={{0x1d, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e22, 0x3, 'ovf\x00', 0x8, 0x1f, 0x7e}, {@dev={0xac, 0x14, 0x14, 0x2b}, 0x4e21, 0x0, 0x101, 0x7ff, 0x4}}, 0x44) r7 = dup3(r0, r1, 0x0) dup2(r7, r2) 07:10:34 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) r1 = socket$kcm(0x10, 0x2, 0x0) prctl$PR_GET_KEEPCAPS(0x7) dup2(0xffffffffffffffff, r1) r2 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendto$inet(r2, &(0x7f0000fa3fff)='\t', 0x1, 0x0, &(0x7f00006f7000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000000080)={0x2, [0x0, 0x0]}, &(0x7f0000a8a000)=0xc) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r2, 0x84, 0x6c, &(0x7f000059aff8)={r3}, &(0x7f000034f000)=0x2059b000) setsockopt$inet_sctp6_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000a40)=@assoc_value={r3}, 0x8) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000000)={r3, @in6={{0xa, 0x4e21, 0x1ff, @mcast1}}, 0x1ff, 0x9, 0x8, 0x40, 0x0, 0x8, 0xf9}, &(0x7f00000000c0)=0x9c) [ 248.162158] binder_alloc: 14167: binder_alloc_buf, no vma 07:10:34 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5, 0x87a5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = dup3(r0, r1, 0x0) dup2(r3, r2) 07:10:34 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) r0 = socket$kcm(0x10, 0x2, 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) dup2(r0, r1) 07:10:34 executing program 1: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2020, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r2, 0x0, 0x60, &(0x7f0000000180)={'filter\x00', 0x7, 0x4, 0x3f8, 0x200, 0x0, 0x0, 0x310, 0x310, 0x310, 0x4, &(0x7f0000000000), {[{{@uncond, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0xfffffc00, 0x1, 0x2, 0x1}}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @mac=@remote, @loopback, @remote, 0x8, 0xffffffff}}}, {{@arp={@multicast1, @rand_addr=0x64010101, 0xffffff00, 0xffffffff, 0xd, 0x3, {@mac=@local, {[0x0, 0xff, 0x0, 0xff]}}, {@empty, {[0xff, 0xff]}}, 0x2, 0x1, 0x1, 0x0, 0x9, 0x5, 'bridge_slave_1\x00', 'veth1_vlan\x00', {}, {}, 0x0, 0x18b}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @loopback, @multicast1, 0x8, 0x1}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x448) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r4 = dup3(r0, r1, 0x0) dup2(r4, r3) 07:10:34 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="056304405603a050ad739cc13a5a7caae9c4ba8510e848257066bbced4bf77c29addaca161fc7fc29660ec69ca2fe08c"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000002c0)=ANY=[@ANYBLOB="852a74700000000000000000000000000000000000000000852a6c73000000000000000000000000000000000000000085616466000000000040000000000000000000000000000000000000000000006023ee47bae5787f2bf12fde93a04c81c57086a5e79b4f4a347316260470e306a3866218e92f346c1064a07ef818dfbebf76e819c355a49145137184a3abd558348987"], &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$BLKPBSZGET(r2, 0x127b, &(0x7f0000000000)) r3 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) r4 = socket$kcm(0x10, 0x2, 0x0) r5 = socket$kcm(0x10, 0x2, 0x0) dup2(r4, r5) [ 248.494647] cannot load conntrack support for proto=3 [ 248.505933] binder: 14201:14205 ioctl 127b 20000000 returned -22 07:10:34 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="00eb000082affdd1f927aa55b57b353beaa01736d5ec582eb6ddd8ee6339ce016c34657105bbe2221b91c87d9b2aabef39acc05a9b602e4e1b8215d788dceaaa8a907443e22ee0d10cb93a54b78b5650cc612a5d4c0447bbc428a727d4d2080accf90abf4b6f12fe052d01d7c80c663787770c47aeec3afaa87cf68e00314405a07842d78e0551c634cfd3409c5f372d7b959277582b9687ea6ba277a7ea1422ec8d20c932baf6"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) setsockopt$RXRPC_MIN_SECURITY_LEVEL(0xffffffffffffffff, 0x110, 0x4, &(0x7f0000000300)=0x2, 0x4) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x18, &(0x7f00000000c0)={@flat=@binder={0x70742a85, 0x100}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_GET(r2, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000480)={0x84, r3, 0x100, 0x70bd28, 0x25dfdbfe, {}, [@TIPC_NLA_SOCK={0x30, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_CON={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x9}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0xfffffffd}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x80000000}]}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x9b7}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0xbd}]}, @TIPC_NLA_MON={0x34, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x6a6}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x3}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x9}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x95}]}, @TIPC_NLA_NODE={0xc, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x3}]}]}, 0x84}, 0x1, 0x0, 0x0, 0x4004040}, 0x8044) ioctl$BLKSECDISCARD(r2, 0x127d, &(0x7f00000002c0)=0x5) perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) r5 = socket$kcm(0x10, 0x2, 0x0) r6 = socket$kcm(0x10, 0x2, 0x0) dup2(r5, r6) 07:10:34 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcsa\x00', 0x4000, 0x0) ioctl$ASHMEM_SET_PROT_MASK(r2, 0x40087705, &(0x7f0000000040)={0x6, 0x80000001}) r3 = dup3(r0, 0xffffffffffffffff, 0x0) dup2(r3, r1) r4 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r6 = dup2(r5, r4) ioctl$BINDER_SET_CONTEXT_MGR(r6, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) setsockopt$CAN_RAW_RECV_OWN_MSGS(r6, 0x65, 0x4, &(0x7f00000000c0), 0x4) [ 248.551063] binder: 14201:14205 ioctl 127b 20000000 returned -22 [ 248.637514] binder_alloc: 14216: binder_alloc_buf, no vma [ 248.651351] binder: 14216:14217 ioctl 127d 200002c0 returned -22 [ 248.665660] binder: BINDER_SET_CONTEXT_MGR already set [ 248.678291] binder: 14218:14220 ioctl 40046207 0 returned -16 07:10:34 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r4 = dup2(r3, r2) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$EVIOCGLED(r4, 0x80404519, &(0x7f0000000180)=""/4096) r5 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r6 = dup3(r0, r1, 0x0) dup2(r6, r5) [ 248.705611] binder: BINDER_SET_CONTEXT_MGR already set [ 248.710994] binder: 14216:14221 ioctl 40046207 0 returned -16 [ 248.723983] binder: 14216:14221 ioctl 127d 200002c0 returned -22 07:10:35 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = dup2(r2, r1) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)=ANY=[@ANYBLOB="852a7470000000000000000000000000852a6873000000000000000000000000000000000000856164660000000000000000000000000000000000000000000000000000000000000000b1d5dda39a22"], &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) epoll_ctl$EPOLL_CTL_DEL(r3, 0x2, r4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) r5 = socket$kcm(0x10, 0x2, 0x0) r6 = socket$kcm(0x10, 0x2, 0x0) dup2(r5, r6) [ 248.807638] binder_alloc: 14223: binder_alloc_buf, no vma [ 248.820739] binder: 14223:14224 ioctl 80404519 20000180 returned -22 07:10:35 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) r1 = socket$kcm(0x10, 0x2, 0x0) ioctl$sock_inet_tcp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000000)) r2 = socket$kcm(0x10, 0x2, 0x0) dup2(r1, r2) [ 248.850061] binder_alloc: 14228: binder_alloc_buf, no vma [ 248.878735] binder_alloc: 14228: binder_alloc_buf, no vma [ 248.928469] binder_alloc: 14223: binder_alloc_buf, no vma [ 248.942678] binder: 14223:14224 ioctl 80404519 20000180 returned -22 07:10:35 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = dup2(r2, r1) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) r4 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendto$inet(r4, &(0x7f0000fa3fff)='\t', 0x1, 0x0, &(0x7f00006f7000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000000080)={0x2, [0x0, 0x0]}, &(0x7f0000a8a000)=0xc) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r4, 0x84, 0x6c, &(0x7f000059aff8)={r5}, &(0x7f000034f000)=0x2059b000) setsockopt$inet_sctp6_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000a40)=@assoc_value={r5}, 0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000000)={r5, @in6={{0xa, 0x4e23, 0x9, @empty, 0xfffffffc}}, 0x7, 0x20, 0x0, 0x0, 0x0, 0x2, 0x3}, 0x9c) r6 = socket$kcm(0x10, 0x2, 0x0) r7 = socket$kcm(0x10, 0x2, 0x0) dup2(r6, r7) 07:10:35 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xe, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) dup3(r0, r1, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) socket$kcm(0x10, 0x2, 0x0) socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)}, 0x89) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) dup2(0xffffffffffffffff, r6) [ 249.079055] binder_alloc: 14244: binder_alloc_buf, no vma [ 249.107580] binder_alloc: 14244: binder_alloc_buf, no vma 07:10:35 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) ioctl$KVM_ENABLE_CAP(r2, 0x4068aea3, &(0x7f0000000000)={0x74, 0x0, [0xfffffffffffffff7, 0x32, 0x1, 0xffffffffffffffff]}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) r6 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r6, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$VIDIOC_G_CROP(r6, 0xc014563b, &(0x7f00000000c0)={0x8, {0x6, 0xfffffffa, 0x3, 0x57af}}) r7 = dup3(r3, r4, 0x0) dup2(r7, r5) 07:10:35 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) socket$nl_crypto(0x10, 0x3, 0x15) ioctl$VIDIOC_TRY_EXT_CTRLS(0xffffffffffffffff, 0xc0205649, &(0x7f0000000080)={0xf000000, 0x9, 0x1, r0, 0x0, &(0x7f0000000040)={0x2031c, 0x2, [], @p_u16=&(0x7f0000000000)=0x3f}}) prctl$PR_SET_THP_DISABLE(0x29, 0x1) ioctl$SIOCSIFHWADDR(r1, 0x8924, &(0x7f00000000c0)={'ipvlan1\x00', @dev={[], 0x1e}}) r2 = socket$kcm(0x10, 0x2, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) r4 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r6 = dup2(r5, r4) ioctl$BINDER_SET_CONTEXT_MGR(r6, 0x40046207, 0x0) getsockopt$inet_sctp6_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f00000001c0)={0x0, 0x2, 0x57e3, 0x5d}, &(0x7f0000000380)=0x10) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) getsockopt$inet6_IPV6_IPSEC_POLICY(r6, 0x29, 0x22, &(0x7f0000000280)={{{@in6=@ipv4, @in=@private}}, {{@in6=@loopback}, 0x0, @in6=@mcast1}}, &(0x7f0000000180)=0xe8) dup2(r2, r3) [ 249.258500] binder_alloc: 14257: binder_alloc_buf, no vma [ 249.277349] binder: 14257:14258 ioctl 4068aea3 20000000 returned -22 [ 249.332718] binder: BINDER_SET_CONTEXT_MGR already set [ 249.340585] binder: 14259:14262 ioctl 40046207 0 returned -16 [ 249.363665] binder_alloc: 14257: binder_alloc_buf, no vma [ 249.380325] binder: 14257:14258 ioctl 4068aea3 20000000 returned -22 07:10:35 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) r3 = fcntl$getown(r0, 0x9) perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x24, 0x0, 0x10000, 0x0, 0x0, 0x0, 0x2}, r3, 0x0, r2, 0x0) symlink(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='\x00') r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) r5 = socket$kcm(0x10, 0x2, 0x0) r6 = socket$kcm(0x10, 0x2, 0x0) dup2(r5, r6) 07:10:35 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = socket$kcm(0x10, 0x0, 0x0) sendmsg$kcm(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) fcntl$dupfd(r1, 0x0, r2) getsockopt$inet_mreqsrc(r0, 0x0, 0x26, &(0x7f0000000000)={@loopback, @multicast1}, &(0x7f0000000040)=0xc) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r4 = dup3(r0, r1, 0x0) dup2(r4, r3) [ 249.487460] binder_alloc: 14274: binder_alloc_buf, no vma [ 249.508131] binder: BINDER_SET_CONTEXT_MGR already set [ 249.513575] binder: 14274:14275 ioctl 40046207 0 returned -16 07:10:35 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@weak_binder={0x77622a85, 0x100b, 0x2}, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) sendmsg$IPSET_CMD_FLUSH(r2, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0xb39c752c937aa0eb}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x30, 0x4, 0x6, 0x301, 0x0, 0x0, {0x0, 0x0, 0x3}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x30}, 0x1, 0x0, 0x0, 0x6000}, 0x24000001) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x40082406, &(0x7f00000002c0)='/dev/binder#\x00') perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_POLICY_EX(r3, 0xc0096616, &(0x7f0000000300)={0x6, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) r5 = socket$kcm(0x10, 0x2, 0x0) r6 = socket$kcm(0x10, 0x2, 0x0) dup2(r5, r6) 07:10:35 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = dup3(r0, r1, 0x0) syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x1, 0x2) r4 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r6 = dup2(r5, r4) ioctl$BINDER_SET_CONTEXT_MGR(r6, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$VIDIOC_S_FREQUENCY(r6, 0x402c5639, &(0x7f0000000080)={0x2, 0x1}) dup2(r3, r2) [ 249.672890] binder_alloc: 14289: binder_alloc_buf, no vma [ 249.683008] binder: 14289:14290 ioctl 40082406 200002c0 returned -22 [ 249.693383] binder: BINDER_SET_CONTEXT_MGR already set [ 249.698826] binder: 14289:14290 ioctl 40046207 0 returned -16 [ 249.720492] binder: 14289:14290 ioctl 40082406 200002c0 returned -22 [ 249.741520] binder: 14291:14294 ioctl 402c5639 20000080 returned -22 07:10:36 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x100000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) r1 = socket$kcm(0x10, 0x2, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) dup2(r1, r2) [ 249.804555] binder: 14291:14301 ioctl 402c5639 20000080 returned -22 07:10:36 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = dup2(r2, r1) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$KVM_SIGNAL_MSI(r3, 0x4020aea5, &(0x7f0000000000)={0x2000, 0x1, 0x6, 0x8, 0x4fd}) r4 = socket$kcm(0x10, 0x2, 0x0) r5 = socket$kcm(0x10, 0x2, 0x0) dup2(r4, r5) 07:10:36 executing program 1: perf_event_open(&(0x7f0000000100)={0x5, 0x70, 0x67, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext={0x2110, 0x3}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = dup3(r0, r1, 0x0) dup2(r3, r2) r4 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="056304402f0644baf6f35375a59994fc175c24bf6ab1e73f93535713f5f4cf6d0894c178a950915e34bcd492195ab9365bcf91ff740db55e7687cb25c67040e5073b9c54265b50214d04003d381fa3d020f7f5270756bcf6f6031d9f9796731c3f47d717ac658cac0d5cc8d10ec2bef2c022a68c32fdff6422d108173ce8f23d270bb17bb2143579f07338bc8562645577d7453c989c4d3487201a77d4e1c0e958aa22631315d62632f59ce892c2dbf325ff5cf1bce671ae8b12f9c43bd4ede3ace86c3d1aa707e58b13ad5d139a118024459eef5d6aecbb962b68d5f81dbf0dea29ed4557a9f9faaff9727ecd5073bf49767813bba88d8ba3b70667dea2baae9a5b90732c773083166fd617a819f5d1cc88a01c2619dfb475cba2dd887433a3cbbfe80d05ec3933b54294829941ff650048d0e42c17bfc3652546e1e2b28374e12578d3cd1fc3eb8d8b3b92898896773b4c31c17e2c20f6b69feb0c352733cff581e91c8e43be7ab862f5bf824bb30a5fa8248cc1f5b819f4bf933631a6af8989f68ac20ad9c57114d560f94aaf22de3a22a12e107837fc5da48f062388c1ff51e5c734753238d0251e60b1fb887cb741d6eda35013c099ef330f79d29eec83988932080ee0"], 0x0, 0x0, 0x0}) r5 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) getsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r5, 0x84, 0x8, &(0x7f0000000180), &(0x7f00000001c0)=0x4) r6 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) r7 = dup2(r6, r4) ioctl$BINDER_SET_CONTEXT_MGR(r6, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle={0x73682a85, 0xa}, @fda={0x66646185, 0x0, 0x2}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 249.950696] binder_alloc: 14309: binder_alloc_buf, no vma [ 249.962411] binder: 14309:14311 ioctl 4020aea5 20000000 returned -22 [ 249.988351] binder: 14310:14312 unknown command 0 07:10:36 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) r1 = dup2(0xffffffffffffffff, r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) r2 = socket$kcm(0x10, 0x2, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) r4 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r6 = dup2(r5, r4) ioctl$BINDER_SET_CONTEXT_MGR(r6, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) accept$packet(r6, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000080)=0x14) r7 = dup2(r2, r3) ioctl$sock_SIOCSIFVLAN_GET_VLAN_INGRESS_PRIORITY_CMD(r7, 0x8983, &(0x7f0000000000)) [ 250.006503] binder: 14310:14312 ioctl c0306201 20000200 returned -22 [ 250.013822] binder_alloc: 14309: binder_alloc_buf, no vma [ 250.019658] binder: 14309:14311 ioctl 4020aea5 20000000 returned -22 [ 250.062202] binder: 14310:14318 unknown command 0 [ 250.067185] binder: 14310:14318 ioctl c0306201 20000200 returned -22 07:10:36 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc94, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10000, 0xb9a2}, 0x4, 0x0, 0x0, 0x1}, 0x0, 0xc, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = dup3(r0, r1, 0x0) dup2(r3, r2) [ 250.117152] binder_alloc: 14324: binder_alloc_buf, no vma [ 250.156491] binder: BINDER_SET_CONTEXT_MGR already set [ 250.162522] binder: 14324:14326 ioctl 40046207 0 returned -16 07:10:36 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="056323fb"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="f8623f6e"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$VIDIOC_S_CTRL(0xffffffffffffffff, 0xc008561c, &(0x7f00000001c0)={0x7}) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000340)=ANY=[@ANYRESHEX=r2], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$UI_GET_SYSNAME(r2, 0x8040552c, &(0x7f0000000000)) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) ioctl$VT_RESIZE(r2, 0x5609, &(0x7f0000000180)={0x2, 0x7f, 0x401}) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) r6 = dup3(r3, r4, 0x0) dup2(r6, r5) 07:10:36 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) ioctl$FS_IOC_FSGETXATTR(r1, 0x801c581f, &(0x7f0000000000)={0x1, 0x59, 0x15e00, 0x0, 0x3}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) r2 = socket$kcm(0x10, 0x2, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) dup2(r2, r3) [ 250.344916] binder: 14338:14339 unknown command -81566971 [ 250.350542] binder: 14338:14339 ioctl c0306201 20000200 returned -22 [ 250.381289] binder: 14338:14339 unknown command 808482864 07:10:36 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) r1 = socket$kcm(0x10, 0x2, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000000), &(0x7f0000000040)=0xc) dup2(r1, r2) [ 250.392048] binder: 14338:14339 ioctl c0306201 200002c0 returned -22 [ 250.412120] binder: 14338:14339 ioctl 8040552c 20000000 returned -22 [ 250.419232] binder: 14338:14339 ioctl 5609 20000180 returned -22 [ 250.492667] binder: 14338:14349 unknown command -81566971 [ 250.498246] binder: 14338:14349 ioctl c0306201 20000200 returned -22 [ 250.512565] binder: 14338:14339 unknown command 808482864 [ 250.522556] binder: 14338:14339 ioctl c0306201 200002c0 returned -22 [ 250.530357] binder: 14338:14349 ioctl 8040552c 20000000 returned -22 07:10:36 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000180)={0x0}, &(0x7f00000001c0)=0xc) prctl$PR_SET_PTRACER(0x59616d61, r1) perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x2, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x2, @perf_config_ext={0x5, 0xfef}, 0x43000, 0xd881, 0x0, 0x1, 0x0, 0x7}, r1, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000040)={r2}) getsockopt$inet_sctp6_SCTP_EVENTS(r3, 0x84, 0xb, &(0x7f0000000080), &(0x7f00000000c0)=0xe) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x410000, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) r5 = socket$kcm(0x10, 0x2, 0x0) r6 = socket$kcm(0x10, 0x2, 0x0) dup2(r5, r6) [ 250.538986] binder: 14338:14351 ioctl 5609 20000180 returned -22 07:10:36 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) r1 = socket$kcm(0x10, 0x2, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) ioctl$ASHMEM_GET_PROT_MASK(r0, 0x7706, &(0x7f0000000000)) dup2(r1, r2) 07:10:36 executing program 1: r0 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000000), 0x4) write$binfmt_misc(r0, &(0x7f0000000180)={'syz1', "d815e92faddb46d1a337f5b30e92ca7e117b25c626af3f4de6aca55582d2b1bf46283aabcf73346c90a72053256aab8b7190a51dabc525c1f58c10d6b21b"}, 0x42) perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = dup3(r1, r2, 0x0) r5 = add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) request_key(&(0x7f0000000080)='encrypted\x00', &(0x7f00000000c0)={'syz', 0x2}, &(0x7f0000000280)='selinux.\x00', r5) add_key(&(0x7f0000000100)='encrypted\x00', &(0x7f0000000140)={'syz', 0x2}, &(0x7f0000000540), 0x0, r5) keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f0000000040)={r5, 0xbc, 0x3}, &(0x7f0000000200)={'enc=', 'raw', ' hash=', {'crct10dif-pclmul\x00'}}, &(0x7f0000000280)="d8c89663fdcf5f6e618ec783fc582bb6e877e81d67204c1a9b3138a650a15fa874a6991f63140a1788a42660134315b9458518c2245169eb7d97ba898f17534e12d90e16a91711eab89af4b0e24caa58e2e4ad2f63ad4690d1198cd15f4137836fe403115fc58e9ea1975379758a28756aa7188e14de511e862668800c90aada831857adaef5bffb1ef0a54605b85ab2a0ecbfb934d830335ae54431ed6be6aea35f844da8cda7903ee5378c7805a5d5a6fb58518cec14fe629662fc", &(0x7f00000000c0)=""/3) dup2(r4, r3) 07:10:37 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xffffffffffffffb1, 0x20}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) socket$kcm(0x10, 0x2, 0x0) write$FUSE_POLL(r0, &(0x7f0000000000)={0x18, 0xfffffffffffffffe, 0x3, {0x401}}, 0x18) socket$kcm(0x10, 0x2, 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) socket$pppoe(0x18, 0x1, 0x0) dup2(r2, 0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x2000002, 0x8011, r4, 0x3ef2c000) 07:10:37 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="06630440ab384ee1f49489a2eb3aa05ecf0af49d3d9323f23db7290ad189e93a59e1275fb6562b429ce9f49eddc64b86408f0a5f0300000086393d804b7bec532bbb748b7410bd67dd3c96bb22272f9d500f17db4160e3b2bf3179081f113c14d021f2f549f0e8d3056c8ed251"], 0x0, 0x0, 0x0}) r3 = dup2(r2, r1) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05080540"], 0x0, 0x0, 0x0}) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$SOUND_MIXER_READ_CAPS(r4, 0x80044dfc, &(0x7f0000000180)) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$KVM_GET_API_VERSION(r3, 0xae00, 0x0) r5 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) r7 = dup3(r0, r5, 0x0) dup2(r7, r6) [ 250.921066] binder: 14380:14381 unknown command 1074071557 [ 250.927015] binder: 14380:14381 ioctl c0306201 20000280 returned -22 [ 250.940462] binder: 14380:14381 ioctl ae00 0 returned -22 07:10:37 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040)='nl80211\x00') r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) r4 = openat$null(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/null\x00', 0x0, 0x0) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r3, &(0x7f0000000c00)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000b80)={0x1c, r1, 0x100, 0x70bd29, 0x25dfdbfc, {}, [@NL80211_ATTR_NETNS_FD={0x8, 0xdb, r4}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20040000}, 0x20004010) r5 = socket(0x10, 0x803, 0x0) sendmsg$BATADV_CMD_GET_MESH(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={0x0, 0x8}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="38000000100039af00"/20, @ANYRES32=0x0, @ANYBLOB="001500009b0000001800128008000100736974000c00028008000100", @ANYRES32=r6], 0x38}}, 0x0) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000000)={@private2, r6}, 0x14) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000080)={&(0x7f0000000280)={0x8cc, r1, 0x200, 0x70bd27, 0x25dfdbfb, {}, [@NL80211_ATTR_IFINDEX={0x8, 0x3, r6}, @NL80211_ATTR_IE_ASSOC_RESP={0x89d, 0x80, "b513042ac2fb741b4ea5a50b1bee097ef5556da2fd07ba50856166b2f706c5e6d171d5c54fcef40daeb0db881b137dc4c4a2eac7145f4a96edb8e8e5c169f41c22ab1f3ba4a4ce584704ba453fcfe6a83d0e2f167542d43ae9f41b04199b690832dbf75cc04f9ce75e41f34e1295491c50b8672026d135823076d744c0ceba0e043a823a2de32d12cdcf7f4cfedba54d117809ba62fc9c7a1c074005b9e420321202ac8c704738b50a0f2a7382e6f0d83bc8fb1144207bbc2aad7f72d121099668946704c113c5be912d6e466430a2fb5ba456c32ea336f33beef100daeabb0ff3180ffe46cba81cbf264917de23c29181a702c9cfbca9f3b4b60c4323bb2191e3a5ac8827b77bf310e165725d6e032b29c408731825b5615238631ffe313399dc15880f40030180f42f7984ce7db1f46350c2d64f3d794e3db3cbaf22fcf9ba062b3306f5534aba169648936539db0a1efd8051f8640bc952b568d1939012a697ac9f578b17f04590b5834cc492f243b9527f58bad2611369834a7b957bce94487e1392cddf506421c749de57f4d7653545304c88541fed573ba479afdbe5568d744781842238402ade105a146581992859c91d2ab9c4313e4b2c3c9fd5f190446803cdb2e08d783d9e269db4ced93f0a72bbe0ff67f9b16cd7df93bf47644874bb27f64d346a4a0c52ff0c261c6dc8e989f3652b2d2f5cc0c724962bdedbb10a2411afa4f15ba7c68dfd397acc63474322fb84aa8dd37ded1f739ebb8c0b6b559dd0601de866309b372f3cbeef4dac2117003688caf250c981382a2f4c30885ba56c5e4fb8437b84ecc16f3efda7eaf2fdbde2184445aa59b186c5b41c2d901e2328424c6c7f596ff8c183bf9c0e08fb054e9d5f466776a6f7687a528979c3b48e17cf26aedf0fc3450b658e13409337324527f218763e1c0aad0b484b10fa105581d5f157ad67f11180e34996842364bd8bbcc3585d223445e329f57d6db3741fb68a6cc7a1227231993fd1e8f14148ac892a9ee762bdef14e2e76b6fddde7a8cade8c32c7ac780ec24de6e649476c07e7689f3eaae86524d58b9f0474f80cb951664ac63e33a6cea3ba77c1cb7167a063555d020ad865446ffcf5b8362ccdbaa26bd97704c65aa5b66d8ce5e88670fac61fe0353dca21e8c38092679fe41c43115460231e7b1771299174ef2ddb1305e6e3c1bf9acf731902fe52b5f8e8a909f85e49a9438568cbe23e433b84857552796406802ced192d217bfb4f335eb1d83158ea060c65ba6207c36f7047edc147665670da0fd1cc38ef42e6187cd47bf6b383a7a3cd28cd4659e134423562ff891a67a39fc20ff1d5ae313735b3c1bcf041517d4b49eedd8b792a7bbe7c02605f478715cceda0aa6bcad2fbba07d39bf5b3e570aef4c848539f33adc43d41324aad9353de31ad1022466d3b954bb22ea0800faac2b2ad96462a76c1e72e078da95b2401d709421859827da7c6dacfc7f7dd3e7365d98eb247be3b49d35c36d3e968a26259122b83c8aef251f32a6fd2337a3af326e9de9f51e985e269442e7cab8964074328ea7799ba8c4f529a3e8d6420d132d76a073852ecaa9b28fa7d1ad8b2430726d122575ff5cdf703f239ef52587b329cf326a09c10ed5af02a057021dba9d5993b190ddde4aac83278cda8281d5b420501b820884fe322b0972c0447c4e517ec0e62b3e5b2a522f72b4755220d3f3e7b9568ff7dfdea3b0826438211da1745d3b2a45e54031e53134ab74b51dc39e203bde9e50b2223b42fb33b46c0583306f802d688e32453b86ec3ee468a680cb8dea4b0be28308af6a3d7720e076c4c453094e5e1f488b9dea8b255597911f1f08bf9307531fd8f8c36eaff5a808a872cf981a88ff07624f237a133efaec7f4e529f58a2a561685e8ab3a8677c99c19699e1f4ef374dd789a676140d7de01c43a4576cfa92b44225e0ad3f1dee0c98de33dbfdf5ba85fd262d155b827cd448bca0bed3bc81dbd72a3df9a6334b56248a07057151f641cb354fae4464881864bdce404428a376f5989e61d9bc38f1bdf0adcd484d13386a2992b994025fca61e8e6b61672ea62405e0b78ca0a9ce8613cf5b58ae8620f9e9396e56d81bc37ac42d52497d065617728e9b011bfeb1a84d13e1d58a12d44e183c30f42f320a53ffe6c420d02ce2d45895fdd1c36750e20b9c8adea6866c5967b0aa6594624f58d9878f2f72615b1ef4785aab12a4a10027bede3ca3ac4004e939940a86f51e760b2621b1c9fc1f2423e93f78d38e8d422bc316d705ac70b3422b245d6936f7c946dc1c3ba5952dfbaf5fb86eeefa32f213ab43979f193b98ebf938caabf9bc2f3ce3bccc621709d3a9b5bf1829a1907fa6d4dc2770f477001f75de3f6c96aee0557f9a4ee67708fa0f1ca91960f1c1f59d8ef5ce8bec44c3aebc14249afff4504eb674e41ce7cdde11cb8398b418e83fad456f8dc8c724741b19d2e16bf30239c8a0b282094aa71e54e95363d709f76d406d586b574afb00dfa50768a9440c1cfa5225aa061262b770c8d35cf86706ef7bebe536e4b5ef88075fc13526e57490208721e3de247446847fe6edf7b64c66aebd4a338dc664697217c301f67480eae22b6cc811aede63c908ecdf51474d418d0329084abd2062dc82bd1dcf6de699fafa67c7953decfba9f602966b6093440e7771021d9a1dd7ca48121db8680c24f2afa4840cc106bb2522d428152c84335c3665654c529d3ed5d166e2f7d8698554d0da5651d70b0cf8baa054a72632b849e38ed9425b548194668df9f13f03962fd2f5b577b7207711b98016038bb972438c66444fb547a030e3214bc0716d73f9b9329b55e684a717eaa4461611554aea3907c7a16d675a634fcda9bc5890333a3471aaf58eaa548ac5b2a33c285fdb27c726ba7b399905409c621382f50d156dd75d4c558ae9e568beec61eee57b885f7befd079ff1e6d7ff2c6bf09bb211083f0f6c749d3ede6f80d18ef00b81cddfed400e6dae5ece6aff9fd1c015bab4d285123f9353d918908da548085105ff22685c91e5df18754bc545ba708bab97cdb8da6e36378b9125024f334c2696833d3d0dc48204cc"}, @NL80211_ATTR_AUTH_TYPE={0x8, 0x35, 0x2}, @NL80211_ATTR_WPA_VERSIONS={0x8, 0x4b, 0x6}]}, 0x8cc}, 0x1, 0x0, 0x0, 0x4040}, 0xc8d0) r7 = socket$kcm(0x10, 0x2, 0x0) r8 = socket$kcm(0x10, 0x2, 0x0) dup2(r7, r8) [ 250.974470] binder: 14380:14386 unknown command 1074071557 [ 250.980325] binder: 14380:14386 ioctl c0306201 20000280 returned -22 [ 250.988542] binder: 14380:14381 ioctl ae00 0 returned -22 07:10:37 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = syz_init_net_socket$nl_rdma(0xffffffffffffffff, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_RES_MR_GET(r3, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x18, 0x140d, 0x530, 0x70bd29, 0x25dfdbfd, "", [@RDMA_NLDEV_ATTR_RES_MRN={0x8}]}, 0x18}, 0x1, 0x0, 0x0, 0x80}, 0x40000) r4 = dup3(r0, r1, 0x0) dup2(r4, r2) 07:10:37 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/meminfo\x00', 0x0, 0x0) accept4$inet6(r0, 0x0, &(0x7f00000001c0), 0x80800) r1 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) ioctl$PPPIOCGL2TPSTATS(r1, 0x80487436, &(0x7f0000000000)="55f1caab2c056d5fd56554fe6789ddac39766d0b235bc190") openat$autofs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/autofs\x00', 0x10842, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_NONCE(r4, 0x8010661b, &(0x7f0000000080)) dup2(r2, r3) 07:10:37 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000000)={{0x0, 0xa0}, 0x1, 0x9, 0x2, {0x2, 0x1}, 0x20, 0xffffffff}) r3 = dup3(r0, r1, 0x0) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r4, 0x6611) dup2(r3, r2) 07:10:37 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) r1 = socket$kcm(0x10, 0x2, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) dup2(r1, r2) r3 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r5 = dup2(r4, r3) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) recvmsg$can_bcm(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f0000000180)=@in={0x2, 0x0, @initdev}, 0x80, &(0x7f0000000500)=[{&(0x7f00000002c0)=""/199, 0xc7}, {&(0x7f00000003c0)=""/187, 0xbb}, {&(0x7f0000000480)=""/128, 0x80}, {&(0x7f00000005c0)=""/78, 0x4e}], 0x4, &(0x7f0000000640)=""/76, 0x4c}, 0x2042) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$TIOCMBIS(r5, 0x5416, &(0x7f0000000000)=0x3) 07:10:37 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = dup3(r0, r1, 0x0) dup2(r3, r2) 07:10:37 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) r1 = socket$kcm(0x10, 0x2, 0x0) ioctl$VIDIOC_S_PRIORITY(r0, 0x40045644, 0x1) r2 = socket$kcm(0x10, 0x2, 0x0) dup2(r1, r2) [ 251.358222] binder_alloc: 14418: binder_alloc_buf, no vma [ 251.385794] binder: 14418:14424 ioctl 5416 20000000 returned -22 07:10:37 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r2 = dup3(r0, r1, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) socket$kcm(0x10, 0x2, 0x0) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) sendmsg$kcm(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000340)="2e000000110081f4040f80ecdb4cb92eff796ce1427ee0fde3bd6efb250009000e0500f7ff10b0eebb25f892821fbca7018a2e837c682268bb21e0f59712c41b39e81f3b93341d5a2d175f34d64ac8a86929667a53d4ebbc9c27c1c63039d7ada1cdc3df7fd2354116a8689f35a6ad456ac720c0688e481db717cad12050fe40cda4d8a616a5039f9e035f9a5877786ee54f032c51719f34cef8286240c7880f4db41aa0e77a0b20ae59602d2a8078020ccccfaf573c48ff78ac831530876f800cdb2c5766af5006855e2e0a34845aef9f1b85ced4dd9750ca9dc85acfb963655bc46b1add58c26b156831b832e1515d88fe2de2559724a81ac837b4c95974c94fa8e66d116cf18d57c12717fc916b90e5dea42c53bf73f75104875395b8f0399d1898943353928507c08d0b469dd78d4cec946925946d074978291bd5e356ac90107ed2e09620e9d7b4ff21375887d23f2e4f75c228b8b445d7436d6af7af7350272651d4c0358280354397cadc2e8b6faa0548e25c84efc338d990d4c28c0154844bc8833b0a3f742865ff7f000000000000", 0x193}], 0x1}, 0x40000) r5 = socket$kcm(0x10, 0x2, 0x0) ioctl$DRM_IOCTL_MODE_CREATEPROPBLOB(0xffffffffffffffff, 0xc01064bd, &(0x7f00000000c0)={&(0x7f0000000000)="1fdaad79f8", 0x5, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROYPROPBLOB(r2, 0xc00464be, &(0x7f00000001c0)={r6}) sendmsg$kcm(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) dup2(r5, r3) 07:10:37 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380), 0x0, 0x73b000, 0x0}) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000340)=0x1, 0x4) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = dup3(r0, r1, 0x0) dup2(r3, r2) r4 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r6 = dup2(r5, r4) ioctl$BINDER_SET_CONTEXT_MGR(r6, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="05230440a296c4281871bfe5774dc199f8dcf2389c3426013d9f000000791222e1948cc99e2645cb453a97c060981d717b"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x18, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@binder={0x73622a85, 0x110b, 0x2}, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) sendmsg$NFNL_MSG_COMPAT_GET(r6, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000040)={&(0x7f0000000240)={0x44, 0x0, 0xb, 0x201, 0x0, 0x0, {0x0, 0x0, 0x9}, [@NFTA_COMPAT_NAME={0xd, 0x1, '/dev/kvm\x00'}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_COMPAT_TYPE={0x8}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x40000001) r7 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/sequencer2\x00', 0x4000, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r7, 0x28, 0x0, &(0x7f0000000300)=0x101, 0x8) ioctl$VIDIOC_G_JPEGCOMP(r3, 0x808c563d, &(0x7f0000000180)) [ 251.560408] netlink: 14 bytes leftover after parsing attributes in process `syz-executor.0'. [ 251.625330] netlink: 14 bytes leftover after parsing attributes in process `syz-executor.0'. [ 251.661805] netlink: 14 bytes leftover after parsing attributes in process `syz-executor.0'. 07:10:37 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x2, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = dup3(r0, r1, 0x0) dup2(r3, r2) [ 251.757110] binder: 14451:14455 unknown command 1074012933 [ 251.775621] binder: 14451:14455 ioctl c0306201 20000280 returned -22 07:10:38 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r1 = dup2(r0, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) r2 = openat$cgroup_ro(r1, &(0x7f0000000000)='io.stat\x00', 0x0, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) close(r3) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f0000000000)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r4, &(0x7f00000000c0)={0x14, 0x88, 0xfa00, {r5, 0x30, 0x0, @ib={0x1b, 0x0, 0x0, {"0000000000000500"}}}}, 0x90) write$RDMA_USER_CM_CMD_QUERY(r3, &(0x7f0000000580)={0x13, 0x10, 0xfa00, {&(0x7f0000000380), r5, 0x2}}, 0x18) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r2, &(0x7f0000000040)={0x4, 0x8, 0xfa00, {r5, 0x9}}, 0x10) r6 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) r7 = socket$kcm(0x10, 0x2, 0x0) r8 = socket$kcm(0x10, 0x2, 0x0) dup2(r7, r8) 07:10:38 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = dup3(r0, r1, 0x0) sendmsg$key(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x2, 0x4, 0x20, 0x8, 0x26, 0x0, 0x70bd2d, 0x25dfdbfc, [@sadb_key={0x12, 0x9, 0x428, 0x0, "68eea4dae5526ba16b1e7cc3252b409d23fc75471835953d61b6fdc8b2cf73be500505b8386b676cfccf38d5ee00b723ee6aa7cb1f612cb9c81a22321c5a07a85a145c950c157ece5f9f811c9af4c70045e756ce4b8def6386fcc52b3f3c5e662b4174dfa4ab6a3964bf583ef424bd406cf59a9b3f15bff00d18d3228f89d2c049551f9218"}, @sadb_x_policy={0x8, 0x12, 0x0, 0x7, 0x0, 0x0, 0x9, {0x6, 0xff, 0x1f, 0x0, 0x0, 0xd422, 0x0, @in=@loopback, @in6=@loopback}}, @sadb_spirange={0x2, 0x10, 0x4d6, 0x4d2}, @sadb_x_policy={0x8, 0x12, 0x3, 0x0, 0x0, 0x6e6bb4, 0x7ff, {0x6, 0x6c, 0x3f, 0x7, 0x0, 0x8be, 0x0, @in=@empty, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}]}, 0x130}}, 0x20044000) dup2(r3, r2) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x400200, 0x0) [ 251.828163] binder: BINDER_SET_CONTEXT_MGR already set [ 251.833725] binder: 14451:14469 unknown command 1074012933 [ 251.849418] binder: 14451:14463 ioctl 40046207 0 returned -16 [ 251.858966] binder: 14451:14469 ioctl c0306201 20000280 returned -22 07:10:38 executing program 1: r0 = perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) dup(r0) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = dup2(r2, r1) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r3, 0xc0305615, &(0x7f0000000000)={0x0, {0x2, 0x9}}) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) r7 = dup3(r4, r5, 0x0) dup2(r7, r6) 07:10:38 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) r1 = socket$kcm(0x10, 0x2, 0x0) setsockopt$netrom_NETROM_N2(r0, 0x103, 0x3, &(0x7f0000000000)=0x10000, 0x4) r2 = socket$kcm(0x10, 0x2, 0x0) dup2(r1, r2) [ 252.008257] binder_alloc: 14485: binder_alloc_buf, no vma [ 252.025984] binder: 14485:14488 ioctl c0305615 20000000 returned -22 07:10:38 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380), 0x0, 0x73b000, 0x0}) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000340)=0x1, 0x4) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = dup3(r0, r1, 0x0) dup2(r3, r2) r4 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r6 = dup2(r5, r4) ioctl$BINDER_SET_CONTEXT_MGR(r6, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="05230440a296c4281871bfe5774dc199f8dcf2389c3426013d9f000000791222e1948cc99e2645cb453a97c060981d717b"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x18, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@binder={0x73622a85, 0x110b, 0x2}, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) sendmsg$NFNL_MSG_COMPAT_GET(r6, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000040)={&(0x7f0000000240)={0x44, 0x0, 0xb, 0x201, 0x0, 0x0, {0x0, 0x0, 0x9}, [@NFTA_COMPAT_NAME={0xd, 0x1, '/dev/kvm\x00'}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_COMPAT_TYPE={0x8}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_COMPAT_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x40000001) r7 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/sequencer2\x00', 0x4000, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r7, 0x28, 0x0, &(0x7f0000000300)=0x101, 0x8) ioctl$VIDIOC_G_JPEGCOMP(r3, 0x808c563d, &(0x7f0000000180)) [ 252.127967] binder_alloc: 14485: binder_alloc_buf, no vma [ 252.137487] binder: 14485:14501 ioctl c0305615 20000000 returned -22 07:10:38 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x2, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000003c0), 0x6}, 0x20}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r4 = dup2(r3, r2) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) pselect6(0x40, &(0x7f0000000180)={0x2e, 0xfffffffffffffff7, 0x800, 0x7fffffff, 0x1ff, 0x101, 0xffffffff, 0x96b6}, &(0x7f00000001c0)={0x3, 0x8, 0x1, 0x9, 0x0, 0x5, 0x5, 0x4}, &(0x7f00000002c0)={0x0, 0x3, 0x7, 0x802000, 0x8, 0x100000000, 0x3, 0x8000000000000000}, &(0x7f0000000300)={0x0, 0x3938700}, &(0x7f0000000380)={&(0x7f0000000340)={[0x2]}, 0x8}) ioctl$RTC_UIE_OFF(r4, 0x7004) ioctl$KVM_PPC_GET_PVINFO(r1, 0x4080aea1, &(0x7f0000000000)=""/42) r5 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r6 = dup3(r0, r1, 0x0) dup2(r6, r5) 07:10:38 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = dup3(r0, r1, 0x0) dup2(r3, r2) r4 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r6 = dup2(r5, r4) r7 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r7, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x18, &(0x7f00000000c0)={@flat=@weak_binder={0x77622a85, 0x1100}, @flat=@handle, @fda={0x66646185, 0x9}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r6, 0x40046207, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f0000000180)={&(0x7f0000ffe000/0x1000)=nil, 0x1000}, &(0x7f00000001c0)=0x10) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x18, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 252.288265] binder_alloc: 14511: binder_alloc_buf, no vma [ 252.303546] binder: 14511:14512 ioctl 7004 0 returned -22 [ 252.316683] binder: 14503:14507 unknown command 1074012933 [ 252.324171] binder: 14503:14507 ioctl c0306201 20000280 returned -22 07:10:38 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r2 = dup3(r0, r1, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) socket$kcm(0x10, 0x2, 0x0) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) sendmsg$kcm(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000340)="2e000000110081f4040f80ecdb4cb92eff796ce1427ee0fde3bd6efb250009000e0500f7ff10b0eebb25f892821fbca7018a2e837c682268bb21e0f59712c41b39e81f3b93341d5a2d175f34d64ac8a86929667a53d4ebbc9c27c1c63039d7ada1cdc3df7fd2354116a8689f35a6ad456ac720c0688e481db717cad12050fe40cda4d8a616a5039f9e035f9a5877786ee54f032c51719f34cef8286240c7880f4db41aa0e77a0b20ae59602d2a8078020ccccfaf573c48ff78ac831530876f800cdb2c5766af5006855e2e0a34845aef9f1b85ced4dd9750ca9dc85acfb963655bc46b1add58c26b156831b832e1515d88fe2de2559724a81ac837b4c95974c94fa8e66d116cf18d57c12717fc916b90e5dea42c53bf73f75104875395b8f0399d1898943353928507c08d0b469dd78d4cec946925946d074978291bd5e356ac90107ed2e09620e9d7b4ff21375887d23f2e4f75c228b8b445d7436d6af7af7350272651d4c0358280354397cadc2e8b6faa0548e25c84efc338d990d4c28c0154844bc8833b0a3f742865ff7f000000000000", 0x193}], 0x1}, 0x40000) r5 = socket$kcm(0x10, 0x2, 0x0) ioctl$DRM_IOCTL_MODE_CREATEPROPBLOB(0xffffffffffffffff, 0xc01064bd, &(0x7f00000000c0)={&(0x7f0000000000)="1fdaad79f8", 0x5, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROYPROPBLOB(r2, 0xc00464be, &(0x7f00000001c0)={r6}) sendmsg$kcm(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) dup2(r5, r3) [ 252.414930] binder_alloc: 14511: binder_alloc_buf, no vma [ 252.443431] binder: 14511:14520 ioctl 7004 0 returned -22 07:10:38 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r2 = dup3(r0, r1, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) socket$kcm(0x10, 0x2, 0x0) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) sendmsg$kcm(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000340)="2e000000110081f4040f80ecdb4cb92eff796ce1427ee0fde3bd6efb250009000e0500f7ff10b0eebb25f892821fbca7018a2e837c682268bb21e0f59712c41b39e81f3b93341d5a2d175f34d64ac8a86929667a53d4ebbc9c27c1c63039d7ada1cdc3df7fd2354116a8689f35a6ad456ac720c0688e481db717cad12050fe40cda4d8a616a5039f9e035f9a5877786ee54f032c51719f34cef8286240c7880f4db41aa0e77a0b20ae59602d2a8078020ccccfaf573c48ff78ac831530876f800cdb2c5766af5006855e2e0a34845aef9f1b85ced4dd9750ca9dc85acfb963655bc46b1add58c26b156831b832e1515d88fe2de2559724a81ac837b4c95974c94fa8e66d116cf18d57c12717fc916b90e5dea42c53bf73f75104875395b8f0399d1898943353928507c08d0b469dd78d4cec946925946d074978291bd5e356ac90107ed2e09620e9d7b4ff21375887d23f2e4f75c228b8b445d7436d6af7af7350272651d4c0358280354397cadc2e8b6faa0548e25c84efc338d990d4c28c0154844bc8833b0a3f742865ff7f000000000000", 0x193}], 0x1}, 0x40000) r5 = socket$kcm(0x10, 0x2, 0x0) ioctl$DRM_IOCTL_MODE_CREATEPROPBLOB(0xffffffffffffffff, 0xc01064bd, &(0x7f00000000c0)={&(0x7f0000000000)="1fdaad79f8", 0x5, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROYPROPBLOB(r2, 0xc00464be, &(0x7f00000001c0)={r6}) sendmsg$kcm(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) dup2(r5, r3) [ 252.495094] netlink: 14 bytes leftover after parsing attributes in process `syz-executor.2'. [ 252.523530] binder: BINDER_SET_CONTEXT_MGR already set [ 252.533463] binder: 14517:14531 ioctl 40046207 0 returned -16 07:10:38 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = dup3(r0, r1, 0x0) dup2(r3, r2) r4 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r6 = dup2(r5, r4) ioctl$BINDER_SET_CONTEXT_MGR(r6, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000180)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0563dce50bb27a1ab7c575e650f8d9de5baa693bf52e616effa8e30ab333dd88c37706a0749e85fee2d10668a372731b8b777e2cf502b2db586dad88d361a57cce3a74f0d86f142b63b68d"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$SG_SET_RESERVED_SIZE(r6, 0x2275, &(0x7f0000000000)=0x800) 07:10:38 executing program 1: perf_event_open(&(0x7f0000000100)={0x3, 0x70, 0xd5, 0x10, 0x3, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0xc820, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) r2 = dup3(r0, 0xffffffffffffffff, 0x0) dup2(r2, r1) [ 252.686182] netlink: 14 bytes leftover after parsing attributes in process `syz-executor.2'. 07:10:39 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = dup3(r0, r1, 0x0) dup2(r3, r2) r4 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r6 = dup2(r5, r4) r7 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r7, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x18, &(0x7f00000000c0)={@flat=@weak_binder={0x77622a85, 0x1100}, @flat=@handle, @fda={0x66646185, 0x9}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r6, 0x40046207, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f0000000180)={&(0x7f0000ffe000/0x1000)=nil, 0x1000}, &(0x7f00000001c0)=0x10) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x18, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 252.776676] binder: 14544:14545 unknown command -438541563 [ 252.811187] binder: 14544:14545 ioctl c0306201 20000180 returned -22 07:10:39 executing program 1: r0 = perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r0, 0x400c6615, &(0x7f0000000000)={0x0, @aes128}) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) r5 = dup3(r1, r4, 0x0) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r6, 0x6611) dup2(r5, r3) [ 252.829283] binder: 14544:14545 ioctl 2275 20000000 returned -22 [ 252.856741] binder: 14544:14559 unknown command -438541563 [ 252.874281] binder: 14544:14559 ioctl c0306201 20000180 returned -22 [ 252.896863] binder: 14544:14556 ioctl 2275 20000000 returned -22 07:10:39 executing program 0: r0 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/nvme-fabrics\x00', 0x305880, 0x0) perf_event_open(&(0x7f0000000100)={0x3, 0x70, 0xd7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80}, 0x0, 0x7, 0x0, 0x0, 0x80000000, 0x100}, 0x0, 0x0, r0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = dup3(0xffffffffffffffff, r2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r3, 0x29, 0x3b, &(0x7f0000000000)={0x16, 0x7, [], [@ra={0x5, 0x2, 0x8}, @jumbo={0xc2, 0x4, 0xffffffff}, @calipso={0x7, 0x28, {0x0, 0x8, 0x8, 0x5, [0x80000001, 0x8, 0x1000000, 0x9]}}, @padn={0x1, 0x4, [0x0, 0x0, 0x0, 0x0]}]}, 0x48) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r5 = dup3(r1, r2, 0x0) dup2(r5, r4) 07:10:39 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = dup3(r0, r1, 0x0) dup2(r3, r2) r4 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r6 = dup2(r5, r4) ioctl$BINDER_SET_CONTEXT_MGR(r6, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000180)={0x4, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0563dce50bb27a1ab7c575e650f8d9de5baa693bf52e616effa8e30ab333dd88c37706a0749e85fee2d10668a372731b8b777e2cf502b2db586dad88d361a57cce3a74f0d86f142b63b68d"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$SG_SET_RESERVED_SIZE(r6, 0x2275, &(0x7f0000000000)=0x800) 07:10:39 executing program 1: r0 = perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) bind$vsock_stream(r0, &(0x7f0000000000)={0x28, 0x0, 0x2710, @hyper}, 0x10) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = dup3(r1, r2, 0x0) dup2(r4, r3) 07:10:39 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r4 = dup2(0xffffffffffffffff, r3) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f0000000340)=ANY=[@ANYBLOB="852a74700000000000000000000000000000000700000000852a6873db0000000000cbdb0000000000000000000085616466000000000000000000007d000000008023000000000000000000000003bf3230eb20c2a6f12ac391d5d84a910ba258f8850b35951373c1c481bb041c34901a2e02ae4e547daaad31292472b2e057df976db1a0eee9456aa62c7a31ef7ec68857154d359092f6ae263088fedca23458294deb95672778b61f8735eea9c71b8d2f8df4b818fb7ebae5b6816ad6a58712552b7a815e7dafeeea41ad6fc388074e0795683587ea5be0dcb89aaddfec6ac33a1464105799e35d7a370777c2835037af630082e75b542d666d3fe38da47cc07b58ab017dfaddb56ebf3e301586677ae5ff0000000db32a9720e31ff525041fd7a2cde89abc22aeb442b90a458a62b1b04f7a379557c83f477205769a0800e56a50a6045eb3e1c5d51161627cec68452ce02bad3a44a7eee7a8f159fbf432eb099d72c618e3521892e6767d36de7d4f1c00b724f2caede2e84aca38d8b54c3a5a4af8a83d5f560240060f127088fd920056e656c3c6354fbcdb44"], &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) sendmsg$NFT_MSG_GETRULE(r4, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000040)={0xfffffffffffffffe}, 0x1, 0x0, 0x0, 0x24004088}, 0x4000044) r5 = dup3(r0, r1, 0x0) dup2(r5, r2) [ 253.180499] binder: 14576:14581 unknown command -438541563 [ 253.194881] binder: 14576:14581 ioctl c0306201 20000180 returned -22 07:10:39 executing program 2: r0 = perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) bind$vsock_stream(r0, &(0x7f0000000000)={0x28, 0x0, 0x2710, @hyper}, 0x10) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = dup3(r1, r2, 0x0) dup2(r4, r3) [ 253.236018] binder: 14576:14581 ioctl 2275 20000000 returned -22 07:10:39 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="a8aa02be8e89a938fdc57dc4feef0440"], 0x0, 0x0, 0x0}) r4 = dup2(r3, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) r5 = socket(0x10, 0x803, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route_sched(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB="0000000000000000000000000000000010200000", @ANYRES32=r6, @ANYBLOB="0000000000000000040000000a0001007273767036000000180002001400020020010000000000000000000000000000f5a04a16e1d0261e9897ea64f004"], 0x48}}, 0x0) r7 = syz_genetlink_get_family_id$tipc2(&(0x7f00000003c0)='TIPCv2\x00') sendmsg$TIPC_NL_UDP_GET_REMOTEIP(r5, &(0x7f0000000600)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000440)={0x158, r7, 0x200, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_MEDIA={0x10, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}]}]}, @TIPC_NLA_BEARER={0x80, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x9}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5efc3560}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7f}, @TIPC_NLA_PROP_MTU={0x8}]}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x2}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e22, 0x7f, @mcast2, 0x3ff}}, {0x14, 0x2, @in={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}}}}]}, @TIPC_NLA_BEARER={0xb4, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_NAME={0x15, 0x1, @l2={'eth', 0x3a, 'veth1_to_hsr\x00'}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffff0001}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}]}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e20, @loopback}}, {0x14, 0x2, @in={0x2, 0x4e24, @broadcast}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x20}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x80000000}]}]}, 0x158}, 0x1, 0x0, 0x0, 0x4}, 0x80) sendmsg$TIPC_NL_BEARER_ADD(r4, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="58000200", @ANYRES16=r7, @ANYBLOB="01002abd7000ffdbdf251500000038000580340002800800040008000000080001000100000008000300060000000800020000100000080002000800000008000300000000000c00038008000300f00e0000"], 0x58}, 0x1, 0x0, 0x0, 0x8000}, 0x44880) r8 = dup3(r0, r1, 0x0) ioctl$IMCTRLREQ(r8, 0x80044945, &(0x7f0000000000)={0x2000, 0x7a5e, 0x0, 0x9}) dup2(r8, r2) 07:10:39 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r5 = dup2(r4, r3) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) r6 = socket(0x10, 0x803, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route_sched(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001880)=ANY=[@ANYBLOB="0000000000000000000000000000000010200000", @ANYRES32=r7, @ANYBLOB="0000000000000000040000000a00010072737670360000001800020014000200200100"/48], 0x48}}, 0x0) r8 = syz_genetlink_get_family_id$tipc2(&(0x7f00000003c0)='TIPCv2\x00') sendmsg$TIPC_NL_UDP_GET_REMOTEIP(r6, &(0x7f0000000600)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000440)={0x158, r8, 0x200, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_MEDIA={0x10, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}]}]}, @TIPC_NLA_BEARER={0x80, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x9}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5efc3560}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7f}, @TIPC_NLA_PROP_MTU={0x8}]}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x2}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e22, 0x7f, @mcast2, 0x3ff}}, {0x14, 0x2, @in={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}}}}]}, @TIPC_NLA_BEARER={0xb4, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_NAME={0x15, 0x1, @l2={'eth', 0x3a, 'veth1_to_hsr\x00'}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffff0001}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}]}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e20, @loopback}}, {0x14, 0x2, @in={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x2e}}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x20}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x80000000}]}]}, 0x158}, 0x1, 0x0, 0x0, 0x4}, 0x80) sendmsg$TIPC_NL_BEARER_GET(r5, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000040)={&(0x7f0000000180)={0xc8, r8, 0x2, 0x70bd25, 0x25dfdbfb, {}, [@TIPC_NLA_PUBL={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x5}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x6}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x9}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x4941bb82}]}, @TIPC_NLA_BEARER={0x90, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x16}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xb}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x16275148}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x19}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e22, @local}}, {0x20, 0x2, @in6={0xa, 0x4e20, 0x0, @remote, 0x1}}}}, @TIPC_NLA_BEARER_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x80}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1a}]}, @TIPC_NLA_BEARER_NAME={0x14, 0x1, @l2={'ib', 0x3a, 'veth1_to_hsr\x00'}}]}]}, 0xc8}, 0x1, 0x0, 0x0, 0x4014}, 0x20000000) r9 = dup3(r0, r1, 0x0) dup2(r9, r2) 07:10:39 executing program 2: r0 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000000), 0x4) write$binfmt_misc(r0, &(0x7f0000000180)={'syz1', "d815e92faddb46d1a337f5b30e92ca7e117b25c626af3f4de6aca55582d2b1bf46283aabcf73346c90a72053256aab8b7190a51dabc525c1f58c10d6b21b"}, 0x42) perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = dup3(r1, r2, 0x0) r5 = add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) request_key(&(0x7f0000000080)='encrypted\x00', &(0x7f00000000c0)={'syz', 0x2}, &(0x7f0000000280)='selinux.\x00', r5) add_key(&(0x7f0000000100)='encrypted\x00', &(0x7f0000000140)={'syz', 0x2}, &(0x7f0000000540), 0x0, r5) keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f0000000040)={r5, 0xbc, 0x3}, &(0x7f0000000200)={'enc=', 'raw', ' hash=', {'crct10dif-pclmul\x00'}}, &(0x7f0000000280)="d8c89663fdcf5f6e618ec783fc582bb6e877e81d67204c1a9b3138a650a15fa874a6991f63140a1788a42660134315b9458518c2245169eb7d97ba898f17534e12d90e16a91711eab89af4b0e24caa58e2e4ad2f63ad4690d1198cd15f4137836fe403115fc58e9ea1975379758a28756aa7188e14de511e862668800c90aada831857adaef5bffb1ef0a54605b85ab2a0ecbfb934d830335ae54431ed6be6aea35f844da8cda7903ee5378c7805a5d5a6fb58518cec14fe629662fc", &(0x7f00000000c0)=""/3) dup2(r4, r3) 07:10:39 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socketpair(0x1, 0x5, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) fstat(r2, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0}) setuid(r3) ioprio_get$uid(0x3, r3) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r5 = dup2(r4, r0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="07630440"], 0x0, 0x0, 0x0}) r6 = mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000700)={0x9c, 0x0, &(0x7f0000000540)=[@transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)=ANY=[@ANYBLOB="a166ff094000", @ANYRES32, @ANYBLOB="000000000000000000000000852a646600000000", @ANYRES32, @ANYBLOB="000000000000000000000000852a62770b0000000300"/36], &(0x7f00000003c0)={0x0, 0x18, 0x30}}, 0x400}, @free_buffer={0x40086303, r6}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x1, &(0x7f0000000400)=""/11, 0xb, 0x0, 0x38}, @flat=@handle={0x73682a85, 0x0, 0x1}}, &(0x7f0000000500)={0x0, 0x18, 0x40}}}], 0xeb, 0x0, &(0x7f0000000600)="2e84181cc27f46b53b7d1d3d140b78e70a8ad503471a05938b7913f53b390f63faaa12b0f4ab398c84ff279780f9f849f38c70ae9ec30671258ed50ec4da81b7e13f35127cf0abd9f52a7d1323c1844b764a318c1a588c361cd2c87383bc5e374d885f62631d3ca01d014180058579cea58dcdbd340c8f0861ae3a7313399a1a3e713dd2e4515e7e077374800dfc03e87dfe49538a23ba9bbbe296bcfbc7a658000a4e8f60a93271783ffd1155e3f382b2a15457a9daf24d02dd17022999381f5cea64668ddcca7fd254e0aad962f43dfc3d3027754656f4788480ba2115510687f4c86c10b2540d4d2a84"}) r7 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) r8 = mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000700)={0x98, 0x0, &(0x7f0000000540)=[@transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@fd={0x66642a85, 0x0, r5}, @fd, @flat=@weak_binder={0x77622a85, 0xb, 0x3}}, &(0x7f00000003c0)={0x0, 0x18, 0x30}}, 0x400}, @acquire={0x40046305, 0x1}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000440)={@fd, @fda={0x66646185, 0x4, 0x0, 0x1c}, @flat=@handle={0x73682a85, 0x0, 0x1}}, &(0x7f0000000500)={0x0, 0x18, 0x38}}}], 0xeb, 0x0, &(0x7f0000000600)="2e84181cc27f46b53b7d1d3d140b78e70a8ad503471a05938b7913f53b390f63faaa12b0f4ab398c84ff279780f9f849f38c70ae9ec30671258ed50ec4da81b7e13f35127cf0abd9f52a7d1323c1844b764a318c1a588c361cd2c87383bc5e374d885f62631d3ca01d014180058579cea58dcdbd340c8f0861ae3a7313399a1a3e713dd2e4515e7e077374800dfc03e87dfe49538a23ba9bbbe296bcfbc7a658000a4e8f60a93271783ffd1155e3f382b2a15457a9daf24d02dd17022999381f5cea64668ddcca7fd254e0aad962f43dfc3d3027754656f4788480ba2115510687f4c86c10b2540d4d2a84"}) syz_mount_image$msdos(&(0x7f0000000740)='msdos\x00', &(0x7f0000000780)='./file0\x00', 0x8001, 0x4, &(0x7f0000000940)=[{&(0x7f00000007c0)="d76fa60958bc9313892b3fffffc48f1597432db9cc8097a29872814b511180b244a2062e02fcb80870b4881f3cecc46980213053a5f6bfaa9e36042eed5680b6070d05fb29c6001bbecc37ec722e9c74cab4c4c95bf0c4416749", 0x5a, 0x3ff}, {&(0x7f0000000840)="4dd325b5f4e507f01ecab2c34760e94268af67072200a91a2a1fa0ce00c10782903e28f2da707e", 0x27, 0x4}, {&(0x7f0000000880)="a59f02e2a0e3e5998943e61d81c4348fc7d2fe987db5a6e848487c0f2e0ba8e6205a95037e5184bc6e53a42d208454b95916cb4e74e0d922f9ad087089044c1576eb27f23c37a1d4bdf2e5edc25b97556e48b1004fabfd0bea242c5267e4ab8b5200379633acc3b984f2196c9e60eb78d4e2491845bb92e458005051563193b84108013b480a61ff776caeac7c6137930f794fe03520cbfe0e37", 0x9a, 0x80000000}, {&(0x7f0000001780)="ebf55059d1204a02cf01d992dc9a627287e0ce9ad12ec01dbaaad4d7a0ca5ac004fd55a7d0bdef7eabb550881097c4d6e31183c21815712529ffbc4275849128ce61e101b7995834dba2230942bab7d76d2979705e3d321687d521ee3eaefef5ac890687ff89aaff35d662ff2dca6533811471e7cbc1548beafda3e3cb73536321c9a8577f28a9775f299500b6c5dfc06241d7e9149dc7b0e0c645cfcf39f80df6e5ba38ceeb4df5809f9b75c7d57de7e025b0cbde2b1bbf18cec56fc42cc72eea7327a291e912c6a64b1cb9cf34edb7e249b74d3fb20992050288b993d140003ae1b8c652f4ed83f13094e16947a346eb703819cd4becadbd0ab86debe7a6682edf96ffd6c7dc4852182487eeb52dc4ec37bee7d44c2924859266c6531035f62d6fc55becd8e644f7d605ac4647d4b37d9711dfd210bcee423acbe8cc3e5191577ab31b349960c337aab200e57bb39424876951b63fb99421a00ca42b720e5ccd2dd318a6626c206d078b28fb44a928bcada4c55337761c2ed24b2db4f294c1244656d8303f88581d8b2fb002f3c12788d6bd8d5f6f4673292270f5eaf82d8f286a64d7922fc8e651afc606d651ca3636e9bf2bb61af18fa77de7351b66d86087c40b495422113840dd035536972b5fab9f1a0feada6622f5b2f302da2ac9f03634ce74bc925636b289564213aa9d8f741abbdbc0fffd5d0cf67caa57546e958223110dd6c030d96f18a20edc3499a7b7d9dda1eafaf32eb036c4afd9efecc3f899fa786cc66595c2e67ede9b365a4e3ce801a9b3ed29389b296abded4f480ffc87f911563fbe696ba4715ff8458e32c67746b12a6c39676f3cb1aba0f1f39e8a75e03b7200418995fa32e93e8de5963d9cc7a546678026ca41df2bf35605ad261254758243b621d27e5b5cc479c977d2a7086eeea265b258d9cea435941b8f8869d87527b7a422164d2cb3b0a1d09bb8a2dac315c5464fbc729d05b4d54776c03d71bfb5611a27660a7d1400809a5975f9abd60aa9adfc35e3c0cec88afa4c2953f799379451c54b8ab2aac8b9ea2c320d1ee312844336fdf759267c0bb894742f5289c70df57dfda76b447fd53b4fbb33eeef38f17f49a73588673aa362831bde7b6f8bfdc19a7accf094e4c7a6ce0db0e6392a76586a984ba012b0db36942ff4af549da1701a682f0ad4049095347f34a0c75c43ec7b7424125c469fadbc125c771d7906b58c7f94c49f60cdb6dfd5485cb4879c24c71bfcc186f97384120502f7b37e2cab77fdd0ed2672c809834537f127853f32f95b9e67279a160b20f285c23c084e659c5c0adab31fe8284017f1bb8eb5e04cc6c323f15726befe9ec88cba812682e5b357479b984a5dfd03236502c4f62b7d48f9b13731079442be9fcbd2dc159302cb886494c2c189b28323e7e157097e087be7bc809ca3f648139797e5b113da6a94e5c4fd30784642ef7d335b09a4b89c9cfae5dd87ab5736c314c67c43124a29c026ab8bbfff66030d2335ed6649f11fb64c6dcfcabeaeb7dc03dc24a2cc81ad0bf4ef8eb3bc4d6aabafead06f549afe7c10e5d9612973261757914276878d1c5c941633ee91df466596effe62186d3565c343449e8f4c91ae78d0c0c87bec31e6ae9adb5cbc54c1c0fb07ababa1a76447a0688eda75bbd8060a3e48486644a99d9ecdfd5f6c2949d1973937eca942b5d5d90db57aa51287b2b5f72d2d8ef669e1c1f60d2fe50b553b3a903100e8a6a9aff536728fef4f0b231578da8407ad4c50c7540efcabd00b1466a73ac07e7a455aa45608ca56dd193aedfb5c080fada01ec8146f303e739201b5725afb765929270683c9b205bfbd032ceef2106abfe002a777f9dd0745b0abbdc09c87ecbf465fa4e679534afab22c611bce25fa9bb66a40ff189784a9daeaea22bf37260fb7aa024d150bbf75e1dedb0274977c4917fc247c29593765c3e14b46817a6806d6c4911c7e6e92f3636244125f895fd907af31b3d82965351b9e5e5f09eb3fd456ca324eac8b38f3e8f1b5ab5c494c11c1cd76aa3c936b0aef583bab05a58b53bf1dc2b02a43fe1ae65b2e0f56b1f35ece35699dad15475bf25dfb12acb4c9b3be85de827c07a36a1e5a3e3244af2d941ea67fe35de558f9d2505a079f60c439a6a8ee2e7ca913b6f0fe9a29e4420fe417a1647e0a28b27f1d302ca98a11e85b746342b96c95ef3c115b8d6ff3807d5b0d816ea21c131002c3e0682eb3e93ce807d9b4dfa901714a045077909cb21aef8acfc339a93addfc7ed5134272d7a302169e26c09cbb8dccbc7281cfd3d21191a39d6e007d8e5101645f12360b184f19e612e10103d4b06d28d8a7c78993c491c7fd6f1cdb7dd4950186973279a87a7e8f531d007e96d71d121f7a8302d66cecdf4bb9c10269d8a29f97db861ab0e44b8dd1b2500c6506912246e97d228c32a8af5334f69ebb2345807c4b2c716f1e29c39179ae3c3c62d90a6a2dbbdb28a0fb996d20b9df395b642b1962eadee55692dbbe0f0ebed2a030ffdd8fa35006a56ed74576ec8ee8d25c888837d2168d84c5b9f0ae1af8af3a3a31d32859d61908523c355a4fe951a144784cebbe70db27260b02b8e1320b631b25d95943b3bb978839cf2ec2db55d17d5f6bf7b1511b2d5f492f25cc030018f7366cd1704b81854421dfb296f1db2f20cd72e4dbca4a2b3bb8aa2138b2834d0f04904e044776d72f1c8d8adbdf0b1a6119e698444f75530bf06be4e970257887c263a26657744331e9d0533698023fb207fc413aba29e52496e299cfccc1deba817a99501d97f9fc47b24edca944caca726d8d6bf88a93096c4170b26430ae87a7c48eaab6d14825d9f54551d7a1727d7768ca37a71afcf7c6ccbccd44172c4356e1c5be332af7175f52694ba129dd8f883a889548db59658b9af5a0308d03b8b8b6978e8409eb53fb238e5c30400a2c982ce6d50da0ccc7d81bb8d6568cbcbf9fb77f306d9d7045cd8be615c68a05356c7fe0f9a477f53e3128feaa6bee0cc17bf994dbf461ff4501aeae2ff4b680352862155b8234ddf9a864981e2be118407b5be1d75c48a539bc274c3d4cc28511f06dbe01ee835fdf09d16c34dc51551fb1917734f76a64dedab4a48d244e21f65cd6a5153dfa775acf1090eff126cffc2489cc140cccbb88c205e2175d1dc2431993b1a5686db1e00e28b451b15ab2f3a21a3516febd1c5b06dc5e4c3039c6b00e3ff607533150d779f6f6c3e8afbf849df2eccc0d1306dc427f8dbe361dbacbdb3267e06f187684e912a276b1a7ba00d671b8ab227a8309b8bf90935b53d3843503e309fda233afe574d1ca9892191597c5e8c1fdad9c6635f8d4970fb2f1e8d902a15d16c3304b03dc99a4e866ba0412fc2330ff49e5cd83a7148c933e4b944ab3ccaa697926b836b0c8a7df2ff0b10950bcec748b861a2f02b48170cc26908d671952b3836eb13c74087f49afdeaaea49b071bd850c98ae3894488aadceb48aa942c84f25caae0d0080a88e3c4558622d46f097c33e983981a682ca21469d6e0864975e38077332e33e959aab2dc7d36798f81c409cce6d9903935ccbbbcbda3b5f858c52c80cc7eac5cf71a8c08813b0a54e7c966239a7cd2d8ec62761c681de2da6f5f2379dbedc4f597f15d73c46758284776814bd3738ee4cba7c722d6d63ddb036b684f04b2972f5c40adb7a48c4ae9adb45c80ca42ac6a96c0b10917d61fd8fdcf9a56232f1c518ae3bf647c99ec0d5880ddb909e6d283acdc5f6433f9b916b0c59ae71687847441a97f7034be24150b454cc21dcc40cf8e7ea5c88deef25c98c40525e35e7d80b0d2c8cc5470c9887f023c83c3c228ace094ee54a2acb4254e9b3c33ec0ade20037966e4aae1f8537294f6acb5cbb30755e0e726ebb7889c92474bde7fdd2a0d263e262c2f850dfc1df0472c49b7f208a571fbc1d359269867b7b20a69fdacddfe4b2eb6d5c517056eff030a3c16c78e91d939f1c5fb8c5e348f3f1314938bd1fb59524854f4ef33972b07bf9a2a1f3ad774258f1d0f71beaf1294922e5eb899fa76d701547a379db6d52118bcda975a32e8bbae9b93fcc01cb2b1d42029aedae582b90ad846a2e0ba3e2d6e8e2c0affc366907d179317e30edfe92c5a241e3dae287c6cdb4f847b3e690636731f80ca398ed1b2d072feb3ef3e704b196ae8fa58b01fff44ec7b0227729a68757097ee8bdff1565c8e969ae4a206fcc19d5c67235c453f8464dfc429ecf8046e5d53a763f822bb9fd7bc9eeb05007a07c25620fa54ec07bbe7764fe54ab8eece9b153109e8973ef2911a393444eb5ae39a3fe693a36caa666e503270c8814cfde3423578cb36776169f19c07bb99f3ea34114072663ec024aa5a95da6878c2ab3f0ba8840fb32938db4e552727a24addce0368e58a40a2c5968f0372b8ef7b6bce97fe66b63384a51a628062e365fd9759278e74cee13cd995f8d48982d65c50f3029b4d6b9f2118bb11124fedb8094c431192f110ea54d47fbb5f69901bbc9fd908d9e5755b4343091a87d6a6a80ae90a4edd0ad736864f1b5c9c684bbf3a8dc5c57fcb09b937d564c578d1c1c8bd9791c222d24b346de0389bef1bc26b00d39421094382b079393d8b9089b4c40e8be2d19540d3686769b3fcc7e437c72e465881e4af902d79f6ae440f13ea70ac3d4c2bd613d2b4fbbfbc19893b60d8bf1d0c37208b71f81f471a93aeddacfc6d57cc1345aeefbfe15959bd6430fe685fcfad4b7721698d1a77ad46eced1646e89fd54c21d6ba2bd2ae46d75c456e53ec02dfd6b8ead14c23fbec3ef6cb34b35979189c8639856d0959cc1fd18f65eda2045ee7c967beb0a72865f42d63b895faffecc4fde49fa3f415f7feb84d579d42235b8de91716aff754562e6a71fe224a1b5872f350bc76afcd7aa6d16d07cf54e5706471c5b675c22a3bdb695f2a1fdf643ca0bb028404817e78457fa70f3046d99281858962b85bf0f82b9abf04eec524f1d1cf21cfef8bc8bdb8c9f98feb372e1cad0b24228638ea6877dbf65472e0892f52ea94cf9f626661b07b81ae52e61cc53aa7a60529017a56570e3b326d9a4c79736a7cd0a17c7426eebd8bd5b16abaab63773dd19b4fc915e8a8793178601215de35dc1d713901edfd2c3795f51583b516561a6df91e73c8701ba130c9378632c66a5c478bb2825c2eafbf4c71a13cbb4e15517ffcce735b58179d2969d7e6259f6a2fa67ee55182fbce95ec7b4139fb8558fda7b8ecdf645d15efef927b1036b4637367c9659de359a12361799e08a346d9a984412bba300b09c4d2f556be0d0ed930a6f34f68131064fc257670d266d7ee16a1a52d4c8f8a855d5f087c89fb3582a663c79ccbbc57852acab18eae3dcbc7447d132294e3458f60a19ac4416cf9b7e25aa8c5543704e027a59f00b65eaf1de44df764d72bea823d4a6bfa87eef80ce2da73194a063572c0a643413e6d72b6ed3d59daba0fb768625fe43d4d9c40a45aa63904f3b5dddce0405fbeb8a3fa7dd5f98767d745fd0116a8423251af8b2a38cf59a8da9d51ab8c89efe643bd6341ec4456d2dd160afc5cbba9d97d4000ed050161561830cf9905f589297521acc0c3acb0e692987fe8d4dcd51b16761d6c03198a6723b6c0927433db954ae6efaf44bf8bc541ccda14d5d6baf2a6a539805f169daae7da118a7fb27509a5a5d66687f15e2ba55c30741d8220765da754cc7dca95cb253b47c7dcfaa13bd807e45c99466b1be2fa16d9834d14dcd711212c83bb2cd0ad4bc", 0x1000, 0x5}], 0x28, &(0x7f00000009c0)={[{@fat=@nocase='nocase'}, {@dots='dots'}, {@fat=@usefree='usefree'}, {@fat=@check_normal='check=normal'}, {@fat=@showexec='showexec'}], [{@context={'context', 0x3d, 'sysadm_u'}}, {@dont_hash='dont_hash'}, {@pcr={'pcr', 0x3d, 0x9}}]}) r9 = syz_open_dev$usbfs(&(0x7f0000000240)='/dev/bus/usb/00#/00#\x00', 0x7, 0x448003) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000600)={0x128, 0x0, &(0x7f0000000400)=[@free_buffer={0x40086303, r6}, @enter_looper, @release, @acquire={0x40046305, 0x3}, @request_death, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000100)={@fda={0x66646185, 0x7, 0x0, 0x3c}, @ptr={0x70742a85, 0x1, &(0x7f0000000080)=""/115, 0x73, 0x2, 0x2f}, @flat=@handle={0x73682a85, 0x1080, 0x1}}, &(0x7f0000000180)={0x0, 0x20, 0x48}}, 0x40}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f00000002c0)={@fd={0x66642a85, 0x0, r7}, @flat=@binder={0x73622a85, 0xa, 0x2}, @flat=@weak_binder={0x77622a85, 0xa, 0x3}}, &(0x7f00000001c0)={0x0, 0x18, 0x30}}, 0x1000}, @free_buffer={0x40086303, r8}, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000340)={@flat=@handle={0x73682a85, 0x110a}, @fd={0x66642a85, 0x0, r9}, @flat=@weak_handle={0x77682a85, 0x110b}}, &(0x7f00000003c0)={0x0, 0x18, 0x30}}}, @request_death], 0x95, 0x0, &(0x7f0000000540)="057911683b3d89fc5cb6811f3eecf6731b4bdd9425182bb33094b002e530bf947e31d003e527cb4703df211f96e38c9022302aa2d840602ee21966f50ddfbe65cd3e58978fe0595d3b99244b7b7f9ef62b964657f4c95347772f12707abf07fbb83373933c565ecd33e002142dd658e53872d7f694dd27a27af8b4d424a99bb7abb384a07cf8859fec96ea58a7586b1ef0c8730bc0"}) 07:10:39 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) r2 = dup3(0xffffffffffffffff, r0, 0x0) dup2(r2, r1) r3 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r5 = dup2(r4, r3) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) setsockopt$TIPC_GROUP_LEAVE(r5, 0x10f, 0x88) [ 253.707163] binder: BINDER_SET_CONTEXT_MGR bad uid 49663 != 0 [ 253.719799] binder_alloc: 14631: binder_alloc_buf, no vma [ 253.734291] binder: 14630:14635 ioctl 40046207 0 returned -1 [ 253.739500] binder_alloc: 14637: binder_alloc_buf, no vma 07:10:40 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="a8aa02be8e89a938fdc57dc4feef0440"], 0x0, 0x0, 0x0}) r4 = dup2(r3, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) r5 = socket(0x10, 0x803, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route_sched(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB="0000000000000000000000000000000010200000", @ANYRES32=r6, @ANYBLOB="0000000000000000040000000a0001007273767036000000180002001400020020010000000000000000000000000000f5a04a16e1d0261e9897ea64f004"], 0x48}}, 0x0) r7 = syz_genetlink_get_family_id$tipc2(&(0x7f00000003c0)='TIPCv2\x00') sendmsg$TIPC_NL_UDP_GET_REMOTEIP(r5, &(0x7f0000000600)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000440)={0x158, r7, 0x200, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_MEDIA={0x10, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}]}]}, @TIPC_NLA_BEARER={0x80, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x9}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5efc3560}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7f}, @TIPC_NLA_PROP_MTU={0x8}]}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x2}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e22, 0x7f, @mcast2, 0x3ff}}, {0x14, 0x2, @in={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}}}}]}, @TIPC_NLA_BEARER={0xb4, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_NAME={0x15, 0x1, @l2={'eth', 0x3a, 'veth1_to_hsr\x00'}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffff0001}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}]}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e20, @loopback}}, {0x14, 0x2, @in={0x2, 0x4e24, @broadcast}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x20}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x80000000}]}]}, 0x158}, 0x1, 0x0, 0x0, 0x4}, 0x80) sendmsg$TIPC_NL_BEARER_ADD(r4, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="58000200", @ANYRES16=r7, @ANYBLOB="01002abd7000ffdbdf251500000038000580340002800800040008000000080001000100000008000300060000000800020000100000080002000800000008000300000000000c00038008000300f00e0000"], 0x58}, 0x1, 0x0, 0x0, 0x8000}, 0x44880) r8 = dup3(r0, r1, 0x0) ioctl$IMCTRLREQ(r8, 0x80044945, &(0x7f0000000000)={0x2000, 0x7a5e, 0x0, 0x9}) dup2(r8, r2) 07:10:40 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="07630440"], 0x0, 0x0, 0x0}) prctl$PR_TASK_PERF_EVENTS_DISABLE(0x1f) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000080)={0x1, 0x7, 0x4, 0xff, 0x3, [{0x8, 0x101, 0x401, [], 0x1084}, {0x6, 0x1509, 0xfff, [], 0x904}, {0x7, 0x3, 0x6, [], 0x1006}]}) [ 253.804219] binder: BINDER_SET_CONTEXT_MGR already set [ 253.827532] binder: BINDER_SET_CONTEXT_MGR already set [ 253.830751] binder: 14637:14645 ioctl 40046207 0 returned -16 [ 253.854234] binder: 14631:14634 ioctl 40046207 0 returned -16 07:10:40 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0xa9, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x6cc, 0x2}, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xfffffffffffffffb, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = dup3(r0, r1, 0x0) dup2(r3, r2) 07:10:40 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = dup3(r0, r1, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) fremovexattr(r3, &(0x7f0000000000)=ANY=[@ANYBLOB="85746a43f8632f00"]) openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/kvm\x00', 0x50000, 0x0) mbind(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x8000, &(0x7f00000000c0)=0x47, 0x40, 0x0) r4 = dup2(r2, 0xffffffffffffffff) sendto$inet(r4, &(0x7f0000000200)="647bf7fe637f6b9e847cbac3e648c3a6c4953d6482e2ca5a2d4edbaeaf7108e3e70e2bd893b0484f2d3128f6c9ef3e7ea798eb8742b9a3281a7f2083734cd2a8dc191c743d712e130c4622f11d31029d0af8c22bdb49ca1daa4f113774e068c21d6dc2475ce79cbff0cd94636370d56cb023f5ce108d5915", 0x78, 0x4000001, &(0x7f0000000280)={0x2, 0x4e21, @broadcast}, 0x10) r5 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) r6 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="05fa96ad70"], 0x0, 0x0, 0x0}) r7 = dup2(r6, r5) ioctl$BINDER_SET_CONTEXT_MGR(r7, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="9bc18c465c5e484ea3070d9e96bd0ae850dd2dccd4e4e9661d0de2f2"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$SIOCX25SENDCALLACCPT(r7, 0x89e9) 07:10:40 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = dup2(r2, r1) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000002c0)=ANY=[@ANYBLOB="852a747000000000003b758b6bfeffff4d805e87a35f89e5839296f52f15ffffffffffbb8e923759b299d51488014c28000000000000000000000000000000852a687300000000000000000000000000c5e24a2cf3455430616466000000e111b08a4fbf8a12e9f7b9dba8f377dc48ba7b8357baa15e32f46bf01e1dd8a3c21b04bdea05a402da4a8036146c5e100f11bbd958f72ab64180d1ba29e7f082ef7ecbb1e41b21b0fafd94e1d2dbc015bb411aa17307951c4f58aea29b428acaaaf5e9402cfefdac2f99c63412aa0995a8f1e6ab3eebe7fda3effa4449d4d43a1b3743a5335342070daf168eb979723eaa06fafbbcb4746b43fccee5ee5a6a9161b46a3ba269a68c0149cd325bbb1d4e7435f1946e8dc003043d6f9a63de5c18"], &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) r4 = dup3(r2, 0xffffffffffffffff, 0x80000) sendto$inet(r4, &(0x7f0000fa3fff)='\t', 0x1, 0x0, &(0x7f00006f7000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000000140)=ANY=[@ANYBLOB="020000002e4c037894f6e4813800e2c9d4bb0271305edf3bf5c63d105b31483d519d", @ANYRES32=0x0, @ANYRES32=0x0], &(0x7f0000a8a000)=0xc) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r4, 0x84, 0x6c, &(0x7f000059aff8)={r5}, &(0x7f000034f000)=0x2059b000) setsockopt$inet_sctp6_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000a40)=@assoc_value={r5}, 0x8) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r3, 0x84, 0x10, &(0x7f0000000080)=@sack_info={r5, 0x781, 0x3}, &(0x7f00000000c0)=0xc) r6 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r7 = dup2(r6, r0) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="07630440"], 0x0, 0x0, 0x0}) 07:10:40 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) ioctl$KVM_ENABLE_CAP(r2, 0x4068aea3, &(0x7f0000000000)={0x74, 0x0, [0xfffffffffffffff7, 0x32, 0x1, 0xffffffffffffffff]}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) r6 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r6, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$VIDIOC_G_CROP(r6, 0xc014563b, &(0x7f00000000c0)={0x8, {0x6, 0xfffffffa, 0x3, 0x57af}}) r7 = dup3(r3, r4, 0x0) dup2(r7, r5) [ 254.120290] binder: 14669:14671 unknown command -1382614523 [ 254.158192] binder: 14669:14671 ioctl c0306201 20000200 returned -22 07:10:40 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = dup2(r2, r1) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x18, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @fd, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) r4 = add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) request_key(&(0x7f0000000080)='encrypted\x00', &(0x7f00000000c0)={'syz', 0x2}, &(0x7f0000000280)='selinux.\x00', r4) add_key(&(0x7f0000000100)='encrypted\x00', &(0x7f0000000140)={'syz', 0x2}, &(0x7f0000000540), 0x0, r4) keyctl$invalidate(0x15, r4) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r3, 0x54a2) r5 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) wait4(0xffffffffffffffff, &(0x7f00000001c0), 0x2, &(0x7f00000002c0)) r7 = dup3(r0, r5, 0x0) dup2(r7, r6) [ 254.173434] binder: 14669:14682 unknown command 1183629723 [ 254.187589] binder: BINDER_SET_CONTEXT_MGR already set [ 254.187607] binder_alloc: 14681: binder_alloc_buf, no vma [ 254.194293] binder: 14669:14682 ioctl c0306201 20000280 returned -22 [ 254.215623] binder: 14680:14684 ioctl 40046207 0 returned -16 [ 254.215858] binder: 14681:14683 ioctl 4068aea3 20000000 returned -22 [ 254.233011] binder: 14669:14671 ioctl 89e9 0 returned -22 [ 254.233466] binder: BINDER_SET_CONTEXT_MGR already set [ 254.255458] binder: 14669:14682 unknown command 1183629723 [ 254.261218] binder: 14669:14682 ioctl c0306201 20000280 returned -22 [ 254.273879] binder: 14680:14684 ioctl 40046207 0 returned -16 [ 254.300320] binder: BINDER_SET_CONTEXT_MGR already set [ 254.314642] binder_alloc: 14685: binder_alloc_buf, no vma 07:10:40 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = dup3(r0, r1, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x40102, 0x0) ioctl$FS_IOC_SETVERSION(r4, 0x40087602, &(0x7f0000000040)=0x3) ioctl$SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT(r4, 0x40505331, &(0x7f0000000180)={{0xff}, {0x1, 0xf9}, 0x1000000, 0x1, 0x8}) dup2(r3, r2) 07:10:40 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="cff0c5f360e20763f38a"], 0x0, 0x0, 0x0}) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) fcntl$setstatus(r3, 0x4, 0x4000) [ 254.319488] binder: BINDER_SET_CONTEXT_MGR already set [ 254.326525] binder: 14680:14684 ioctl 40046207 0 returned -16 [ 254.333303] binder: 14680:14688 ioctl 40046207 0 returned -16 [ 254.358726] binder: 14685:14689 ioctl 54a2 0 returned -22 07:10:40 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) ioctl$KVM_ENABLE_CAP(r2, 0x4068aea3, &(0x7f0000000000)={0x74, 0x0, [0xfffffffffffffff7, 0x32, 0x1, 0xffffffffffffffff]}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) r6 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r6, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$VIDIOC_G_CROP(r6, 0xc014563b, &(0x7f00000000c0)={0x8, {0x6, 0xfffffffa, 0x3, 0x57af}}) r7 = dup3(r3, r4, 0x0) dup2(r7, r5) [ 254.442875] binder_alloc: 14685: binder_alloc_buf, no vma [ 254.455030] binder: 14685:14706 ioctl 54a2 0 returned -22 [ 254.479418] binder: 14699:14709 unknown command -205131569 07:10:40 executing program 0: perf_event_open(&(0x7f0000000100)={0x0, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x8) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x802, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = dup3(r0, r1, 0x0) dup2(r3, r2) [ 254.517388] binder: 14699:14709 ioctl c0306201 20000280 returned -22 07:10:40 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r2 = dup3(r0, r1, 0x0) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) dup2(r2, r3) [ 254.567917] binder: 14699:14709 unknown command -205131569 [ 254.585558] binder_alloc: 14717: binder_alloc_buf, no vma [ 254.594751] binder: 14699:14709 ioctl c0306201 20000280 returned -22 [ 254.621550] binder: 14717:14721 ioctl 4068aea3 20000000 returned -22 07:10:40 executing program 0: perf_event_open(&(0x7f00000000c0)={0x2, 0x70, 0xd5, 0x0, 0x0, 0xfd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = dup3(r0, r1, 0x0) dup2(r3, r2) 07:10:41 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="07630440"], 0x0, 0x0, 0x0}) r3 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r5 = dup2(r4, r3) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) r7 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="2e7e602e27db84249b059e4ebd189e88269f649fc46f96d8ec7b2ec1f191027061342c1e37e80e5e35047b1349298796b21df2a8f595305a1e968eeefc4ed750f9da2b23085b67741ffc139c4e86ff68c186d5c453ace9dbc03ba37b0cc7a2fb1179d4b7df4bba035333423545890b7fe882d769d4f5985cb2003245a8d02f515a32c84ea6354fcf58a4a734ba7d816e138eb81fe6c0b81173053c93eef7b9c0fcf36661553c5152f2b580f9ea853165567131008d9431efa03223c77698399e9a889236fc286d115b5baf34d2fac2c33edf3db77035a8c324ef49c48b33230cb79b69e9833936", @ANYBLOB="06f09f795c254ef85e3a074b61acb299d032df0d69f0edf5", @ANYRES16=r7], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$SOUND_MIXER_READ_STEREODEVS(r5, 0x80044dfb, &(0x7f0000000080)) 07:10:41 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r5 = dup2(r4, r3) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$IMCLEAR_L2(r5, 0x80044946, &(0x7f0000000000)=0x6) r6 = dup3(r0, r1, 0x0) dup2(r6, r2) 07:10:41 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) ioctl$KVM_ENABLE_CAP(r2, 0x4068aea3, &(0x7f0000000000)={0x74, 0x0, [0xfffffffffffffff7, 0x32, 0x1, 0xffffffffffffffff]}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) r6 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r6, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$VIDIOC_G_CROP(r6, 0xc014563b, &(0x7f00000000c0)={0x8, {0x6, 0xfffffffa, 0x3, 0x57af}}) r7 = dup3(r3, r4, 0x0) dup2(r7, r5) [ 254.851073] binder: 14748:14751 unknown command 778075694 [ 254.869443] binder: 14748:14751 ioctl c0306201 20000140 returned -22 07:10:41 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$SNDRV_PCM_IOCTL_HW_REFINE_OLD(r2, 0xc1004110, &(0x7f0000001580)={0x40, [0x3ff, 0x10000, 0x400], [{0x357b, 0x3, 0x1}, {0x401, 0x0, 0x0, 0x1, 0x1}, {0x8001, 0x5, 0x1, 0x1, 0x1, 0x1}, {0x81, 0xff, 0x1, 0x0, 0x0, 0x1}, {0x5, 0x7ff, 0x1, 0x0, 0x1}, {0x1, 0x8000, 0x0, 0x0, 0x1, 0x1}, {0x6, 0x4, 0x1, 0x0, 0x1}, {0x7, 0x2, 0x1, 0x1, 0x1, 0x1}, {0x0, 0x101}, {0x4, 0x2, 0x0, 0x0, 0x1}, {0x4, 0x5, 0x0, 0x0, 0x0, 0x1}, {0x9, 0x5e2, 0x1, 0x0, 0x0, 0x1}], 0x80000001}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$DRM_IOCTL_MODE_ADDFB(0xffffffffffffffff, 0xc01c64ae, &(0x7f0000001680)={0x3, 0x8a3, 0x7, 0x8, 0x200, 0x1, 0x7}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) r6 = socket$nl_audit(0x10, 0x3, 0x9) recvmsg(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000180)=""/255, 0xff}, {&(0x7f0000000280)=""/4096, 0x1000}, {&(0x7f0000001280)=""/222, 0xde}, {&(0x7f0000001380)=""/193, 0xc1}], 0x4, &(0x7f0000001480)=""/244, 0xf4}, 0x8000) r7 = dup3(r3, r4, 0x0) dup2(r7, r5) [ 254.902311] binder: 14748:14751 ioctl 80044dfb 20000080 returned -22 [ 254.922856] binder_alloc: 14753: binder_alloc_buf, no vma [ 254.933529] binder: BINDER_SET_CONTEXT_MGR already set [ 254.945146] binder: 14748:14762 ioctl 40046207 0 returned -16 07:10:41 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$EVIOCGVERSION(r2, 0x80044501, &(0x7f0000000080)=""/64) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="07630440"], 0x0, 0x0, 0x0}) [ 254.960074] binder: 14753:14756 ioctl 80044946 20000000 returned -22 [ 254.973395] binder_alloc: 14760: binder_alloc_buf, no vma [ 254.992244] binder: 14760:14765 ioctl 4068aea3 20000000 returned -22 [ 255.041748] binder_alloc: 14766: binder_alloc_buf, no vma [ 255.074957] binder: 14766:14767 ioctl c1004110 20001580 returned -22 07:10:41 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="056304407d205d1417e395bb2a771f32049eb072ee774824f883"], 0x0, 0x0, 0x0}) r3 = dup2(r2, r1) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x18, &(0x7f00000000c0)={@flat=@binder={0x70742a85, 0x0, 0x1}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) r4 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYRES16=r2, @ANYRESOCT=r5], 0x14}, 0x1, 0x0, 0x0, 0xc4040}, 0x1) r6 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x1) r8 = dup3(r0, r6, 0x0) socket$inet6(0xa, 0xa, 0x3) dup2(r8, r7) [ 255.098175] binder: 14772:14777 ioctl 80044501 20000080 returned -22 07:10:41 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) ioctl$KVM_ENABLE_CAP(r2, 0x4068aea3, &(0x7f0000000000)={0x74, 0x0, [0xfffffffffffffff7, 0x32, 0x1, 0xffffffffffffffff]}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) r5 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$VIDIOC_G_CROP(r5, 0xc014563b, &(0x7f00000000c0)={0x8, {0x6, 0xfffffffa, 0x3, 0x57af}}) dup3(r3, r4, 0x0) [ 255.152815] binder: 14772:14777 ioctl 80044501 20000080 returned -22 07:10:41 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0508004093891c93fd06b10fc2344d8da09bdbb99b1b629b7e09fa06b9834474dd4d9fe4b28f2e3e1489529df27c2220ffb8f46dfdd44b652badcf789d46e8403da148572958058f81df65b1217b7b4c0cd65f81131b116e071db3a65edb98b12290"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="07630440"], 0x0, 0x0, 0x0}) [ 255.200518] binder: BINDER_SET_CONTEXT_MGR already set [ 255.234682] binder: 14786:14787 ioctl 40046207 0 returned -16 [ 255.278113] binder: 14791:14796 unknown command 1073743877 [ 255.295055] binder: 14791:14796 ioctl c0306201 20000200 returned -22 [ 255.303095] binder_alloc: 14789: binder_alloc_buf, no vma [ 255.319000] binder: 14789:14798 ioctl 4068aea3 20000000 returned -22 07:10:41 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000000080)=ANY=[@ANYRES64=r0], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="07630440"], 0x0, 0x0, 0x0}) [ 255.346820] binder: BINDER_SET_CONTEXT_MGR already set [ 255.353629] binder: 14786:14787 ioctl 40046207 0 returned -16 [ 255.365391] binder: 14786:14805 ioctl ae41 1 returned -22 07:10:41 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) ioctl$KVM_ENABLE_CAP(r2, 0x4068aea3, &(0x7f0000000000)={0x74, 0x0, [0xfffffffffffffff7, 0x32, 0x1, 0xffffffffffffffff]}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) r5 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$VIDIOC_G_CROP(r5, 0xc014563b, &(0x7f00000000c0)={0x8, {0x6, 0xfffffffa, 0x3, 0x57af}}) 07:10:41 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = dup3(r0, r1, 0x0) r4 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendto$inet(r4, &(0x7f0000fa3fff)='\t', 0x1, 0x0, &(0x7f00006f7000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000000080)={0x2, [0x0, 0x0]}, &(0x7f0000a8a000)=0xc) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r6 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r7 = dup2(r6, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r7, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$VIDIOC_LOG_STATUS(r7, 0x5646, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r4, 0x84, 0x6c, &(0x7f000059aff8)={r5}, &(0x7f000034f000)=0x2059b000) setsockopt$inet_sctp6_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000a40)=@assoc_value={r5}, 0x8) getsockopt$inet_sctp_SCTP_DELAYED_SACK(r3, 0x84, 0x10, &(0x7f0000000000)=@assoc_value={r5, 0x4}, &(0x7f0000000040)=0x8) dup2(r3, r2) 07:10:41 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x1, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630440", @ANYRES64=r2], 0x0, 0x0, 0x0}) r3 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="07630440"], 0x0, 0x0, 0x0}) [ 255.485662] binder: 14813:14818 unknown command 3 [ 255.490929] binder_alloc: 14814: binder_alloc_buf, no vma [ 255.505628] binder: 14814:14817 ioctl 4068aea3 20000000 returned -22 [ 255.506074] binder: 14813:14818 ioctl c0306201 20000200 returned -22 07:10:41 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) ioctl$KVM_ENABLE_CAP(r2, 0x4068aea3, &(0x7f0000000000)={0x74, 0x0, [0xfffffffffffffff7, 0x32, 0x1, 0xffffffffffffffff]}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) r5 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) 07:10:41 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$BATADV_CMD_GET_MESH(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={0x0, 0x8}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r7 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="38000000100039af00"/20, @ANYRES32=0x0, @ANYBLOB="001500009b0000001800128008000100736974000c00028008000100", @ANYRES32=r6, @ANYRES16=r7], 0x38}, 0x1, 0x0, 0x0, 0x10}, 0x0) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000000)={@private2, r6}, 0x14) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'\x00', r6}) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f00000000c0)={r8, 0x1, 0x6, @local}, 0x10) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="07630440"], 0x0, 0x0, 0x0}) 07:10:41 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ocfs2_control\x00', 0x280100, 0x0) getpeername$inet(r3, &(0x7f0000000040)={0x2, 0x0, @local}, &(0x7f00000000c0)=0x10) r4 = dup3(r0, r1, 0x0) dup2(r4, r2) [ 255.679106] binder_alloc: 14836: binder_alloc_buf, no vma [ 255.685628] binder: 14836:14839 ioctl 4068aea3 20000000 returned -22 07:10:42 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = syz_open_dev$vcsa(&(0x7f0000000040)='/dev/vcsa#\x00', 0x4, 0xc2042) setsockopt$inet6_tcp_TLS_RX(r1, 0x6, 0x2, &(0x7f00000000c0)=@gcm_256={{0x303}, "a3d8ff8708943a65", "f00806989be28347d84a3cc1faee4c7641f08b6a05112f3f5cc25008ee01c83a", "1c940fbc", "c11d24e7165b5589"}, 0x38) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fb0\x00', 0x220100, 0x0) ioctl$FBIOBLANK(r4, 0x4611, 0x1) r5 = dup3(r0, r2, 0x0) dup2(r5, r3) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x1, &(0x7f0000000180)=0x6, 0x4) [ 255.825705] binder: 14766:14781 ioctl c1004110 20001580 returned -22 07:10:42 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) ioctl$KVM_ENABLE_CAP(r2, 0x4068aea3, &(0x7f0000000000)={0x74, 0x0, [0xfffffffffffffff7, 0x32, 0x1, 0xffffffffffffffff]}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) r5 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) 07:10:42 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x800) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="07630440"], 0x0, 0x0, 0x0}) 07:10:42 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) r2 = dup3(0xffffffffffffffff, r0, 0x0) ioctl$SNDRV_PCM_IOCTL_DROP(r2, 0x4143, 0x0) dup2(r2, r1) r3 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r5 = dup2(r4, r3) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) setsockopt$inet6_icmp_ICMP_FILTER(r5, 0x1, 0x1, &(0x7f0000000000)={0x5}, 0x4) [ 255.962881] binder_alloc: 14875: binder_alloc_buf, no vma [ 255.996813] binder: 14875:14877 ioctl 4068aea3 20000000 returned -22 07:10:42 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0x6b, 0x502000) ioctl$SNDRV_PCM_IOCTL_HWSYNC(r2, 0x4122, 0x0) r3 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYRESDEC], 0x0, 0x0, 0x0}) 07:10:42 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) ioctl$KVM_ENABLE_CAP(r2, 0x4068aea3, &(0x7f0000000000)={0x74, 0x0, [0xfffffffffffffff7, 0x32, 0x1, 0xffffffffffffffff]}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) r5 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) [ 256.014911] binder_alloc: 14882: binder_alloc_buf, no vma [ 256.068103] binder: BINDER_SET_CONTEXT_MGR already set 07:10:42 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) r2 = dup3(r0, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r4 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$SNDRV_PCM_IOCTL_LINK(r4, 0x40044160, &(0x7f0000000180)=0xffffffff) r5 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r6 = dup2(r5, r3) ioctl$BINDER_SET_CONTEXT_MGR(r6, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$VIDIOC_EXPBUF(r6, 0xc0405610, &(0x7f0000000000)={0x3, 0x9, 0x3ff}) dup2(r2, r1) [ 256.094717] binder: 14897:14898 unknown command 875837489 [ 256.100702] binder: 14882:14891 ioctl 40046207 0 returned -16 [ 256.115451] binder: 14897:14898 ioctl c0306201 20000280 returned -22 [ 256.124620] binder_alloc: 14899: binder_alloc_buf, no vma 07:10:42 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) stat(&(0x7f0000000000)='./file0\x00', &(0x7f0000000180)) r3 = dup3(r0, r1, 0x0) dup2(r3, r2) 07:10:42 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) syz_open_dev$rtc(&(0x7f0000000040)='/dev/rtc#\x00', 0x6, 0x2400) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="00010000f546a1ab2c4ceb8b47b820659b9df489395f7be924eb40c00222d2876fc04eeb8b7e0c91102211ba9f810b2f1f59a148c302870500000000000000dd64c4a3fc2a953d809bea3b31cedc493b4b07cb67a82ec8d82589770fe3d900bacd4a7aef7ddf3074a3e5683129530c7cbd99a9e8ca00096549fe4ac3a54b7b0fe90340961074991e041fe33e00d88b4f4e562a93f761da703721909533f385c2c6cc8bde75f9c6537928f3"], 0x0, 0x0, 0x0}) [ 256.142560] binder: 14899:14900 ioctl 4068aea3 20000000 returned -22 07:10:42 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) ioctl$KVM_ENABLE_CAP(r2, 0x4068aea3, &(0x7f0000000000)={0x74, 0x0, [0xfffffffffffffff7, 0x32, 0x1, 0xffffffffffffffff]}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 256.191756] binder_alloc: 14903: binder_alloc_buf, no vma [ 256.228172] binder: 14903:14907 ioctl c0405610 20000000 returned -22 [ 256.256106] binder: 14909:14912 unknown command 256 [ 256.270708] binder_alloc: 14903: binder_alloc_buf, no vma [ 256.277498] binder: 14903:14916 ioctl c0405610 20000000 returned -22 [ 256.280439] binder: 14909:14912 ioctl c0306201 20000280 returned -22 07:10:42 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = dup3(r0, r1, 0x0) dup2(r3, r2) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) write(r4, &(0x7f0000000000)="d125d06327e52210b61846dc34e890c83e181bd32e8c24c4706dfd9c5bfd461b608fae536bd36bc43bdaa282f91ce3", 0x2f) [ 256.318234] binder_alloc: 14917: binder_alloc_buf, no vma [ 256.329601] binder: 14909:14921 unknown command 256 [ 256.337903] binder: 14917:14919 ioctl 4068aea3 20000000 returned -22 [ 256.349516] binder: 14909:14921 ioctl c0306201 20000280 returned -22 07:10:42 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nvram\x00', 0x260003, 0x0) ioctl$sock_inet_udp_SIOCOUTQ(r1, 0x5411, &(0x7f0000000140)) ioctl$EVIOCGMTSLOTS(r1, 0x8040450a, &(0x7f00000000c0)=""/93) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = dup2(r2, r0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="07630440"], 0x0, 0x0, 0x0}) 07:10:42 executing program 5: r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x18, &(0x7f00000000c0)={@flat=@binder={0x70742a85, 0x100a}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) r1 = syz_open_dev$mouse(&(0x7f0000000180)='/dev/input/mouse#\x00', 0x3, 0x8000) renameat2(r0, &(0x7f0000000140)='./file0\x00', r1, &(0x7f00000001c0)='./file0\x00', 0x2) r2 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x4, 0x20000000007ffd, 0x7c, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100]}, 0x2c) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r2, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096}, 0x20) r5 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) r6 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r7 = dup2(r6, r5) ioctl$BINDER_SET_CONTEXT_MGR(r7, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="0c0a63e8c4b765c0e104cb598e05484149a5dc1b8c0b26c30f2f6abdbea0110657f32a5ac8f11d2a0a0bb4458b79ea217486c3f5085a4e2670ce036ec53f73cb7ecc755f7d2c616fe6369194c8e2a9ff8961a757346aac1bdc27872a51f40ad6c2667e9de869a5c15a529ead743d36e0d126f29d019f9d55b3af3fc7c246"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000240)={0xd8, 0x0, &(0x7f00000015c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001780)={@flat=@binder={0x70742a85, 0x100b}, @ptr={0x70742a85, 0x0, &(0x7f00000016c0)=""/67, 0x43, 0x1, 0x17}, @fda={0x66646185, 0xfffffffffffffffe}}, &(0x7f0000000340)={0x0, 0x18, 0x40}}}, @reply_sg={0x40486312, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001800)={@fda={0x66646185, 0x0, 0x2, 0x200000003e}, @flat=@binder={0x73622a85, 0x1000, 0x1}, @fda={0x66646185, 0x3, 0x0, 0x38}}, &(0x7f0000000400)={0x0, 0x20, 0x38}}, 0x1000}, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000440)={@fda={0x66646185, 0x5, 0x1, 0x24}, @fda={0x66646185, 0x0, 0x0, 0x17}, @flat=@binder={0x73622a85, 0x101, 0x2}}, &(0x7f00000004c0)={0x0, 0x20, 0x40}}}, @register_looper], 0x0, 0x73b000, 0x0}) ioctl$DRM_IOCTL_GEM_CLOSE(r7, 0x40086409, &(0x7f0000000080)) 07:10:42 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) ioctl$KVM_ENABLE_CAP(r2, 0x4068aea3, &(0x7f0000000000)={0x74, 0x0, [0xfffffffffffffff7, 0x32, 0x1, 0xffffffffffffffff]}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) 07:10:42 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = dup3(r0, r1, 0x0) r4 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r6 = dup2(r5, r4) ioctl$BINDER_SET_CONTEXT_MGR(r6, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$KVM_NMI(r6, 0xae9a) dup2(r3, r2) 07:10:42 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) prctl$PR_GET_DUMPABLE(0x3) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="07638440"], 0x0, 0x0, 0x0}) getsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f0000000100), &(0x7f00000000c0)=0x4) 07:10:42 executing program 5: getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x24, &(0x7f0000000100)={@multicast1, @loopback, 0x0}, &(0x7f0000000140)=0xc) r1 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x4, 0x3f, 0x7c, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100], r0, 0xffffffffffffffff, 0x0, 0x0, 0x4}, 0x40) r2 = socket$inet6(0xa, 0x2, 0x0) r3 = dup(r2) ioctl$TUNSETCARRIER(r3, 0x400454e2, &(0x7f00000000c0)) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r1, &(0x7f00000004c0), &(0x7f00000015c0)=""/4085}, 0x20) mknod$loop(&(0x7f0000000080)='./file0\x00', 0x8, 0x0) 07:10:42 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) ioctl$KVM_ENABLE_CAP(r2, 0x4068aea3, &(0x7f0000000000)={0x74, 0x0, [0xfffffffffffffff7, 0x32, 0x1, 0xffffffffffffffff]}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) [ 256.525364] binder_alloc: 14937: binder_alloc_buf, no vma [ 256.562793] binder: 14937:14943 ioctl 4068aea3 20000000 returned -22 [ 256.622377] binder_alloc: 14940: binder_alloc_buf, no vma [ 256.650952] binder: 14940:14949 ioctl ae9a 0 returned -22 [ 256.655051] binder: 14954:14958 unknown command 1082417927 07:10:42 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) ioctl$KVM_ENABLE_CAP(r2, 0x4068aea3, &(0x7f0000000000)={0x74, 0x0, [0xfffffffffffffff7, 0x32, 0x1, 0xffffffffffffffff]}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) 07:10:42 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) r1 = dup2(r0, 0xffffffffffffffff) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$BATADV_CMD_GET_MESH(r3, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={0x0, 0x8}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB="001500009b0000001800128008000100736974000c00028008000100", @ANYRES32=r4], 0x38}}, 0x0) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000000)={@private2, r4}, 0x14) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f00000000c0)={'wg1\x00', r4}) r6 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x4, 0x20000000007ffd, 0x7c, 0x39, r1, 0x0, [0x0, 0x0, 0x0, 0x400100], r5}, 0x40) r7 = socket$inet6(0xa, 0x2, 0x0) r8 = dup(r7) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r6, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096}, 0x20) [ 256.677606] binder_alloc: 14960: binder_alloc_buf, no vma [ 256.703179] binder: 14954:14958 ioctl c0306201 20000280 returned -22 [ 256.707068] binder: 14960:14963 ioctl 4068aea3 20000000 returned -22 [ 256.748700] binder: 14954:14958 unknown command 1082417927 [ 256.770410] binder: 14954:14958 ioctl c0306201 20000280 returned -22 [ 256.779407] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=14977 comm=syz-executor.5 07:10:43 executing program 1: r0 = perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) write$input_event(r0, &(0x7f0000000180)={{}, 0x11, 0x7, 0x3f}, 0x18) r3 = dup3(r1, r2, 0x0) r4 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05631640"], 0x0, 0x0, 0x0}) getsockopt$bt_sco_SCO_OPTIONS(r3, 0x11, 0x1, &(0x7f00000002c0)=""/86, &(0x7f00000001c0)=0x56) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) getsockopt$bt_hci(r6, 0x0, 0x3, &(0x7f0000000340)=""/255, &(0x7f0000000440)=0xff) r7 = dup2(r5, r4) ioctl$BINDER_SET_CONTEXT_MGR(r7, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$SIOCPNDELRESOURCE(r7, 0x89ef, &(0x7f0000000000)=0x10000) dup2(r3, 0xffffffffffffffff) 07:10:43 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) ioctl$KVM_ENABLE_CAP(r2, 0x4068aea3, &(0x7f0000000000)={0x74, 0x0, [0xfffffffffffffff7, 0x32, 0x1, 0xffffffffffffffff]}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) [ 256.796036] binder_alloc: 14970: binder_alloc_buf, no vma [ 256.815390] binder: 14970:14974 ioctl 4068aea3 20000000 returned -22 [ 256.893140] binder: 14984:14985 unknown command 1075208965 [ 256.911403] binder_alloc: 14989: binder_alloc_buf, no vma [ 256.918166] binder: 14984:14985 ioctl c0306201 20000200 returned -22 07:10:43 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) ioctl$KVM_ENABLE_CAP(r2, 0x4068aea3, &(0x7f0000000000)={0x74, 0x0, [0xfffffffffffffff7, 0x32, 0x1, 0xffffffffffffffff]}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) [ 256.938046] binder: 14989:14993 ioctl 4068aea3 20000000 returned -22 [ 256.950850] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=14977 comm=syz-executor.5 [ 256.967041] binder: 14984:14985 ioctl 89ef 20000000 returned -22 07:10:43 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r5 = dup2(r4, r3) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) setsockopt$inet6_tcp_TLS_RX(r5, 0x6, 0x2, &(0x7f0000000000)=@gcm_256={{0x303}, "ea69fc8a2e656d21", "8eecef0768d97b476e3a519ee24161d6ab6e3a7ac86e303b3077056efd05c42f", "2b1f3f51", "ae6098dcc9a428fd"}, 0x38) r6 = dup3(r0, r1, 0x0) dup2(r6, r2) 07:10:43 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) r3 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x4, 0x20000000007ffd, 0x7c, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100], 0x0, r2}, 0x40) r4 = socket$inet6(0xa, 0x2, 0x0) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) lsetxattr$security_evm(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='security.evm\x00', &(0x7f0000000100)=@md5={0x1, "5dfe85118500edeb8e5fd53da63b797c"}, 0x11, 0x3) r6 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r6, 0x40046207, 0x0) r7 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r8 = dup2(r7, r6) ioctl$BINDER_SET_CONTEXT_MGR(r8, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r8, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r8, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$SCSI_IOCTL_START_UNIT(r8, 0x5) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r3, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096}, 0x20) 07:10:43 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$SNDRV_PCM_IOCTL_HW_REFINE_OLD(r2, 0xc1004110, &(0x7f0000001580)={0x40, [0x3ff, 0x10000, 0x400], [{0x357b, 0x3, 0x1}, {0x401, 0x0, 0x0, 0x1, 0x1}, {0x8001, 0x5, 0x1, 0x1, 0x1, 0x1}, {0x81, 0xff, 0x1, 0x0, 0x0, 0x1}, {0x5, 0x7ff, 0x1, 0x0, 0x1}, {0x1, 0x8000, 0x0, 0x0, 0x1, 0x1}, {0x6, 0x4, 0x1, 0x0, 0x1}, {0x7, 0x2, 0x1, 0x1, 0x1, 0x1}, {0x0, 0x101}, {0x4, 0x2, 0x0, 0x0, 0x1}, {0x4, 0x5, 0x0, 0x0, 0x0, 0x1}, {0x9, 0x5e2, 0x1, 0x0, 0x0, 0x1}], 0x80000001}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$DRM_IOCTL_MODE_ADDFB(0xffffffffffffffff, 0xc01c64ae, &(0x7f0000001680)={0x3, 0x8a3, 0x7, 0x8, 0x200, 0x1, 0x7}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) r6 = socket$nl_audit(0x10, 0x3, 0x9) recvmsg(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000180)=""/255, 0xff}, {&(0x7f0000000280)=""/4096, 0x1000}, {&(0x7f0000001280)=""/222, 0xde}, {&(0x7f0000001380)=""/193, 0xc1}], 0x4, &(0x7f0000001480)=""/244, 0xf4}, 0x8000) r7 = dup3(r3, r4, 0x0) dup2(r7, r5) [ 257.038236] binder_alloc: 15003: binder_alloc_buf, no vma 07:10:43 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) ioctl$KVM_ENABLE_CAP(r2, 0x4068aea3, &(0x7f0000000000)={0x74, 0x0, [0xfffffffffffffff7, 0x32, 0x1, 0xffffffffffffffff]}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) 07:10:43 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) ioctl$KVM_ENABLE_CAP(r2, 0x4068aea3, &(0x7f0000000000)={0x74, 0x0, [0xfffffffffffffff7, 0x32, 0x1, 0xffffffffffffffff]}) [ 257.092626] binder: 15003:15014 ioctl 4068aea3 20000000 returned -22 07:10:43 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) ioctl$FITHAW(r0, 0xc0045878) r1 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x4, 0x20000000007ffd, 0x7c, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100]}, 0x2c) r2 = socket$inet6(0xa, 0x2, 0x0) r3 = dup(r2) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_MON_PEER_GET(r3, &(0x7f00000002c0)={&(0x7f0000000080), 0xc, &(0x7f0000000280)={&(0x7f0000000100)=ANY=[@ANYBLOB="50020000", @ANYRES16=r4, @ANYBLOB="20002dbd7000ffdbdf25130000003c000180380004001400010002004e22000000000000000000000000200002000a004e2300000008fc000000000000000000000000000000ff0f00000c00078008000200050000003c00038008000100ff0300000800030001040000080003000000000008000200030000000800030005000000080001005808000008000300050000002800078008000200770e0000080001000200000008000200010000000c0004000200000000000000300002802c00038008000100040000000800020009000000080002000200000008000200ff7f000008000100ff010000600006804800040067636d286165732900000000000000000000000000000000000000000000000020000000d12bb929405546ef283d22f0412647df24633cf36ced42ee2c5b5dd8ff00853b040002000400020008000100181f000004000200"], 0x150}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r3, 0x4010640d, &(0x7f0000000300)={0x12}) r5 = syz_open_dev$audion(&(0x7f00000004c0)='/dev/audio#\x00', 0x1, 0x4800c0) sendmsg$NFT_MSG_GETOBJ_RESET(r5, &(0x7f0000001600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000015c0)={&(0x7f0000000540)={0x44, 0x15, 0xa, 0x201, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_OBJ_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_OBJ_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_OBJ_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x5}]}, 0x44}}, 0x8001) r6 = syz_open_dev$vcsa(&(0x7f0000000340)='/dev/vcsa#\x00', 0x3, 0xd00) r7 = syz_genetlink_get_family_id$ipvs(&(0x7f00000003c0)='IPVS\x00') sendmsg$IPVS_CMD_NEW_SERVICE(r6, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x38, r7, 0x800, 0x70bd2b, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DAEMON={0x1c, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @loopback}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x3}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x4}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x24048880}, 0x800) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f00000005c0)={r1, &(0x7f0000001640)="5c33ff24f94fc6f5eae14e6fac56a354789bc4c7a87896b534fb21a881481cfbe0ebe9cff8f5f50bfb2457f66dd6602a0a929fc42382b08755ca7d95c873c538b742f84f2d0c41083757deb170e95da30605e0e3cd9682075f71100b80eb31ff2d2b5ecb6141a86ef3080518ae00dc5433e05b03168fc521d91bd1cd6c45fa4254fd50cd4a7d5cd077ea704b5388142a91877bc8c418a934a08c6a76664af0246f703901e3174ecd037c5a7ba39481dd90526493fbfb0417f82c89dce222c4c574433420a75689653fd9da34471e6b6ffa759a716b90128f48b4510a87edd18c55a04b07acc008a6237728e43a491dfc45c54e84c43dfe89e7118b2ecabdf3d4bd41a10494f82ed397a91f5a4556e1827d8f869d7725a3da87091063cc91afe87eb058724a98b282c8d3c0b0c13038ac713535cad1b3aa35f76045598c9c805f2281defb5e048b34", &(0x7f00000017c0)=""/4105}, 0x20) [ 257.179128] binder_alloc: 15016: binder_alloc_buf, no vma [ 257.182375] binder_alloc: 15012: binder_alloc_buf, no vma [ 257.196811] binder_alloc: 15021: binder_alloc_buf, no vma [ 257.207596] binder: 15016:15022 ioctl c1004110 20001580 returned -22 [ 257.222816] binder: 15021:15025 ioctl 4068aea3 20000000 returned -22 07:10:43 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = dup3(r0, r1, 0x0) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r3, 0x10f, 0x84, &(0x7f0000000000), &(0x7f0000000040)=0x4) dup2(r3, r2) [ 257.240153] binder_alloc: 15024: binder_alloc_buf, no vma [ 257.270409] binder_alloc: 15012: binder_alloc_buf, no vma [ 257.283108] binder: 15024:15027 ioctl 4068aea3 20000000 returned -22 07:10:43 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:43 executing program 5: bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x4, 0x20000000007ffd, 0x7c, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100]}, 0x2c) r0 = socket$inet6(0xa, 0x2, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r4 = dup2(r3, r2) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f00000001c0)={r4, &(0x7f0000000100)="06fe4ae11943aa4f489cac62845c10f14b8ab5d778c44776f9efdb322237ed380bd00db7b8457d614c384aece6ca4824e165c6d7f81513fc192b2f871d1f487dd686d9cf899c3a1cd2776a6ec9bd729a8842fbbd0e110e51c4db1a9a4493f8db71669d79ebc62646a8c624c00232d2aa7f8a404d25ab4c231369b747be02cdb12443780bab171ae373803a0a9e5b922688e16e7885eeca14815d870fe34b2cea47d3f10669f7843ea953926a4170f08b52015904d0dee1f3ee", &(0x7f00000005c0)=""/4096}, 0x20) ioctl$SG_GET_PACK_ID(r1, 0x227c, &(0x7f0000000080)) r5 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer\x00', 0x240, 0x0) ioctl$VT_DISALLOCATE(r5, 0x5608) 07:10:43 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) ioctl$KVM_ENABLE_CAP(r2, 0x4068aea3, &(0x7f0000000000)={0x74, 0x0, [0xfffffffffffffff7, 0x32, 0x1, 0xffffffffffffffff]}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) 07:10:43 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 257.482415] binder_alloc: 15048: binder_alloc_buf, no vma 07:10:43 executing program 5: r0 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x4, 0x20000000007ffd, 0x7c, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100]}, 0x2c) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000080)={r0, &(0x7f00000000c0)="bef1220a9566e850ba3bf25b3ffcc250facf521837b615e3e820e9a1467c0edd", &(0x7f0000000100)=""/4106}, 0x20) [ 257.557247] binder_alloc: 15060: binder_alloc_buf, no vma [ 257.588512] binder: 15060:15064 ioctl 4068aea3 20000000 returned -22 07:10:43 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:44 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) ioctl$KVM_ENABLE_CAP(r2, 0x4068aea3, &(0x7f0000000000)={0x74, 0x0, [0xfffffffffffffff7, 0x32, 0x1, 0xffffffffffffffff]}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) [ 257.806878] binder_alloc: 15077: binder_alloc_buf, no vma [ 257.817916] binder: 15077:15078 ioctl 4068aea3 20000000 returned -22 07:10:44 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = dup3(r0, r1, 0x0) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r3, 0x10f, 0x84, &(0x7f0000000000), &(0x7f0000000040)=0x4) dup2(r3, r2) 07:10:44 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:44 executing program 5: r0 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x4, 0x20000000007ffd, 0x7c, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100]}, 0x2c) r1 = creat(&(0x7f0000000080)='./file0\x00', 0x44) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$BATADV_CMD_GET_MESH(r3, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={0x0, 0x8}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=ANY=[@ANYBLOB="38000000100039af00000000005869ac733db968fda862230b9a1b190000000c0000003aae5bd776aff1b29a394d304a5f8a3c20751e0dbca8736f8947f089d2e4dfcc14fbede0909f33069af7d5ef445473a7486b00c85e1f81d0d75cd8dcf0f38feab084fe83428c345b1b5411ee18eb7d5dfa70112d7ccfdfb8c1b4603950ab2e07000000c4b8d698fc6a64aa5ecfdfb6605eaf", @ANYRES32=0x0, @ANYBLOB="001500009b0000001800128008000100736974000c00028008000100", @ANYRES32=r4], 0x38}}, 0x0) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000000)={@private2, r4}, 0x14) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f00000000c0)={'batadv0\x00', r4}) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) getsockopt$IP_VS_SO_GET_TIMEOUT(r5, 0x0, 0x486, &(0x7f0000000240), &(0x7f0000000280)=0xc) r6 = socket$inet6(0xa, 0x2, 0x0) r7 = dup(r6) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r0, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096}, 0x20) 07:10:44 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) ioctl$KVM_ENABLE_CAP(r2, 0x4068aea3, &(0x7f0000000000)={0x74, 0x0, [0xfffffffffffffff7, 0x32, 0x1, 0xffffffffffffffff]}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) 07:10:44 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:44 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:44 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) ioctl$KVM_ENABLE_CAP(r2, 0x4068aea3, &(0x7f0000000000)={0x74, 0x0, [0xfffffffffffffff7, 0x32, 0x1, 0xffffffffffffffff]}) [ 258.096140] binder_alloc: 15095: binder_alloc_buf, no vma [ 258.119449] binder: 15095:15098 ioctl 4068aea3 20000000 returned -22 [ 258.141138] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. 07:10:44 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = dup3(r0, r1, 0x0) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r3, 0x10f, 0x84, &(0x7f0000000000), &(0x7f0000000040)=0x4) dup2(r3, r2) 07:10:44 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = dup3(r0, r1, 0x0) r4 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r6 = dup2(r5, r4) ioctl$BINDER_SET_CONTEXT_MGR(r6, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$smc(&(0x7f0000000140)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x40, r8, 0x501, 0x0, 0x0, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth1_to_bridge\x00'}]}, 0x40}}, 0x0) sendmsg$SMC_PNETID_FLUSH(r6, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000040)={&(0x7f0000000180)={0x64, r8, 0x2, 0x70bd2a, 0x25dfdbfd, {}, [@SMC_PNETID_IBPORT={0x5, 0x4, 0x2}, @SMC_PNETID_NAME={0x9, 0x1, 'syz0\x00'}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x2}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'hsr0\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth0_to_hsr\x00'}]}, 0x64}, 0x1, 0x0, 0x0, 0x48811}, 0x11) dup2(r3, r2) 07:10:44 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 258.225726] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 258.240150] binder_alloc: 15104: binder_alloc_buf, no vma [ 258.279275] binder: 15104:15106 ioctl 4068aea3 20000000 returned -22 07:10:44 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:44 executing program 5: r0 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x4, 0x20000000007ffd, 0x7c, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100]}, 0x2c) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = dup2(r2, r1) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)=ANY=[@ANYBLOB="852a74700000000000000000000000000000000000000000852a687300000000000000000000000000000000e400000074616466000000000000ff0f00"/80], &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'wg2\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x572e2cece7ee295b}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@deltclass={0x3c, 0x29, 0x400, 0x70bd27, 0x25dfdbfe, {0x0, 0x0, 0x0, r4, {0x8, 0xb}, {0xffe0, 0xf}, {0x7, 0x5}}, [@TCA_RATE={0x6, 0x5, {0x1, 0x1f}}, @TCA_RATE={0x6, 0x5, {0x7, 0x2}}, @TCA_RATE={0x6, 0x5, {0x7}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x8004001}, 0x60004011) r5 = socket$inet6(0xa, 0x2, 0x0) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r0, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096}, 0x20) 07:10:44 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 258.382659] binder_alloc: 15113: binder_alloc_buf, no vma 07:10:44 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:44 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) r4 = dup3(r3, r1, 0x0) dup2(r4, r2) 07:10:44 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 258.468774] binder_alloc: 15127: binder_alloc_buf, no vma 07:10:44 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = dup3(r0, r1, 0x0) r4 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r6 = dup2(r5, r4) ioctl$BINDER_SET_CONTEXT_MGR(r6, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$smc(&(0x7f0000000140)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x40, r8, 0x501, 0x0, 0x0, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth1_to_bridge\x00'}]}, 0x40}}, 0x0) sendmsg$SMC_PNETID_FLUSH(r6, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000040)={&(0x7f0000000180)={0x64, r8, 0x2, 0x70bd2a, 0x25dfdbfd, {}, [@SMC_PNETID_IBPORT={0x5, 0x4, 0x2}, @SMC_PNETID_NAME={0x9, 0x1, 'syz0\x00'}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x2}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'hsr0\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth0_to_hsr\x00'}]}, 0x64}, 0x1, 0x0, 0x0, 0x48811}, 0x11) dup2(r3, r2) 07:10:44 executing program 5: r0 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x4, 0x20000000007ffd, 0x7c, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100], 0x0, 0xffffffffffffffff, 0x0, 0x4}, 0x40) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r0, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096}, 0x20) 07:10:44 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:44 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:44 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:45 executing program 5: r0 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x4, 0x20000000007ffd, 0x7c, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100]}, 0x2c) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r4 = dup2(r3, r2) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) setsockopt$inet_MCAST_LEAVE_GROUP(r4, 0x0, 0x2d, &(0x7f0000000080)={0x2, {{0x2, 0x4e20, @local}}}, 0x88) r5 = dup(r1) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) dup3(r6, r2, 0x80000) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r0, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096}, 0x20) 07:10:45 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:45 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 258.772349] binder_alloc: 15143: binder_alloc_buf, no vma 07:10:45 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = dup3(r0, r1, 0x0) r4 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r6 = dup2(r5, r4) ioctl$BINDER_SET_CONTEXT_MGR(r6, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$smc(&(0x7f0000000140)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x40, r8, 0x501, 0x0, 0x0, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth1_to_bridge\x00'}]}, 0x40}}, 0x0) sendmsg$SMC_PNETID_FLUSH(r6, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000040)={&(0x7f0000000180)={0x64, r8, 0x2, 0x70bd2a, 0x25dfdbfd, {}, [@SMC_PNETID_IBPORT={0x5, 0x4, 0x2}, @SMC_PNETID_NAME={0x9, 0x1, 'syz0\x00'}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x2}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'hsr0\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth0_to_hsr\x00'}]}, 0x64}, 0x1, 0x0, 0x0, 0x48811}, 0x11) dup2(r3, r2) 07:10:45 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 258.844433] binder_alloc: 15166: binder_alloc_buf, no vma 07:10:45 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:45 executing program 5: r0 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x4, 0x20000000007ffd, 0x7c, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100]}, 0x2c) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r4 = dup2(r3, r2) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$KVM_SET_PIT(r4, 0x8048ae66, &(0x7f0000000080)={[{0x1ff, 0x2, 0x4d, 0x7, 0xff, 0x7f, 0xfa, 0x8, 0x12, 0xe6, 0xf7, 0x81, 0xa53}, {0x2, 0x7, 0x4, 0xb3, 0x8, 0x80, 0x1, 0xfa, 0x3, 0x64, 0x5, 0xff, 0x100000000}, {0xc83, 0x4, 0x59, 0xff, 0x1, 0x3, 0x7, 0x1, 0x1, 0x0, 0xf8, 0x1, 0xe44}], 0x69ac}) r5 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r0, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096}, 0x20) 07:10:45 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:45 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r1 = dup2(0xffffffffffffffff, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 259.026115] binder_alloc: 15173: binder_alloc_buf, no vma 07:10:45 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = dup3(r0, r1, 0x0) r4 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r6 = dup2(r5, r4) ioctl$BINDER_SET_CONTEXT_MGR(r6, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$smc(&(0x7f0000000140)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x40, r8, 0x501, 0x0, 0x0, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth1_to_bridge\x00'}]}, 0x40}}, 0x0) sendmsg$SMC_PNETID_FLUSH(r6, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000040)={&(0x7f0000000180)={0x64, r8, 0x2, 0x70bd2a, 0x25dfdbfd, {}, [@SMC_PNETID_IBPORT={0x5, 0x4, 0x2}, @SMC_PNETID_NAME={0x9, 0x1, 'syz0\x00'}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x2}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'hsr0\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth0_to_hsr\x00'}]}, 0x64}, 0x1, 0x0, 0x0, 0x48811}, 0x11) dup2(r3, r2) 07:10:45 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 259.107470] binder_alloc: 15184: binder_alloc_buf, no vma [ 259.125297] binder: 15184:15186 ioctl 8048ae66 20000080 returned -22 07:10:45 executing program 5: r0 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x4, 0x20000000007ffd, 0x7c, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100]}, 0x2c) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = accept4$x25(0xffffffffffffffff, &(0x7f00000000c0)={0x9, @remote}, &(0x7f0000000100)=0x12, 0x80000) fcntl$F_GET_RW_HINT(r2, 0x40b, &(0x7f0000000140)) r3 = dup(r1) setsockopt$inet_sctp6_SCTP_MAXSEG(r1, 0x84, 0xd, &(0x7f0000000080)=@assoc_value={0x0, 0x5}, 0x8) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r0, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096}, 0x20) 07:10:45 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r1 = dup2(0xffffffffffffffff, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:45 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:45 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r1 = dup2(0xffffffffffffffff, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 259.308108] binder_alloc: 15191: binder_alloc_buf, no vma 07:10:45 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) r3 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x4, 0x9, 0x3c, 0x0, 0x1, 0xa4dd, [0x0, 0x0, 0x0, 0x400100], 0x0, r2}, 0x40) r4 = socket$inet6(0xa, 0x2, 0x0) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r3, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096}, 0x20) 07:10:45 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) dup3(r0, r1, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r4 = dup2(r3, r2) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$smc(&(0x7f0000000140)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x40, r6, 0x501, 0x0, 0x0, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth1_to_bridge\x00'}]}, 0x40}}, 0x0) sendmsg$SMC_PNETID_FLUSH(r4, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000040)={&(0x7f0000000180)={0x64, r6, 0x2, 0x70bd2a, 0x25dfdbfd, {}, [@SMC_PNETID_IBPORT={0x5, 0x4, 0x2}, @SMC_PNETID_NAME={0x9, 0x1, 'syz0\x00'}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x2}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'hsr0\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth0_to_hsr\x00'}]}, 0x64}, 0x1, 0x0, 0x0, 0x48811}, 0x11) 07:10:45 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:45 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:45 executing program 5: r0 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x4, 0x20000000007ffd, 0x7c, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100]}, 0x2c) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r4 = dup2(r3, r2) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="00000000efbde43f30ab5dc33bf9ff03009ac89ef17ff8bf59959c9a23c1912a3732ea235689242fa7723f2ae46a48708824f3c008893d11a29ed52bea213087972f0f162999f5cb2851a81196e6b883000e86f589adf20570bbb623921484c7fb546bc60183b231fb4b72b2f1354eaa1158d5cbc9dce3d219ccb955f13dd3"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) getsockopt$inet_IP_IPSEC_POLICY(r4, 0x0, 0x10, &(0x7f0000000080)={{{@in=@multicast1, @in6=@loopback}}, {{@in6=@private1}, 0x0, @in6=@private1}}, &(0x7f0000000180)=0xe8) r5 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r0, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096}, 0x20) [ 259.486714] binder_alloc: 15214: binder_alloc_buf, no vma 07:10:45 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:45 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:45 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 259.598780] binder_alloc: 15217: binder_alloc_buf, no vma 07:10:45 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:45 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) dup3(r0, r1, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r4 = dup2(r3, r2) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$smc(&(0x7f0000000140)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x40, r6, 0x501, 0x0, 0x0, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth1_to_bridge\x00'}]}, 0x40}}, 0x0) [ 259.680038] binder: 15228:15237 unknown command 0 07:10:46 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r1 = dup2(r0, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 259.709441] binder: 15228:15237 ioctl c0306201 20000280 returned -22 07:10:46 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 259.784440] binder_alloc: 15241: binder_alloc_buf, no vma 07:10:46 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r1 = dup2(r0, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:46 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) dup3(r0, r1, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r4 = dup2(r3, r2) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$SMC_PNETID_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x40, 0x0, 0x501, 0x0, 0x0, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth1_to_bridge\x00'}]}, 0x40}}, 0x0) 07:10:46 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:46 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r1 = dup2(r0, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:46 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r1 = dup2(0xffffffffffffffff, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:46 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 260.024232] binder_alloc: 15259: binder_alloc_buf, no vma 07:10:46 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) dup3(r0, r1, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r4 = dup2(r3, r2) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$SMC_PNETID_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x40, 0x0, 0x501, 0x0, 0x0, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth1_to_bridge\x00'}]}, 0x40}}, 0x0) 07:10:46 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r1 = dup2(0xffffffffffffffff, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 260.139981] binder_alloc: 15274: binder_alloc_buf, no vma 07:10:46 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:46 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r1 = dup2(0xffffffffffffffff, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 260.227737] binder_alloc: 15276: binder_alloc_buf, no vma 07:10:46 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) dup3(r0, r1, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r4 = dup2(r3, r2) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$SMC_PNETID_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x40, 0x0, 0x501, 0x0, 0x0, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth1_to_bridge\x00'}]}, 0x40}}, 0x0) 07:10:46 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000080)={0x9, 0x0, 0x10000, 0x7}) ioctl$DRM_IOCTL_SG_FREE(r2, 0x40106439, &(0x7f00000000c0)={0x6f70, r3}) r4 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x4, 0x20000000007ffd, 0x7c, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100]}, 0x2c) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r4, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096}, 0x20) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000002640)=ANY=[@ANYRES32], 0x32600) 07:10:46 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 260.332556] binder_alloc: 15288: binder_alloc_buf, no vma 07:10:46 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 260.399908] binder_alloc: 15294: binder_alloc_buf, no vma [ 260.415118] binder: 15294:15296 ioctl 40106439 200000c0 returned -22 07:10:46 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 260.457207] binder: BINDER_SET_CONTEXT_MGR already set [ 260.467229] binder_alloc: 15293: binder_alloc_buf, no vma [ 260.469624] binder: 15294:15296 ioctl 40046207 0 returned -16 [ 260.484171] binder: 15294:15302 ioctl 40106439 200000c0 returned -22 [ 260.495931] binder_alloc: 15300: binder_alloc_buf, no vma 07:10:46 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) dup3(r0, r1, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r4 = dup2(r3, r2) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) r5 = syz_genetlink_get_family_id$smc(&(0x7f0000000140)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x40, r5, 0x501, 0x0, 0x0, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth1_to_bridge\x00'}]}, 0x40}}, 0x0) 07:10:46 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:46 executing program 2: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:46 executing program 3: r0 = syz_open_dev$mouse(&(0x7f0000000080)='/dev/input/mouse#\x00', 0x701, 0x2) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$BATADV_CMD_GET_MESH(r2, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={0x0, 0x8}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="38000000100039af00"/20, @ANYRES32=0x0, @ANYBLOB="001500009b0000001800128008000100736974000c00028008000100", @ANYRES32=r3], 0x38}}, 0x0) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000000)={@private2, r3}, 0x14) r4 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x4, 0x20000000007ffd, 0x7c, 0x0, r0, 0x0, [0x0, 0x0, 0x0, 0x400100], r3, 0xffffffffffffffff, 0x0, 0x800}, 0xfffffffffffffdd6) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r4, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096}, 0x20) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000002640)=ANY=[@ANYRES32], 0x32600) 07:10:46 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r1 = dup2(r0, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 260.636023] binder_alloc: 15314: binder_alloc_buf, no vma 07:10:46 executing program 2: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 260.718732] binder_alloc: 15311: binder_alloc_buf, no vma 07:10:47 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r1 = dup2(r0, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:47 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) dup3(r0, r1, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r4 = dup2(r3, r2) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) r5 = syz_genetlink_get_family_id$smc(&(0x7f0000000140)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x40, r5, 0x501, 0x0, 0x0, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth1_to_bridge\x00'}]}, 0x40}}, 0x0) 07:10:47 executing program 2: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:47 executing program 3: r0 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x4, 0x20000000007ffd, 0x7c, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100]}, 0x2c) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r0, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096, 0x4}, 0x20) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x2) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="748828a240"], 0x0, 0x0, 0x0}) r3 = dup2(r2, r1) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) write$cgroup_subtree(r3, &(0x7f00000025c0)=ANY=[@ANYBLOB="2fe95068651b3a1956642c1715b1520c1584a1c57707d021d5aa680d220c16c75981c9d0047b764e2f3d8d9aa9e4bddabadccc895f34a03163e2407fadf8e7480085e19349c33a6e30d248e8e4c5ca389c8540d4d594a301c13d95529572ac09403457f9f550038fec1fa578d8db3bc6cb9fecfaff9297f192c8ef3113e75860851bf7960ce956f0d297191e23f6bd6d9a679989f299843b7a0941ac61a7940e16ac9021b6c10394784c83458d8a2e470673b9273790bb81acb3d72c363b00197d469849e89d2a810b96e7a8c07fefd85fa9325f9fa74aedec464b283ea78a10dfbe59dc12dc277d0882027918beafc16acc97f0db777e320ea591bc2b913c3a3e17b50853ea895b0e3c8f1a238063b2806bf1c2f5642612b70928527e6badca0ce8aae40b56cb679430c18cccc7ab293c80eac290fe6245a18786520c8a8c8e58b9f57fd47aae792dbabb34b02c631ab22818b6fe20c3b48cacf96d9d45d96049faef621faa1003e061c73b60773c139341d3bdfc705443894beb61539b79f481a592e2b4c0d5a4d581f7cd95493fed08ca3df094e0ebf34143d2eab88f3a0cf279ffb8cbb8a54de3c05b79a553f8ce60d9dd31cea81ed1b86b10ec926edb77440549b1ca7ffc0b9b063b274c31990338332e4b10ae283e8b2d7d8c21e4047c08a1d912071c5360d8e0cff6d21287676d918ea9158f1d2b4b9821b22b67f3c0360ce1b1f64ab76745a69eaddaa872f40d9010d0c05d5d007df2569a5654d12609b568fc7bc8503e978bbf351a864b2a1bf977360f603f6162428fe2d6b47e42f21459253741f4a58151167bef1cebc9f4300bbf71e41794c53dffbed06812930403917ed139391a19b9c30e1ff052efe4ebbf676aefcce6ad496ee947763e95945c11d83873be838017e59546117534d04e2ef21655f139871500a5c57c924073ea5e86b3ce4e1bc6892cb6b082c8d791324ed54c6fba668a7912f0ec515d3803b7d2d381d1380bf05de4e8c7ce34a71731ff484462708fd38b374f0ea4921e1f30c93b35679ffad5a44ca183df519ee4a22accac8c57cd69198d309d67209e13fdb2446b18239677cfddae3c59aefa34ef341841b1cb631a1dd3d4e9dac1ef3aa5d9f86eeadf6996659a161a452d30d03c1507a4c5b63d84e2b4fedca4972be875d6891336de48e464bca7a18576e90e8905359cb573024a130d410c2c5629e1a9385faafa4025d05458223e341a92fef5c587e3f84bf124410b417acdba5ed88fcfcbbd365760176ed53bb0f3a07b157e1fa2d79bb95f0b0669f11fd39fceedc6cd036cc5ce1ff4434ab1d2299744698ca05da77783dac7bff6cafc8ae211d181956e7f5d739ac852b573682864f079d775cf43d615c156dcbf378440c2b64da914b40819074610cb58cd994e929be85c205d1b215be03ea78f0431beeb4318e35af68451d93b8dc593328495368177f12e80ed8aeadb0187bb6f1c18d1f3ff7da0fe973ebc676a56441f0682ddfa2268f1eaa696286a9614f2bcfb1ec235d1a94e1c23f8258e1e54d88610640b05bc761eeb18306129e00516e70f9446acf6ef3bfb80531db9a9e9c0e8e97e2063b9f179f8bd08fabd1826eeae77105b244766f2414f3436e27ce47725c8c6f7d5584fc6de2bfd97b9a3a651abf02f35928f6fa456e3cb403ab12181590e0a9d93fef9853ee8845a935df3021b1ae4bc9c48fa0a7296e0919c948bce16ba4e79c7fc91e8005e4b4320e4373bfceaa7bdf94d8bafae43015a95d83c710548f97492047b9b2a09fa538f5b11701e4a2b8e068547e3d42b693c21696a5d3f86f9957d7566b9a7653fb864b4a0b67f83e1ce39394ac4b0522595da38e570823e51bfe825ffc6e46108cd90f2a2a653c499a0fc2aeca327514690fd0fe3b5759b4cbda6d7fc75faa97ac58fa7ab8476ee31031f036fbb8a043cc7d9f9bdb35341bd8f7b9c2a087cad4bb738d67cbea9c2ab6e5a0992e9e8e39c719123b23d09f4a4402b615d6e97060571bbc431e254c960f1e04a2ed9da1509457b1e5f4ef2316718431b94a5400c57ce8b4dbe628e8564347e3d37592f3928aa2ae8b516404f3576bb910d82ed6be1d1b6de9fcd48e375ad5257cb5ca636b5ac5a8fb972ecf08a22d3776d2e8649fc61659b422e90d9e8c86258d27f08f0d81947d2a6c34247e270f79226a48a4bae4404e160355ac9690a66fe0bd53904d8da80b66a141ea7e8d24810ae19078767e7ecb7f71df4c300080c9239b3cefe684ede5c4a6f3fa1563489594a4abf48ac26cea59ee7e7338790d58a32f2fa4c82b553543bdd090c24b27a1132f0a814ee17c861b42dd06c13b18ef93c29a0bb6ab2218f1b9bc42ca0a591c3fa7d907e0b0708a6166f3827b7d912d5b079918f2c948f109db7f2b8d565ae57691af10a7633258034465d8778140f33579025942a1077740ea74b0da6c8ed6fb72f163734e6c250d6648d50ab59be22834ed121a1c44e9a55c4960fda4b05a11ea988a3ce6f4f00e165631c251cb1421bc31252893712861d9b3c9b767cc75cde10688c4a6c763bd5c1de26047eb8f29d983a6add4bd88faf76f0a8433006f7e70b338447f9beb7f267fec565e120d4c05c5c09e1fdc02828fd66ee38920c882e63bdc952f7aaf0cc68b96b305cb9d03c1e762884ce8f3903de6ee0c904063c43d9573a04e66af30aba61ebda5decc4d5e242cea9c950aed1376b222bfbd68ebf218aa889fba5c3356e605ecd9dcf7e6721ced60f0916eb5c8c0b85e55db10f4bab220c54bb3b3b9414a624bbf5681e12f41e2dd2502de23488881a16f3b0393cd33e704c62e7f332b769f77b00d280599f12b3a9c50a758ee0593191d7bb1b901b55d7935d887f7ca98ef601ba95347af8bf92e8498dae4ed497ca35693845e75cd069201484d1e9ac21a1cff4bafeb50e4a913774542c511511139dbf0fc6758a031b3c9329785df85965559588d2548e42e931a189782adf5789e738588d0246a5586a47990256b9d64eb69bebde08375495e399ca50b40fb09bdb28efdf75c66a256d88aff06f5da8d7eb2f0311117ddd3014859dd407286249bd236e9bdedd69aab5968047ccc5fb6b2a388e0f418e20f3f76857ef327510b69256f61ac826697bfddeaeb4d343c09215bae8e40146f7a5c2a70f77189e20cad636069a0ebb080d459bb1e10f04f49bcba5ecec63dc8fa9236df1028ff7e3099c0dc4ccfdea1d1ebab16c20e4c607100ba4ac6b9522aa816b226d26376f62635caf11ff4f6c0336c60dcac2f5ab5b10de449d8fd60df1fa799889927835b9c769bd64712dcb467e78f9c52b90de66bc6c5ce2931447aca5e08b2e7e3cf30734b05b37a67cdd31105880a16add8dfb7da6987b745014992f8f7cceb69e92554ccb7df7c9ef71c49e0159d59f129236b41a941b8c78af31477046185f665f05ec08f127eb1c4502242ad23d8f3c06edc72addf72ef73ae64ba775bea94532b433fd36c1bd72ff5772eba2582458ece140134c2732393e4fee498d18b293412489971bf72cbe5980fc8c2d9b19317989fb28c3fbdc7d5189b2d6954983197b262097a133ac0eee8518a4c8312771ef55b0a66c8b2beeccc12d27d09cc8acf04bed6ebdb3f817b82ffe3ca75e023ade931d58c5cd24f46e9ad586f3f0fe4a7dc672048e7ed963147e3d5d608cbc4ae12c35c83c3ebe10407fef43826e540be910f794287773ae6a1e4003680bab28cbea09ef468fb29e3b701a5ae52ef03e755830e6dede63d1207db944144eb763c0342541857bacd83902fb13558626b523a5d4742a5a90177ccb6edb99be7657c0c45b8190c37c795f2e33c6b34a686f938fd400836bfa759d935193407815631c816acee914c9f4c6943a0cb5f20d340888bc68032b9cf9a463bd77f97d870f3b190fb99a2c09a99b8994822902a34193c3471f975ed9b9e7fb3f4857dd154914e6505825b0753a2ee17d80fcb8649d81a6e8079d8754525848be0bd6856f0b6d8361a856a2b43e0f5df2a64c1f76a05ba96a545f5fdcdffc7bdf7038d500023e189218f17be1b6f3bda1ab4e631bb42eebc9428c083ba82d5e39a0afa3531a13fa1c9c40940d9659eb8a62718f431b8a2e46b90046df1ea171362725a7249c9a853675836eb470c21bf752cea7c6ed1c879ee2a6f6a9781eb77af4d88016051be0123056bd6fd7c421abf90918fb6a5ff474b6b936405aaa7086b3681e28f56a10356d7bf8bb0f0ecd23ce61f717a8b9694ce8c6b3043ab8659694e15505a06bbda2508390a44c2aebd3039058e3e615272201e085494eabc0b466bfb93ea92f5bed2417c65613a033a3b507002248fd47e48719e3237491a0cc1fd92011517ec2ba342fcfc092a146914b238818b12ff61a7c9f82600ebe0bea1f426650f02956d12e4f3bdd2d69af5275babbee7b295eb0334c9d8acf3b0b616add76d40b0adf9235ceb7f7086a5a86093d785043660068d94f39abc5c5572832c073ca21afa8870b87253a4db976f72a1823f1a1620d89c5f35dd2c9ee007857de8af1a819514fda206407eaf70dfbfd632c8c001613743ba7ca6cd9f604251405b541c65469e3bb466bd47bcac4ca6ce2585c9d4e9bf7144cdfc9dc8dc811381c185bd7dcdeaad264738b3d3db478ec1a080a29463f31ccab13a7201798c76dc106b0a4aa70a9b3c55dfea97cde8767b12728d139035b718f113bf4a7f2c6e42e1c643ec96716cd9ce3d7ea09cbac8212e75519d93a2bbd5fccc964f65ebe8bc8aa9854cb3fafb5a9a82cfb97528e1321e5a8e4b47075698c28f4c429a9f7a952d00402627ab7d6e4c1d7b8b1b98c5e23411356b1f2e62fbd22094f5028665d8fad84bdc7c7a8bf7b0477ba23b8fe7551371425ca1afde66b630437c898e630ff182630baf4257a41d513c58690abc7bbfa3f2093e294dbe25c0d344931aeaba1b6479ffa32afb5cfb560c6c4816796a348d0cbf49b22e401258975ec01ecef1306f5f72385107b83004f8cf8841bdfdfe306775e7ac150c90deca9f4b7a8516d310e260a596f888a1aeb6b42c392d186bc7110981f2662e905b7a9190392ef85d91d93e26f71d6694b214ac1cac027dc45c41da81650dd81a01d90509f608ed71787c0d77b8bae4e0318f350c9624ee3ac90ad7ced40903af2f7d7bc4cb94ecd608ed73fa1958c2fe23c95f7cc5effaa7518014a4601d1b9083668597ed8667f349291186c2616ff7eb5ab96e27489e6a75eb4b3e1444742dc1236c60dd740dba2283e7b9c484c2148906ee61a0da1ebee944f8f6a287117cba54fd1e8fa883d8f0549ff25186393da64778fcf3aec23f1faae9f620cffee7a7a261eedb3280a6e6a7f747ca7a9093b7242ece32b051305a85704ad4a03d855ca3e8c70dcf96ad18b1fc9ae54e2b5d0f8e4b7f0b50b7ef931243a7e941752f7f3e17067d79786c782c6797cdb6dcebe80826de36f7448e2766c2ed983bdb53328ae13d303dd40371ca1fc52e8b4500cdd5a45c88c7b96e241ceff084737c2f524308c1837235594513b1e25a005ee399c74b643b36a76f532c8db9b13259e6bd7e487bdb18d1b0fb3e16961149db490f33f340500ea4ed44d6bcc442a86e2c8e2ab0a556d3c347ffc29f36396edf06ed7aa885421f9258387dcaff105d475160db917dec46071f0f1f6ca47400d33ef8356085d471dca51e6b73be654d5869d2ab59ff62dc999a7afc1754821880366359ede1c62055f1e9335997163130c0e723bdbd3132b1d3a36624b2a278bd9ec", @ANYRESOCT=r4, @ANYRES16=r5, @ANYRESHEX=r1], 0x32600) [ 260.801469] binder_alloc: 15331: binder_alloc_buf, no vma 07:10:47 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r1 = dup2(r0, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 260.885332] binder_alloc: 15340: binder_alloc_buf, no vma 07:10:47 executing program 2: perf_event_open(&(0x7f0000000100)={0x0, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:47 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 260.926422] binder_alloc: 15338: binder_alloc_buf, no vma [ 260.960449] binder: 15346:15349 unknown command -1574401932 [ 260.967432] binder: 15346:15349 ioctl c0306201 20000200 returned -22 07:10:47 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) dup3(r0, r1, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r4 = dup2(r3, r2) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) r5 = syz_genetlink_get_family_id$smc(&(0x7f0000000140)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x40, r5, 0x501, 0x0, 0x0, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth1_to_bridge\x00'}]}, 0x40}}, 0x0) 07:10:47 executing program 2: perf_event_open(&(0x7f0000000100)={0x0, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:47 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 261.058691] binder: BINDER_SET_CONTEXT_MGR already set [ 261.066894] binder_alloc: 15353: binder_alloc_buf, no vma [ 261.078788] binder: 15346:15349 ioctl 40046207 0 returned -16 [ 261.079895] binder_alloc: 15354: binder_alloc_buf, no vma 07:10:47 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) accept$nfc_llcp(r2, &(0x7f0000000080), &(0x7f0000000100)=0x60) r3 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x4, 0x20000000007ffd, 0x7c, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100]}, 0x2c) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r3, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096}, 0x20) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000002640)=ANY=[@ANYRES32], 0x32600) 07:10:47 executing program 2: perf_event_open(&(0x7f0000000100)={0x0, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 261.156082] binder_alloc: 15355: binder_alloc_buf, no vma [ 261.193557] binder_alloc: 15365: binder_alloc_buf, no vma 07:10:47 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) dup3(r0, r1, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r4 = dup2(r3, r2) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$smc(&(0x7f0000000140)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x40, r6, 0x501, 0x0, 0x0, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth1_to_bridge\x00'}]}, 0x40}}, 0x0) 07:10:47 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 261.219034] binder_alloc: 15366: binder_alloc_buf, no vma 07:10:47 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 261.272407] binder_alloc: 15373: binder_alloc_buf, no vma [ 261.284653] binder_alloc: 15375: binder_alloc_buf, no vma 07:10:47 executing program 4: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 261.322722] binder_alloc: 15380: binder_alloc_buf, no vma [ 261.328690] binder: BINDER_SET_CONTEXT_MGR already set [ 261.358073] binder: 15373:15374 ioctl 40046207 0 returned -16 07:10:47 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) dup3(r0, r1, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r4 = dup2(r3, r2) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$smc(&(0x7f0000000140)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x40, r6, 0x501, 0x0, 0x0, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth1_to_bridge\x00'}]}, 0x40}}, 0x0) 07:10:47 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:47 executing program 4: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:47 executing program 3: syz_mount_image$tmpfs(&(0x7f0000000080)='tmpfs\x00', &(0x7f00000000c0)='./file0\x00', 0x800, 0x5, &(0x7f0000000480)=[{&(0x7f0000000100)="ec01c66ce8f13950dc35ce8a21e56b580c13aadd43f3faaf7dff6f468f2aee4bf8624f01f93ca4e4b483919abb4a3624bb5c5c7879e9fa30bed82bde5b9a2373a63a88ec5a6c46e990d6a06914d627c55501526b8c581860e45775debfcd955c20e6fa910f60899a88dd00b468228d3209e9e65152ce08fb4a085a593636dfd6a796c4ebc02b16a6dd59f44e75cca6f3c5786bf8ca3718bc908f549d7169258b015799f48da21f94196a9f532b4e3392fe932c1dbe", 0xb5, 0x7fff}, {&(0x7f00000001c0)="943829289d7c653c47962218155aa287c0b8ba020e320e2cee69d642b7b2be68f1cc483f12fe42ea85defd28305841cdef5e151576f8f11a79311a06ea24ac659ff5a9faa11442446d8a6ef2e5605efd6d9ac3a6ce0b07b24e06ef43621f9f61b046c9065b3fabdd841ae95e0fce5c6818e09771cc8f41705291580b7b14b5cb63c1f077e314d305c7b5099de0c2ad308caeaabea7d0179b56f3ed6001ee7a8466d505a101701b871ccfba1d6b88873d71ae8895ac", 0xb5, 0x7fffffff}, {&(0x7f0000000280)="d54de6222e32ae07c839", 0xa, 0x7}, {&(0x7f00000002c0)="7b00bc481a28c60152d7019824cf8a73961e725c4724aea76db50b56b8c978bc9e7977cc43736010cbd961843e8bce81c51ff3d90f4527e804bd47cf91a73d2b7ede1149a22852393a58897046297ad79ce450ad365c3569a3866d1136841567f1c44aada54c01670ba4d8e0b8b79e6e84eb6178835c2650c2d4231108e204855d55f69da56f33de6dce095e2c177ed1924cd80edeb69688e26784232b55b404f3a2c41b4791015dd536a0e0bc5238a8721967ac784d25ae82ad8aa44ad9ac1aa6ffa67ce7c4a0f59cb8c7b6c5ec2ae57fe678b0702b90c251eb3329bceb22d4e6dd73e9b07f4563153799ce2a64fbb275886911", 0xf4, 0x7f}, {&(0x7f00000003c0)="a28f540b71a17f8bab27f1c3694c19b79ff8c317eea7f7d0078333483b67d7398ee3609b5c7474aeb2b106bfcd9963cc96894552fa9a5ec7d583c19965613e84f2f4f00ef728dcc06198f5f1ff074f29eade740a5486a70e8ee97e4fe036e365949f477e8fa9c8182e266d816016fc66d3f57e8d7dc5a2469adaa3879fbe42800ce3eca217e9f5a5a01be76fc3e876e603a4b919957e1e3b21d5702603f0217487b906924b06da1d10c5c3774c3dc6dbdd141df5bfea042d45d3ebe3b434c911", 0xc0, 0x1}], 0x3093000, &(0x7f0000000500)=ANY=[@ANYBLOB='huge=within_size=,huge=never=!-,huge=within_size=@,fsmagic=0x0000000000000005,sj_user=,\x00']) r0 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x4, 0x20000000007ffd, 0x7c, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100]}, 0x2c) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r0, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096}, 0x20) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = dup2(r2, r1) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630441"], 0x0, 0x0, 0x0}) r5 = dup2(r4, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) recvfrom$rxrpc(r5, &(0x7f00000015c0)=""/42, 0x2a, 0x1, &(0x7f0000001600)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e20, @multicast1}}, 0x24) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05ea2a40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000001680)={0x4c, 0x0, &(0x7f00000017c0)=[@transaction_sg={0x40486311, {0x4, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x48, 0x75, &(0x7f00000016c0)={@flat=@binder={0x73622a85, 0x1, 0x2}, @fd={0x66642a85, 0x0, r5}, @fd}, &(0x7f0000001780)={0x0, 0x18, 0x30}}, 0x10c0}], 0x0, 0x73b000, 0x0}) ioctl$LOOP_CLR_FD(r3, 0x4c01) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000002640)=ANY=[@ANYRES32], 0x32600) [ 261.389153] binder_alloc: 15385: binder_alloc_buf, no vma [ 261.416996] binder_alloc: 15391: binder_alloc_buf, no vma 07:10:47 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) dup3(r0, r1, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) dup2(r3, r2) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$smc(&(0x7f0000000140)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x40, r5, 0x501, 0x0, 0x0, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth1_to_bridge\x00'}]}, 0x40}}, 0x0) 07:10:47 executing program 4: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:47 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 261.504721] binder_alloc: 15395: binder_alloc_buf, no vma [ 261.537828] binder_alloc: 15398: binder_alloc_buf, no vma 07:10:47 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) dup3(r0, r1, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$smc(&(0x7f0000000140)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x40, r5, 0x501, 0x0, 0x0, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth1_to_bridge\x00'}]}, 0x40}}, 0x0) [ 261.673139] binder: 15401:15405 unknown command 1090806533 [ 261.683692] binder_alloc: 15412: binder_alloc_buf, no vma [ 261.695206] binder_alloc: 15411: binder_alloc_buf, no vma [ 261.710302] binder: 15401:15405 ioctl c0306201 20000200 returned -22 07:10:47 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:48 executing program 4: perf_event_open(&(0x7f0000000100)={0x0, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 261.727373] binder: 15401:15420 unknown command 1076554245 [ 261.757699] binder: 15401:15420 ioctl c0306201 20000280 returned -22 [ 261.773119] binder: 15401:15405 ioctl 4c01 0 returned -22 [ 261.817825] binder_alloc: 15422: binder_alloc_buf, no vma [ 261.830588] binder_alloc: 15424: binder_alloc_buf, no vma 07:10:48 executing program 4: perf_event_open(&(0x7f0000000100)={0x0, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:48 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) dup3(r0, r1, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$smc(&(0x7f0000000140)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x40, r4, 0x501, 0x0, 0x0, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth1_to_bridge\x00'}]}, 0x40}}, 0x0) 07:10:48 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:48 executing program 3: r0 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x4, 0x20000000007ffd, 0x7c, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100]}, 0x2c) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r0, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096}, 0x20) socketpair(0x10, 0x1, 0x2000000, &(0x7f0000000080)) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000002640)=ANY=[@ANYRES32], 0x32600) 07:10:48 executing program 4: perf_event_open(&(0x7f0000000100)={0x0, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 261.973823] binder_alloc: 15438: binder_alloc_buf, no vma [ 261.974682] binder_alloc: 15440: binder_alloc_buf, no vma 07:10:48 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:48 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) dup3(r0, r1, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$smc(&(0x7f0000000140)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x40, r4, 0x501, 0x0, 0x0, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth1_to_bridge\x00'}]}, 0x40}}, 0x0) 07:10:48 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) r3 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r5 = dup2(r4, r3) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r6 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x1b, 0x1, 0x7ffa, 0x7, 0x753, r5, 0x5, [0x0, 0x0, 0x0, 0x400100], 0x0, 0xffffffffffffffff, 0x8, 0x2}, 0x40) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r6, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096}, 0x20) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000002640)=ANY=[@ANYRES32], 0x32600) r7 = openat$null(0xffffffffffffff9c, &(0x7f0000000080)='/dev/null\x00', 0x20401, 0x0) sendmsg$IPSET_CMD_ADD(r7, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="700000000906000000000000000000000a0000005c000880100007800c00028008000140ac1e0101100007800900120073797a30000000000c00078008000b40000000050c000780060005404e200000100007800c00018008e00040ac14141e100007800900120073797a3100000000"], 0x70}}, 0x1) 07:10:48 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:48 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 262.114452] binder_alloc: 15453: binder_alloc_buf, no vma 07:10:48 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) dup3(r0, r1, 0x0) syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$smc(&(0x7f0000000140)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x40, r3, 0x501, 0x0, 0x0, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth1_to_bridge\x00'}]}, 0x40}}, 0x0) 07:10:48 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 262.225815] binder_alloc: 15464: binder_alloc_buf, no vma [ 262.255887] binder_alloc: 15465: binder_alloc_buf, no vma [ 262.267044] binder: BINDER_SET_CONTEXT_MGR already set 07:10:48 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 262.284640] binder: 15464:15467 ioctl 40046207 0 returned -16 [ 262.316692] binder: BINDER_SET_CONTEXT_MGR already set 07:10:48 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:48 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) dup3(r0, r1, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$smc(&(0x7f0000000140)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x40, r3, 0x501, 0x0, 0x0, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth1_to_bridge\x00'}]}, 0x40}}, 0x0) [ 262.345721] binder: 15464:15467 ioctl 40046207 0 returned -16 [ 262.387191] binder: BINDER_SET_CONTEXT_MGR already set [ 262.398246] binder_alloc: 15478: binder_alloc_buf, no vma [ 262.421772] binder: BINDER_SET_CONTEXT_MGR already set [ 262.427265] binder: BINDER_SET_CONTEXT_MGR already set 07:10:48 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:48 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 262.427282] binder: 15464:15480 ioctl 40046207 0 returned -16 [ 262.439493] binder: 15464:15467 ioctl 40046207 0 returned -16 [ 262.441404] binder: 15464:15486 ioctl 40046207 0 returned -16 07:10:48 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$smc(&(0x7f0000000140)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x40, r3, 0x501, 0x0, 0x0, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth1_to_bridge\x00'}]}, 0x40}}, 0x0) 07:10:48 executing program 3: bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x4, 0x20000000007ffd, 0x7c, 0x60, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100]}, 0x40) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r2, &(0x7f0000000080)="d3b97d0491ad803eef7e17c7659ec9bd7d5a1ffd30e93f2531eaab072dc2d0397d4a56c50be2166ae8b2e29b58481fae62c41685c602e5205b5725839a8deaf1b14a5cbd05d675d991bacebb22c68b5c78b6afc05e7b81009245d263c90000000000", &(0x7f00000005c0)=""/4096}, 0x20) r3 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r5 = dup2(r4, r3) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f00000002c0)={@fd, @ptr={0x70742a85, 0x1, &(0x7f0000000180)=""/64, 0x40, 0x0, 0x21}, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x40}}}], 0x0, 0x73b000, 0x0}) ioctl$NBD_CLEAR_QUE(r5, 0xab05) write$cgroup_subtree(r5, &(0x7f0000000140)=ANY=[@ANYRES16=r3], 0x32600) 07:10:48 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:48 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 262.555817] binder_alloc: 15495: binder_alloc_buf, no vma 07:10:48 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 262.651571] binder_alloc: 15503: binder_alloc_buf, no vma [ 262.686058] binder_alloc: 15506: binder_alloc_buf, no vma [ 262.687633] binder: BINDER_SET_CONTEXT_MGR already set 07:10:49 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:49 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$smc(&(0x7f0000000140)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x40, r2, 0x501, 0x0, 0x0, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth1_to_bridge\x00'}]}, 0x40}}, 0x0) 07:10:49 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 262.718223] binder: 15503:15509 ioctl 40046207 0 returned -16 [ 262.742353] binder_alloc: 15503: binder_alloc_buf, no vma [ 262.785104] binder: BINDER_SET_CONTEXT_MGR already set [ 262.791189] binder: 15503:15509 ioctl 40046207 0 returned -16 [ 262.812855] binder: BINDER_SET_CONTEXT_MGR already set [ 262.818183] binder: 15503:15518 ioctl 40046207 0 returned -16 [ 262.829190] binder: 15503:15524 ioctl ab05 0 returned -22 07:10:49 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$smc(&(0x7f0000000140)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x40, r1, 0x501, 0x0, 0x0, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth1_to_bridge\x00'}]}, 0x40}}, 0x0) 07:10:49 executing program 3: r0 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x4, 0x20000000007ffd, 0x7c, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100]}, 0x2c) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r0, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096}, 0x20) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYRES64=r0], 0x32600) 07:10:49 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 262.838975] binder_alloc: 15519: binder_alloc_buf, no vma 07:10:49 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:49 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$smc(&(0x7f0000000140)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x40, r1, 0x501, 0x0, 0x0, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth1_to_bridge\x00'}]}, 0x40}}, 0x0) 07:10:49 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 262.974841] binder_alloc: 15535: binder_alloc_buf, no vma 07:10:49 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:49 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:49 executing program 3: r0 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x4, 0x20000000007ffd, 0x7c, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100]}, 0x2c) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r0, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096}, 0x20) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = dup2(r2, r1) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$KVM_SET_IDENTITY_MAP_ADDR(r3, 0x4008ae48, &(0x7f0000000080)=0x1) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000002640)=ANY=[@ANYRES32], 0x32600) 07:10:49 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$smc(&(0x7f0000000140)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x40, r1, 0x501, 0x0, 0x0, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth1_to_bridge\x00'}]}, 0x40}}, 0x0) [ 263.098274] binder: 15545:15547 ioctl c0306201 0 returned -14 07:10:49 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:49 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:49 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$smc(&(0x7f0000000140)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x40, r1, 0x501, 0x0, 0x0, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth1_to_bridge\x00'}]}, 0x40}}, 0x0) [ 263.232094] binder_alloc: 15552: binder_alloc_buf, no vma [ 263.258729] binder: 15558:15561 ioctl c0306201 0 returned -14 [ 263.265459] binder: 15552:15555 ioctl 4008ae48 20000080 returned -22 07:10:49 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:49 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$smc(&(0x7f0000000140)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x40, r1, 0x501, 0x0, 0x0, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth1_to_bridge\x00'}]}, 0x40}}, 0x0) 07:10:49 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 263.329136] binder_alloc: 15552: binder_alloc_buf, no vma [ 263.338250] binder: 15552:15567 ioctl 4008ae48 20000080 returned -22 07:10:49 executing program 3: r0 = syz_open_dev$mouse(&(0x7f0000000080)='/dev/input/mouse#\x00', 0x5, 0x284102) sendmsg$IPSET_CMD_RENAME(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x34, 0x5, 0x6, 0x801, 0x0, 0x0, {0x3, 0x0, 0x9}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_SETNAME2={0x9, 0x3, 'syz0\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000000}, 0x4) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = dup2(r2, r1) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)=ANY=[@ANYBLOB="852a74700000000000000000000000000002000000000000852a687300000000000000000000000000000000000000000000000000faca57d19d20cc69000000"], &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) r4 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x0, 0x20000000007ffd, 0x7c, 0x50a, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100]}, 0x40) ioctl$sock_rose_SIOCADDRT(r0, 0x890b, &(0x7f00000001c0)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0x1}, 0x2, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={'nr', 0x0}, 0x6, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @bcast, @default, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default]}) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r4, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096}, 0x20) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000002640)=ANY=[@ANYRES32], 0x32600) 07:10:49 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:49 executing program 0: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$smc(&(0x7f0000000140)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x40, r1, 0x501, 0x0, 0x0, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth1_to_bridge\x00'}]}, 0x40}}, 0x0) [ 263.414490] binder: 15568:15569 ioctl c0306201 0 returned -14 07:10:49 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 263.484542] binder_alloc: 15576: binder_alloc_buf, no vma 07:10:49 executing program 3: r0 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000080)={0xb, 0x4, 0x7fffffff, 0x7c, 0x100, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100]}, 0x40) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r0, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096}, 0x20) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000002640)=ANY=[@ANYRES32], 0x32600) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = dup2(r2, r1) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) connect$l2tp6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote, 0x3, 0x1}, 0x20) 07:10:49 executing program 0: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$smc(&(0x7f0000000140)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x40, r1, 0x501, 0x0, 0x0, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth1_to_bridge\x00'}]}, 0x40}}, 0x0) 07:10:49 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 263.525167] binder: 15578:15581 ioctl c0306201 20000200 returned -14 [ 263.535628] binder_alloc: 15576: binder_alloc_buf, no vma 07:10:49 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 263.624032] binder_alloc: 15588: binder_alloc_buf, no vma [ 263.643641] binder: 15591:15593 ioctl c0306201 20000200 returned -14 [ 263.652414] binder_alloc: 15588: binder_alloc_buf, no vma 07:10:49 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) r4 = socket(0x10, 0x803, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route_sched(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001880)=ANY=[@ANYBLOB="0000000000000000000000000000000010200000", @ANYRES32=r5, @ANYBLOB="0000000000000000040000000a00010072737670360000001800020014000200200100"/48], 0x48}}, 0x0) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f00000003c0)='TIPCv2\x00') sendmsg$TIPC_NL_UDP_GET_REMOTEIP(r4, &(0x7f0000000600)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000440)={0x158, r6, 0x200, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_MEDIA={0x10, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}]}]}, @TIPC_NLA_BEARER={0x80, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x9}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5efc3560}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7f}, @TIPC_NLA_PROP_MTU={0x8}]}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x2}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e22, 0x7f, @mcast2, 0x3ff}}, {0x14, 0x2, @in={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}}}}]}, @TIPC_NLA_BEARER={0xb4, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_NAME={0x15, 0x1, @l2={'eth', 0x3a, 'veth1_to_hsr\x00'}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffff0001}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}]}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e20, @loopback}}, {0x14, 0x2, @in={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x2e}}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x20}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x80000000}]}]}, 0x158}, 0x1, 0x0, 0x0, 0x4}, 0x80) sendmsg$TIPC_NL_SOCK_GET(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000480)={&(0x7f0000000300)={0x17c, r6, 0x1, 0x70bd27, 0x25dfdbfe, {}, [@TIPC_NLA_SOCK={0x30, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x200}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x3}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x2}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x7}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x5}]}, @TIPC_NLA_PUBL={0x44, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x4}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x7fff}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x6}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x2}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0xfffffffa}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x80000001}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x6}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x5}]}, @TIPC_NLA_SOCK={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x3}, @TIPC_NLA_SOCK_CON={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0xfffff75a}]}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x10000}]}, @TIPC_NLA_MON={0x14, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x1000}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x5}]}, @TIPC_NLA_MEDIA={0x50, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}]}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7ff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xb}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}]}]}, @TIPC_NLA_LINK={0x6c, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x54, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x10000}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8c}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x200}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffe00}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}]}]}]}, 0x17c}, 0x1, 0x0, 0x0, 0x8880}, 0x4004015) ioctl$VIDIOC_G_EXT_CTRLS(r2, 0xc0205647, &(0x7f00000001c0)={0x9b0000, 0x80000000, 0x3, r3, 0x0, &(0x7f0000000180)={0x980905, 0xffff, [], @p_u8=&(0x7f0000000140)=0x91}}) r8 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0xe, 0x4, 0x7fff, 0x7c, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100], 0x0, r7, 0x0, 0xfffffffc, 0x1}, 0xfffffffffffffd3a) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r8, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096}, 0x20) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000002640)=ANY=[@ANYRES32], 0x32600) 07:10:50 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:50 executing program 0: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$smc(&(0x7f0000000140)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x40, r1, 0x501, 0x0, 0x0, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth1_to_bridge\x00'}]}, 0x40}}, 0x0) 07:10:50 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 263.761883] binder_alloc: 15598: binder_alloc_buf, no vma [ 263.782214] binder: 15598:15600 ioctl c0205647 200001c0 returned -22 07:10:50 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 263.810775] binder: BINDER_SET_CONTEXT_MGR already set [ 263.824901] binder: 15598:15600 ioctl 40046207 0 returned -16 [ 263.836526] binder: 15598:15609 ioctl c0205647 200001c0 returned -22 07:10:50 executing program 0: perf_event_open(&(0x7f0000000100)={0x0, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$smc(&(0x7f0000000140)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x40, r1, 0x501, 0x0, 0x0, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth1_to_bridge\x00'}]}, 0x40}}, 0x0) 07:10:50 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 263.878562] binder: 15604:15610 ioctl c0306201 20000200 returned -14 07:10:50 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:50 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:50 executing program 0: perf_event_open(&(0x7f0000000100)={0x0, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$smc(&(0x7f0000000140)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x40, r1, 0x501, 0x0, 0x0, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth1_to_bridge\x00'}]}, 0x40}}, 0x0) 07:10:50 executing program 0: perf_event_open(&(0x7f0000000100)={0x0, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$smc(&(0x7f0000000140)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x40, r1, 0x501, 0x0, 0x0, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth1_to_bridge\x00'}]}, 0x40}}, 0x0) [ 264.081316] binder: 15621:15625 unknown command 0 [ 264.104349] binder: 15621:15625 ioctl c0306201 20000200 returned -22 [ 264.118216] binder: 15623:15627 ioctl c0306201 0 returned -14 07:10:50 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$smc(&(0x7f0000000140)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x40, r1, 0x501, 0x0, 0x0, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth1_to_bridge\x00'}]}, 0x40}}, 0x0) 07:10:50 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:50 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:50 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$smc(&(0x7f0000000140)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x40, r1, 0x501, 0x0, 0x0, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth1_to_bridge\x00'}]}, 0x40}}, 0x0) [ 264.234830] binder: 15633:15635 unknown command 0 07:10:50 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:50 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 264.255537] binder: 15636:15637 ioctl c0306201 0 returned -14 [ 264.255930] binder: 15633:15635 ioctl c0306201 20000200 returned -22 07:10:50 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$smc(&(0x7f0000000140)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x40, r1, 0x501, 0x0, 0x0, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth1_to_bridge\x00'}]}, 0x40}}, 0x0) 07:10:50 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 264.356872] binder: 15641:15643 ioctl c0306201 0 returned -14 [ 264.367648] binder: 15642:15644 unknown command 0 [ 264.378469] binder: 15642:15644 ioctl c0306201 20000200 returned -22 07:10:50 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:50 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$smc(&(0x7f0000000140)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x40, r1, 0x501, 0x0, 0x0, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth1_to_bridge\x00'}]}, 0x40}}, 0x0) 07:10:50 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:50 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$smc(0x0) sendmsg$SMC_PNETID_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x40, r1, 0x501, 0x0, 0x0, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth1_to_bridge\x00'}]}, 0x40}}, 0x0) [ 264.479308] binder: 15649:15650 ioctl c0306201 20000200 returned -14 [ 264.535098] binder: 15651:15653 unknown command 0 [ 264.539992] binder: 15651:15653 ioctl c0306201 20000200 returned -22 07:10:50 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 264.577487] binder: 15655:15659 ioctl c0306201 20000200 returned -14 07:10:50 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:50 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$smc(0x0) sendmsg$SMC_PNETID_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x40, r1, 0x501, 0x0, 0x0, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth1_to_bridge\x00'}]}, 0x40}}, 0x0) [ 264.671713] binder: 15662:15663 unknown command 0 [ 264.676604] binder: 15662:15663 ioctl c0306201 20000200 returned -22 07:10:51 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:51 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 264.723093] binder: 15665:15668 ioctl c0306201 20000200 returned -14 07:10:51 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$smc(0x0) sendmsg$SMC_PNETID_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x40, r1, 0x501, 0x0, 0x0, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth1_to_bridge\x00'}]}, 0x40}}, 0x0) [ 264.799850] binder: 15671:15672 unknown command 0 [ 264.818639] binder: 15671:15672 ioctl c0306201 20000200 returned -22 [ 264.838702] binder: 15673:15677 unknown command 0 07:10:51 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="0563"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 264.855714] binder: 15673:15677 ioctl c0306201 20000200 returned -22 07:10:51 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:51 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_genetlink_get_family_id$smc(&(0x7f0000000140)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x40, r0, 0x501, 0x0, 0x0, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth1_to_bridge\x00'}]}, 0x40}}, 0x0) 07:10:51 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="0563"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 264.929141] binder: 15680:15681 unknown command 25349 [ 264.944107] binder: 15680:15681 ioctl c0306201 20000200 returned -22 07:10:51 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 265.003081] binder: 15684:15685 unknown command 0 [ 265.018318] binder: 15684:15685 ioctl c0306201 20000200 returned -22 [ 265.044223] binder: 15687:15689 unknown command 25349 07:10:51 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_genetlink_get_family_id$smc(&(0x7f0000000140)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x40, r0, 0x501, 0x0, 0x0, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth1_to_bridge\x00'}]}, 0x40}}, 0x0) 07:10:51 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="0563"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 265.091864] binder: 15690:15691 unknown command 0 [ 265.092658] binder: 15687:15689 ioctl c0306201 20000200 returned -22 [ 265.106533] binder: 15690:15691 ioctl c0306201 20000200 returned -22 07:10:51 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:51 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_genetlink_get_family_id$smc(&(0x7f0000000140)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x40, r0, 0x501, 0x0, 0x0, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth1_to_bridge\x00'}]}, 0x40}}, 0x0) [ 265.225660] binder: 15697:15698 unknown command 25349 [ 265.231209] binder: 15697:15698 ioctl c0306201 20000200 returned -22 07:10:51 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="056304"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:51 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:51 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$smc(&(0x7f0000000140)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(r0, 0x0, 0x0) [ 265.270834] binder: 15699:15700 unknown command 0 [ 265.279153] binder: 15699:15700 ioctl c0306201 20000200 returned -22 07:10:51 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$smc(&(0x7f0000000140)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(r0, 0x0, 0x0) [ 265.357904] binder: 15703:15706 unknown command 287493 [ 265.371181] binder: 15704:15708 unknown command 0 [ 265.377226] binder: 15703:15706 ioctl c0306201 20000200 returned -22 [ 265.391846] binder: 15704:15708 ioctl c0306201 20000200 returned -22 07:10:51 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="056304"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:51 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:51 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$smc(&(0x7f0000000140)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(r0, 0x0, 0x0) 07:10:51 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$smc(&(0x7f0000000140)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) 07:10:51 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="0563"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 265.513421] binder: 15715:15719 unknown command 0 [ 265.513960] binder: 15714:15718 unknown command 287493 [ 265.534820] binder: 15715:15719 ioctl c0306201 20000200 returned -22 [ 265.545419] binder: 15714:15718 ioctl c0306201 20000200 returned -22 07:10:51 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="056304"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:51 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$smc(&(0x7f0000000140)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) [ 265.651605] binder: 15727:15730 unknown command 287493 [ 265.663141] binder: 15727:15730 ioctl c0306201 20000200 returned -22 [ 265.665261] binder: 15724:15729 unknown command 25349 07:10:51 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(0xffffffffffffffff, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:52 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="0563"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:52 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$smc(&(0x7f0000000140)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) [ 265.696533] binder: 15724:15729 ioctl c0306201 20000200 returned -22 07:10:52 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(0xffffffffffffffff, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:52 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="0563"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 265.809228] binder: 15737:15739 unknown command 25349 [ 265.819137] binder: 15737:15739 ioctl c0306201 20000200 returned -22 07:10:52 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$smc(&(0x7f0000000140)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0}}, 0x0) 07:10:52 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(0xffffffffffffffff, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 265.907729] binder: 15744:15746 unknown command 25349 07:10:52 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="056304"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 265.928591] binder: 15744:15746 ioctl c0306201 20000200 returned -22 07:10:52 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$smc(&(0x7f0000000140)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0}}, 0x0) 07:10:52 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:52 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="056304"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 266.040507] binder: 15751:15754 unknown command 287493 [ 266.045945] binder: 15751:15754 ioctl c0306201 20000200 returned -22 07:10:52 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:52 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$smc(&(0x7f0000000140)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0}}, 0x0) 07:10:52 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="056304"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:52 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$smc(&(0x7f0000000140)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x40, 0x0, 0x501, 0x0, 0x0, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth1_to_bridge\x00'}]}, 0x40}}, 0x0) [ 266.145376] binder: 15760:15762 unknown command 287493 [ 266.156865] binder: 15760:15762 ioctl c0306201 20000200 returned -22 07:10:52 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:52 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$smc(&(0x7f0000000140)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x40, 0x0, 0x501, 0x0, 0x0, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth1_to_bridge\x00'}]}, 0x40}}, 0x0) [ 266.253194] binder: 15767:15770 unknown command 287493 [ 266.260027] binder: 15767:15770 ioctl c0306201 20000200 returned -22 07:10:52 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(0xffffffffffffffff, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:52 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:52 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$smc(&(0x7f0000000140)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x40, 0x0, 0x501, 0x0, 0x0, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth1_to_bridge\x00'}]}, 0x40}}, 0x0) 07:10:52 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(0xffffffffffffffff, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:52 executing program 3: r0 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x4, 0x20000000007ffd, 0x7c, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100]}, 0x2c) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r0, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096}, 0x20) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000002640)=ANY=[@ANYRES32], 0x32600) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = dup2(r2, r1) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) r5 = mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000700)={0x9c, 0x0, &(0x7f0000000540)=[@transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@fd, @fd, @flat=@weak_binder={0x77622a85, 0xb, 0x3}}, &(0x7f00000003c0)={0x0, 0x18, 0x30}}, 0x400}, @free_buffer={0x40086303, r5}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000440)={@fd, @ptr={0x70742a85, 0x1, &(0x7f0000000400)=""/11, 0xb, 0x0, 0x38}, @flat=@handle={0x73682a85, 0x0, 0x1}}, &(0x7f0000000500)={0x0, 0x18, 0x40}}}], 0xeb, 0x0, &(0x7f0000000600)="2e84181cc27f46b53b7d1d3d140b78e70a8ad503471a05938b7913f53b390f63faaa12b0f4ab398c84ff279780f9f849f38c70ae9ec30671258ed50ec4da81b7e13f35127cf0abd9f52a7d1323c1844b764a318c1a588c361cd2c87383bc5e374d885f62631d3ca01d014180058579cea58dcdbd340c8f0861ae3a7313399a1a3e713dd2e4515e7e077374800dfc03e87dfe49538a23ba9bbbe296bcfbc7a658000a4e8f60a93271783ffd1155e3f382b2a15457a9daf24d02dd17022999381f5cea64668ddcca7fd254e0aad962f43dfc3d3027754656f4788480ba2115510687f4c86c10b2540d4d2a84"}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000240)={0xc, 0x0, &(0x7f0000000100)=[@free_buffer={0x40086303, r5}], 0x0, 0x73b000, 0x0}) sendto$l2tp6(r3, &(0x7f0000000080)="246ba5bb2b9dcc6c86", 0x9, 0x20000001, &(0x7f00000000c0)={0xa, 0x0, 0x2, @remote, 0x31e6, 0x3}, 0x20) 07:10:52 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:52 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(0xffffffffffffffff, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:52 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$smc(&(0x7f0000000140)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x40, r1, 0x0, 0x0, 0x0, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth1_to_bridge\x00'}]}, 0x40}}, 0x0) 07:10:52 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:52 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:52 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:52 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$smc(&(0x7f0000000140)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x40, r1, 0x0, 0x0, 0x0, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth1_to_bridge\x00'}]}, 0x40}}, 0x0) [ 266.617015] binder: BINDER_SET_CONTEXT_MGR already set 07:10:52 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 266.645073] binder: 15787:15801 ioctl 40046207 0 returned -16 07:10:52 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$smc(&(0x7f0000000140)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x40, r1, 0x0, 0x0, 0x0, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth1_to_bridge\x00'}]}, 0x40}}, 0x0) 07:10:52 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:53 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:53 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$smc(&(0x7f0000000140)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x2c, r1, 0x501, 0x0, 0x0, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz2\x00'}]}, 0x2c}}, 0x0) 07:10:53 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:53 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:53 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$smc(&(0x7f0000000140)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x2c, r1, 0x501, 0x0, 0x0, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz2\x00'}]}, 0x2c}}, 0x0) 07:10:53 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:53 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$smc(&(0x7f0000000140)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x2c, r1, 0x501, 0x0, 0x0, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz2\x00'}]}, 0x2c}}, 0x0) 07:10:53 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 266.959523] binder: 15826:15829 ioctl c0306201 0 returned -14 07:10:53 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$smc(&(0x7f0000000140)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x34, r1, 0x501, 0x0, 0x0, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth1_to_bridge\x00'}]}, 0x34}}, 0x0) 07:10:53 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:53 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:53 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$smc(&(0x7f0000000140)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x34, r1, 0x501, 0x0, 0x0, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth1_to_bridge\x00'}]}, 0x34}}, 0x0) [ 267.085981] binder: 15835:15837 ioctl c0306201 0 returned -14 07:10:53 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$smc(&(0x7f0000000140)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x34, r1, 0x501, 0x0, 0x0, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth1_to_bridge\x00'}]}, 0x34}}, 0x0) 07:10:53 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 267.193880] binder: 15842:15846 ioctl c0306201 0 returned -14 07:10:53 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:53 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$smc(&(0x7f0000000140)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x34, r1, 0x501, 0x0, 0x0, {}, [@SMC_PNETID_IBNAME={0x9, 0x3, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth1_to_bridge\x00'}]}, 0x34}}, 0x0) 07:10:53 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:53 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:53 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$smc(&(0x7f0000000140)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x34, r1, 0x501, 0x0, 0x0, {}, [@SMC_PNETID_IBNAME={0x9, 0x3, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth1_to_bridge\x00'}]}, 0x34}}, 0x0) [ 267.404073] binder: 15853:15855 ioctl c0306201 20000280 returned -14 07:10:53 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:53 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:53 executing program 0: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$smc(&(0x7f0000000140)='SMC_PNETID\x00') sendmsg$SMC_PNETID_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x34, r1, 0x501, 0x0, 0x0, {}, [@SMC_PNETID_IBNAME={0x9, 0x3, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth1_to_bridge\x00'}]}, 0x34}}, 0x0) 07:10:53 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:53 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 267.573597] binder: 15866:15869 ioctl c0306201 20000280 returned -14 07:10:53 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 267.648333] binder: 15872:15875 ioctl c0306201 0 returned -14 07:10:54 executing program 0: perf_event_open(&(0x7f0000000000)={0x1000000002, 0x70, 0x800000000000013, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$EVIOCSCLOCKID(r0, 0x400445a0, &(0x7f00000000c0)=0x7) ioctl$EVIOCSFF(0xffffffffffffffff, 0x402c4580, 0x0) 07:10:54 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 267.714808] binder: 15876:15878 ioctl c0306201 20000280 returned -14 [ 267.750344] binder: 15879:15880 ioctl c0306201 0 returned -14 07:10:54 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:54 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 267.849089] binder: 15885:15886 unknown command 0 [ 267.864579] binder: 15885:15886 ioctl c0306201 20000280 returned -22 [ 267.864721] binder: 15887:15888 ioctl c0306201 0 returned -14 07:10:54 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:54 executing program 0: perf_event_open(&(0x7f0000000000)={0x1000000002, 0x70, 0x800000000000013, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$EVIOCSCLOCKID(r0, 0x400445a0, &(0x7f00000000c0)=0x7) ioctl$EVIOCSFF(0xffffffffffffffff, 0x402c4580, 0x0) 07:10:54 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 267.967406] binder: 15891:15892 ioctl c0306201 20000280 returned -14 07:10:54 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 268.022420] binder: 15894:15895 unknown command 0 [ 268.037158] binder: 15894:15895 ioctl c0306201 20000280 returned -22 07:10:54 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 268.123699] binder: 15896:15900 ioctl c0306201 20000280 returned -14 [ 268.143413] binder: 15902:15903 unknown command 0 07:10:54 executing program 0: perf_event_open(&(0x7f0000000000)={0x1000000002, 0x70, 0x800000000000013, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$EVIOCSCLOCKID(r0, 0x400445a0, &(0x7f00000000c0)=0x7) ioctl$EVIOCSFF(0xffffffffffffffff, 0x402c4580, 0x0) [ 268.178845] binder: 15902:15903 ioctl c0306201 20000280 returned -22 07:10:54 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 268.253076] binder: 15905:15909 ioctl c0306201 20000280 returned -14 07:10:54 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:54 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:54 executing program 0: perf_event_open(&(0x7f0000000000)={0x1000000002, 0x70, 0x800000000000013, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$EVIOCSCLOCKID(r0, 0x400445a0, &(0x7f00000000c0)=0x7) ioctl$EVIOCSFF(0xffffffffffffffff, 0x402c4580, 0x0) [ 268.316392] binder: 15911:15912 unknown command 0 [ 268.321355] binder: 15911:15912 ioctl c0306201 20000280 returned -22 07:10:54 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 268.397004] binder: 15914:15917 unknown command 0 [ 268.398216] binder: 15916:15918 unknown command 0 [ 268.409433] binder: 15916:15918 ioctl c0306201 20000280 returned -22 [ 268.413929] binder: 15914:15917 ioctl c0306201 20000280 returned -22 07:10:54 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:54 executing program 0: perf_event_open(&(0x7f0000000000)={0x1000000002, 0x70, 0x800000000000013, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$EVIOCSCLOCKID(r0, 0x400445a0, &(0x7f00000000c0)=0x7) [ 268.531871] binder: 15922:15924 unknown command 0 [ 268.543753] binder: 15922:15924 ioctl c0306201 20000280 returned -22 07:10:54 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 268.586136] binder: 15925:15926 unknown command 0 07:10:54 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0563"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 268.619984] binder: 15925:15926 ioctl c0306201 20000280 returned -22 07:10:54 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 268.669190] binder: 15928:15932 unknown command 0 [ 268.677923] binder: 15928:15932 ioctl c0306201 20000280 returned -22 07:10:55 executing program 0: perf_event_open(&(0x7f0000000000)={0x1000000002, 0x70, 0x800000000000013, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) ioctl$EVIOCSCLOCKID(r0, 0x400445a0, &(0x7f00000000c0)=0x7) [ 268.749661] binder: 15933:15934 unknown command 25349 [ 268.765489] binder: 15933:15934 ioctl c0306201 20000280 returned -22 [ 268.792981] binder: 15935:15937 unknown command 0 [ 268.808751] binder: 15935:15937 ioctl c0306201 20000280 returned -22 07:10:55 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0563"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:55 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:55 executing program 0: perf_event_open(&(0x7f0000000000)={0x1000000002, 0x70, 0x800000000000013, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$EVIOCSCLOCKID(0xffffffffffffffff, 0x400445a0, &(0x7f00000000c0)=0x7) 07:10:55 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:55 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0563"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 268.928847] binder: 15943:15945 unknown command 25349 [ 268.932618] binder: 15944:15946 unknown command 0 [ 268.942660] binder: 15944:15946 ioctl c0306201 20000280 returned -22 [ 268.947184] binder: 15943:15945 ioctl c0306201 20000280 returned -22 07:10:55 executing program 0: perf_event_open(&(0x7f0000000000)={0x1000000002, 0x70, 0x800000000000013, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$EVIOCSCLOCKID(0xffffffffffffffff, 0x400445a0, &(0x7f00000000c0)=0x7) 07:10:55 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="056304"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 269.074199] binder: 15952:15954 unknown command 25349 [ 269.082946] binder: 15948:15951 unknown command 0 [ 269.086551] binder: 15952:15954 ioctl c0306201 20000280 returned -22 [ 269.096549] binder: 15948:15951 ioctl c0306201 20000280 returned -22 07:10:55 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0563"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 269.153163] binder: 15956:15958 unknown command 287493 [ 269.166302] binder: 15956:15958 ioctl c0306201 20000280 returned -22 07:10:55 executing program 0: perf_event_open(&(0x7f0000000000)={0x1000000002, 0x70, 0x800000000000013, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$EVIOCSCLOCKID(0xffffffffffffffff, 0x400445a0, &(0x7f00000000c0)=0x7) 07:10:55 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="056304"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:55 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0563"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 269.260185] binder: 15961:15963 unknown command 25349 [ 269.265520] binder: 15961:15963 ioctl c0306201 20000280 returned -22 07:10:55 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2) ioctl$EVIOCSCLOCKID(r0, 0x400445a0, &(0x7f00000000c0)=0x7) 07:10:55 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="056304"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 269.341805] binder: 15966:15967 unknown command 287493 [ 269.352100] binder: 15966:15967 ioctl c0306201 20000280 returned -22 [ 269.374508] binder: 15968:15970 unknown command 25349 [ 269.383384] binder: 15968:15970 ioctl c0306201 20000280 returned -22 07:10:55 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0563"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 269.435848] binder: 15973:15975 unknown command 287493 07:10:55 executing program 0: r0 = syz_open_dev$evdev(0x0, 0x0, 0x2) ioctl$EVIOCSCLOCKID(r0, 0x400445a0, &(0x7f00000000c0)=0x7) 07:10:55 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="056304"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:55 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 269.475866] binder: 15973:15975 ioctl c0306201 20000280 returned -22 [ 269.485763] binder: 15976:15977 unknown command 25349 [ 269.496810] binder: 15976:15977 ioctl c0306201 20000280 returned -22 07:10:55 executing program 0: r0 = syz_open_dev$evdev(0x0, 0x0, 0x2) ioctl$EVIOCSCLOCKID(r0, 0x400445a0, &(0x7f00000000c0)=0x7) 07:10:55 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 269.603191] binder: 15982:15986 unknown command 287493 [ 269.613355] binder: 15982:15986 ioctl c0306201 20000280 returned -22 07:10:55 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="056304"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:55 executing program 0: r0 = syz_open_dev$evdev(0x0, 0x0, 0x2) ioctl$EVIOCSCLOCKID(r0, 0x400445a0, &(0x7f00000000c0)=0x7) 07:10:55 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:56 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCSCLOCKID(r0, 0x400445a0, &(0x7f00000000c0)=0x7) 07:10:56 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) [ 269.762492] binder: 15994:15995 unknown command 287493 [ 269.780319] binder: 15994:15995 ioctl c0306201 20000280 returned -22 07:10:56 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="056304"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:56 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:56 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) [ 269.867908] binder: 16001:16002 ioctl c0306201 0 returned -14 [ 269.882466] binder: 16005:16007 unknown command 287493 [ 269.894949] binder: 16005:16007 ioctl c0306201 20000280 returned -22 07:10:56 executing program 0: syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCSCLOCKID(0xffffffffffffffff, 0x400445a0, &(0x7f00000000c0)=0x7) 07:10:56 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:56 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) [ 270.003333] binder: 16010:16013 ioctl c0306201 0 returned -14 07:10:56 executing program 3: r0 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x4, 0x20000000007ffd, 0x7c, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100]}, 0x2c) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r0, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096}, 0x20) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = dup2(r2, r1) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) r4 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x80}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r5 = dup(r4) r6 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000180)='mptcp_pm\x00') sendmsg$MPTCP_PM_CMD_DEL_ADDR(r5, &(0x7f0000000300)={&(0x7f0000000100), 0xc, &(0x7f00000001c0)={&(0x7f0000000280)={0x58, r6, 0x400, 0x70bd2c, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}, @MPTCP_PM_ATTR_ADDR={0x34, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private0}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @private=0xa010101}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @dev={0xfe, 0x80, [], 0x20}}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x20000044}, 0x1) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r3, &(0x7f0000000180)={&(0x7f0000000080), 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x50, r6, 0x400, 0x70bd2b, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x2c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x6}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e20}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x80}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}]}, 0x50}, 0x1, 0x0, 0x0, 0x40001}, 0x84) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000002640)=ANY=[@ANYRES32], 0x32600) 07:10:56 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:56 executing program 0: syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCSCLOCKID(0xffffffffffffffff, 0x400445a0, &(0x7f00000000c0)=0x7) 07:10:56 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) [ 270.144686] binder: 16020:16021 ioctl c0306201 0 returned -14 07:10:56 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) [ 270.188330] binder: BINDER_SET_CONTEXT_MGR already set 07:10:56 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) [ 270.219261] binder: 16022:16025 ioctl 40046207 0 returned -16 07:10:56 executing program 0: syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCSCLOCKID(0xffffffffffffffff, 0x400445a0, &(0x7f00000000c0)=0x7) 07:10:56 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) [ 270.272603] binder: 16030:16035 ioctl c0306201 0 returned -14 [ 270.309396] binder: BINDER_SET_CONTEXT_MGR already set [ 270.319094] binder: 16022:16032 ioctl 40046207 0 returned -16 07:10:56 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) 07:10:56 executing program 3: r0 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x4, 0x20000000007ffd, 0x7c, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100]}, 0x2c) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r0, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096}, 0x20) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r4 = dup2(r3, r2) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) openat$ashmem(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ashmem\x00', 0x4800, 0x0) ioctl$SNDRV_SEQ_IOCTL_DELETE_QUEUE(r4, 0x408c5333, &(0x7f00000000c0)={0x2, 0xaec4, 0x1, 'queue1\x00', 0x4}) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYRES64=r1], 0x32600) 07:10:56 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCSCLOCKID(r0, 0x400445a0, 0x0) 07:10:56 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) [ 270.415093] binder: 16041:16043 ioctl c0306201 0 returned -14 07:10:56 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000540), 0x0, 0x73b000, 0x0}) 07:10:56 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) 07:10:56 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000540), 0x0, 0x73b000, 0x0}) 07:10:56 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCSCLOCKID(r0, 0x400445a0, 0x0) [ 270.506647] binder_alloc: 16047: binder_alloc_buf, no vma [ 270.520921] binder: 16051:16053 ioctl c0306201 0 returned -14 [ 270.537791] binder: 16047:16050 ioctl 408c5333 200000c0 returned -22 07:10:56 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) 07:10:56 executing program 3: r0 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x4, 0x20000000007ffd, 0x7c, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100]}, 0x2c) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r0, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096}, 0x20) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000002640)=ANY=[@ANYRES32], 0x32600) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000080)={0x0, 0x3, 0x0, 0x1000, &(0x7f0000fff000/0x1000)=nil}) [ 270.624778] binder_alloc: 16047: binder_alloc_buf, no vma [ 270.631016] binder: 16047:16060 ioctl 408c5333 200000c0 returned -22 07:10:56 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x73b000, 0x0}) 07:10:56 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000540), 0x0, 0x73b000, 0x0}) 07:10:57 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCSCLOCKID(r0, 0x400445a0, 0x0) 07:10:57 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:57 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000540), 0x0, 0x73b000, 0x0}) 07:10:57 executing program 3: r0 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x4, 0x20000000007ffd, 0x7c, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100]}, 0x2c) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r0, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096}, 0x20) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm-control\x00', 0x10002, 0x0) write$cgroup_subtree(r1, &(0x7f0000002640)=ANY=[], 0xfff2) r2 = socket$caif_seqpacket(0x25, 0x5, 0x3) preadv(r2, &(0x7f00000002c0)=[{&(0x7f0000000100)=""/92, 0x5c}, {&(0x7f0000000180)=""/54, 0x36}, {&(0x7f00000001c0)=""/203, 0xcb}], 0x3, 0x8) r3 = syz_init_net_socket$nl_rdma(0xffffffffffffffff, 0x3, 0x14) ioctl$sock_inet_SIOCGIFPFLAGS(r3, 0x8935, &(0x7f00000000c0)={'netpci0\x00', 0x10001}) 07:10:57 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCSCLOCKID(r0, 0x400445a0, &(0x7f00000000c0)) 07:10:57 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:57 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000540), 0x0, 0x73b000, 0x0}) 07:10:57 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:57 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCSCLOCKID(r0, 0x400445a0, &(0x7f00000000c0)) 07:10:57 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000540), 0x0, 0x73b000, 0x0}) 07:10:57 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:57 executing program 3: r0 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x4, 0x20000000007ffd, 0x7c, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100]}, 0x2c) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r0, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096}, 0x20) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000002640)=ANY=[@ANYRES32], 0x32600) semget$private(0x0, 0x4, 0x140) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB='\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) r3 = dup2(r2, r1) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) socketpair(0x1, 0x5, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) fstat(r5, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0}) setuid(r6) ioctl$TUNSETOWNER(0xffffffffffffffff, 0x400454cc, r6) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$vim2m_VIDIOC_G_FMT(r3, 0xc0d05604, &(0x7f00000001c0)={0x3, @win={{0x0, 0x1, 0xfffff133, 0x5}, 0xecd1bddc6e65e25f, 0x5, &(0x7f0000000080)={{0x0, 0xf8a, 0x2, 0x7}}, 0x4, &(0x7f00000000c0)="a7ece826a96b2029c6986877007ea204967639e4fb26fb9b434f5120b97a1df968345dea993a315f437b1f301a1dfc6ca7cd27a09fda18e97b9b0510237f69efa02e5bb5871765998481de3b40f3a0bda81f0466e5d5d5f07d53cd977b0d70f71ea67844e7258da6562df4629e2b9cf3afe502dc6866e26abc0fd8c3d0163de5c94371856545828d888bcef4899f2f0e4b55e17854fc5ce4d555def8c39d4c3a6f4c975c7a6b622f5bf519b50dd4658c6df5736de9a8474bab2f296fb7b6419eb5879c221b48", 0x5}}) 07:10:57 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:57 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 271.239632] binder_alloc: 16108: binder_alloc_buf, no vma [ 271.267595] binder: 16110:16113 unknown command 0 07:10:57 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCSCLOCKID(r0, 0x400445a0, &(0x7f00000000c0)) [ 271.287085] binder: 16110:16113 ioctl c0306201 20000200 returned -22 07:10:57 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 271.333496] binder: BINDER_SET_CONTEXT_MGR bad uid 49663 != 0 [ 271.339424] binder: 16110:16118 ioctl 40046207 0 returned -1 [ 271.369358] binder_alloc: 16119: binder_alloc_buf, no vma [ 271.379486] binder: 16110:16113 ioctl c0d05604 200001c0 returned -22 07:10:57 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:57 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) 07:10:57 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r0, &(0x7f00000000c0)=ANY=[], 0x10132) setsockopt$sock_int(r1, 0x1, 0x10, &(0x7f0000000100)=0xffff, 0x4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000500)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) recvmmsg(r1, &(0x7f0000001140)=[{{0x0, 0x0, 0x0}}], 0x700, 0x2, 0x0) 07:10:57 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x73b000, 0x0}) 07:10:57 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 271.527141] binder_alloc: 16127: binder_alloc_buf, no vma 07:10:57 executing program 2: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x73b000, 0x0}) [ 271.639573] binder_alloc: 16136: binder_alloc_buf, no vma [ 271.657772] binder_alloc: 16139: binder_alloc_buf, no vma 07:10:57 executing program 0: gettid() perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) prctl$PR_TASK_PERF_EVENTS_DISABLE(0x1f) syz_genetlink_get_family_id$team(0x0) bind$inet6(r0, &(0x7f0000000180)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) syz_genetlink_get_family_id$team(0x0) listen(r0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) openat$null(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x24060084, &(0x7f0000000100)={0xa, 0x4e22, 0x0, @empty}, 0x1c) shutdown(r1, 0x1) r2 = accept(r0, 0x0, 0x0) sendmsg$TIPC_CMD_GET_MAX_PORTS(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000000c0)={0x1c}, 0x1c}}, 0x0) recvfrom$inet6(r1, &(0x7f0000000540)=""/220, 0xdc, 0x0, 0x0, 0x0) close(r1) 07:10:57 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 271.768076] binder_alloc: 16143: binder_alloc_buf, no vma [ 271.805537] binder_alloc: 16147: binder_alloc_buf, no vma 07:10:58 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@flat=@binder={0x70742a85}, @flat=@handle, @ptr={0x70742a85, 0x1, &(0x7f00000002c0)=""/220, 0xdc, 0x1, 0x12}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) [ 271.840831] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. 07:10:58 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=@bridge_dellink={0x20, 0x11, 0x1}, 0x20}}, 0x0) 07:10:58 executing program 0: getrandom(0x0, 0x0, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21ae, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) [ 271.926051] binder_alloc: 16160: binder_alloc_buf, no vma 07:10:58 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x73b000, 0x0}) 07:10:58 executing program 2: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000200)='/dev/vhost-net\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000100)={0x0, 0x1, 0x0, &(0x7f0000000380)=""/242, 0x0}) r4 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000f1dff8)={0x0, r4}) r5 = socket(0x0, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={0x0, 0x24}}, 0x0) [ 272.002786] PF_BRIDGE: RTM_SETLINK with unknown ifindex 07:10:58 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000080)}}], 0x0, 0x73b000, 0x0}) [ 272.044218] binder_alloc: 16168: binder_alloc_buf, no vma 07:10:58 executing program 0: r0 = socket$unix(0x1, 0x2, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000600)='cpuacct.usage_user\x00', 0x26e1, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000080)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x20) ioctl$PERF_EVENT_IOC_PERIOD(r2, 0xc0c0583b, &(0x7f0000000000)) 07:10:58 executing program 4: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x73b000, 0x0}) [ 272.160588] binder_alloc: 16177: binder_alloc_buf, no vma [ 272.249466] binder_alloc: 16183: binder_alloc_buf, no vma 07:10:58 executing program 0: r0 = socket$unix(0x1, 0x2, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000600)='cpuacct.usage_user\x00', 0x26e1, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000080)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x20) ioctl$PERF_EVENT_IOC_PERIOD(r2, 0xc0c0583b, &(0x7f0000000000)) 07:10:58 executing program 4: 07:10:58 executing program 2: 07:10:58 executing program 0: r0 = socket$unix(0x1, 0x2, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000600)='cpuacct.usage_user\x00', 0x26e1, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000080)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x20) ioctl$PERF_EVENT_IOC_PERIOD(r2, 0xc0c0583b, &(0x7f0000000000)) 07:10:58 executing program 4: 07:10:58 executing program 2: 07:10:58 executing program 0: r0 = socket$unix(0x1, 0x2, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000600)='cpuacct.usage_user\x00', 0x26e1, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000080)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x20) ioctl$PERF_EVENT_IOC_PERIOD(r2, 0xc0c0583b, &(0x7f0000000000)) 07:10:58 executing program 4: 07:10:58 executing program 2: 07:10:58 executing program 4: r0 = mq_open(&(0x7f00005a1ffb)='eth0\x00', 0x2, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs_stats_percpu\x00') ftruncate(r1, 0xffffffa5) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r1, 0xc0502100, &(0x7f0000000080)={0x0, 0x0}) perf_event_open(&(0x7f0000000000)={0x1000000002, 0x70, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r2, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup2(r0, r3) r5 = socket$inet(0x2, 0x2000000000003, 0x2) r6 = socket$inet(0x2, 0x2000000000003, 0x2) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) r8 = fcntl$dupfd(r7, 0x0, r7) ioctl$sock_SIOCETHTOOL(r8, 0x89f0, &(0x7f0000000340)={'bridge0\x00', &(0x7f0000000200)=@ethtool_ringparam={0x8, 0xfffffffd, 0x0, 0x0, 0x0, 0x800, 0x0, 0x8000}}) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r8, 0x6, 0x14, &(0x7f0000000180)=0x2, 0x4) setsockopt$inet_int(r6, 0x1f00000000000000, 0xd2, &(0x7f0000000000), 0x3c) getsockopt$inet_pktinfo(r6, 0x0, 0x8, &(0x7f0000000100)={0x0, @empty, @multicast1}, &(0x7f0000000140)=0xc) setsockopt$inet_int(r5, 0x1f00000000000000, 0xd2, &(0x7f0000000000), 0x3c) socket$alg(0x26, 0x5, 0x0) mq_timedsend(r4, &(0x7f0000001080)="7e854fb94c5e604ff57e510d99672bb84674144b9e92b93e3c7da9b826ac23477d337b3c394ca8f948954a480263c396ac6f5a0097c87bc25b5c7a38ecd2880f4f74e7ba9724eb89f0d686179d1f2644dabddf937ccd01bf871124c5ff9441a09329c87f2a7959a26ccb9bae819eb1104970996e56e54b6dfd7c65a14424bf85bfb3c4a3e4ad0244e4bac3df947766183226dd4ed7fc4f10ce6228efa6aa353848925f58a8172467373a06bbef98386015a23411dd62ccd8cef89bc777b94eb1a51b16e103db14fa3a040057f2712ec6892e53a9a6db84597cb5e1a4d484a0d4", 0x2000, 0xd3, &(0x7f0000000000)={0x0, 0x1c9c380}) 07:10:58 executing program 0: r0 = socket$unix(0x1, 0x2, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000600)='cpuacct.usage_user\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(r2, 0xc0c0583b, &(0x7f0000000000)) 07:10:58 executing program 2: 07:10:58 executing program 4: 07:10:58 executing program 0: r0 = socket$unix(0x1, 0x2, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000600)='cpuacct.usage_user\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(r2, 0xc0c0583b, &(0x7f0000000000)) 07:10:59 executing program 2: 07:10:59 executing program 4: 07:10:59 executing program 0: r0 = socket$unix(0x1, 0x2, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000600)='cpuacct.usage_user\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(r2, 0xc0c0583b, &(0x7f0000000000)) 07:10:59 executing program 4: 07:10:59 executing program 4: 07:10:59 executing program 2: 07:10:59 executing program 0: r0 = socket$unix(0x1, 0x2, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000080)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x20) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0xc0c0583b, &(0x7f0000000000)) 07:10:59 executing program 4: 07:10:59 executing program 2: 07:10:59 executing program 2: 07:10:59 executing program 4: 07:10:59 executing program 0: r0 = socket$unix(0x1, 0x2, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000080)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x20) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0xc0c0583b, &(0x7f0000000000)) 07:10:59 executing program 2: 07:10:59 executing program 4: 07:10:59 executing program 2: 07:10:59 executing program 0: r0 = socket$unix(0x1, 0x2, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000080)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x20) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0xc0c0583b, &(0x7f0000000000)) 07:10:59 executing program 4: 07:10:59 executing program 2: 07:10:59 executing program 0: r0 = socket$unix(0x1, 0x2, 0x0) fcntl$dupfd(r0, 0x0, r0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000600)='cpuacct.usage_user\x00', 0x26e1, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000080)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x20) ioctl$PERF_EVENT_IOC_PERIOD(r1, 0xc0c0583b, &(0x7f0000000000)) 07:10:59 executing program 4: 07:10:59 executing program 2: 07:10:59 executing program 0: r0 = socket$unix(0x1, 0x2, 0x0) fcntl$dupfd(r0, 0x0, r0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000600)='cpuacct.usage_user\x00', 0x26e1, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000080)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x20) ioctl$PERF_EVENT_IOC_PERIOD(r1, 0xc0c0583b, &(0x7f0000000000)) 07:10:59 executing program 2: 07:10:59 executing program 4: 07:10:59 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) r3 = dup3(r0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, &(0x7f0000000000)={0x0}) r5 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) r6 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r7 = dup2(r6, r5) ioctl$BINDER_SET_CONTEXT_MGR(r7, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, &(0x7f0000000040)={r4, 0x0, r7}) dup2(r3, r2) 07:10:59 executing program 2: 07:10:59 executing program 0: r0 = socket$unix(0x1, 0x2, 0x0) fcntl$dupfd(r0, 0x0, r0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000600)='cpuacct.usage_user\x00', 0x26e1, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000080)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x20) ioctl$PERF_EVENT_IOC_PERIOD(r1, 0xc0c0583b, &(0x7f0000000000)) 07:10:59 executing program 4: 07:10:59 executing program 2: 07:10:59 executing program 0: socket$unix(0x1, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000600)='cpuacct.usage_user\x00', 0x26e1, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000080)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x20) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0xc0c0583b, &(0x7f0000000000)) 07:10:59 executing program 4: 07:10:59 executing program 4: 07:10:59 executing program 2: [ 273.627455] binder_alloc: 16265: binder_alloc_buf, no vma 07:11:00 executing program 0: socket$unix(0x1, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000600)='cpuacct.usage_user\x00', 0x26e1, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000080)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x20) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0xc0c0583b, &(0x7f0000000000)) 07:11:00 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = dup3(r0, r1, 0x0) dup2(r3, r2) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) mmap(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000000, 0x50, r4, 0x4a884000) 07:11:00 executing program 4: 07:11:00 executing program 2: [ 273.733250] binder_alloc: 16265: binder_alloc_buf, no vma 07:11:00 executing program 4: 07:11:00 executing program 2: 07:11:00 executing program 0: socket$unix(0x1, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000600)='cpuacct.usage_user\x00', 0x26e1, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000080)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x20) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0xc0c0583b, &(0x7f0000000000)) 07:11:00 executing program 2: 07:11:00 executing program 4: 07:11:00 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$rds(0x15, 0x5, 0x0) shutdown(r0, 0x1) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ubi_ctrl\x00', 0x802, 0x0) ioctl$DRM_IOCTL_AGP_INFO(r3, 0x80386433, &(0x7f0000000040)=""/32) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r5 = dup3(r1, r2, 0x0) dup2(r5, r4) 07:11:00 executing program 2: 07:11:00 executing program 4: 07:11:00 executing program 0: r0 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000600)='cpuacct.usage_user\x00', 0x26e1, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000080)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x20) ioctl$PERF_EVENT_IOC_PERIOD(r1, 0xc0c0583b, &(0x7f0000000000)) 07:11:00 executing program 2: 07:11:00 executing program 4: 07:11:00 executing program 2: 07:11:00 executing program 4: 07:11:00 executing program 0: r0 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000600)='cpuacct.usage_user\x00', 0x26e1, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000080)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x20) ioctl$PERF_EVENT_IOC_PERIOD(r1, 0xc0c0583b, &(0x7f0000000000)) 07:11:00 executing program 2: 07:11:00 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, r2, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) r6 = dup3(r3, r4, 0x0) dup2(r6, r5) 07:11:00 executing program 4: 07:11:00 executing program 0: r0 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000600)='cpuacct.usage_user\x00', 0x26e1, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000080)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x20) ioctl$PERF_EVENT_IOC_PERIOD(r1, 0xc0c0583b, &(0x7f0000000000)) 07:11:00 executing program 2: 07:11:00 executing program 4: [ 274.346992] binder_alloc: 16333: binder_alloc_buf, no vma 07:11:00 executing program 0: r0 = socket$unix(0x1, 0x0, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000600)='cpuacct.usage_user\x00', 0x26e1, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000080)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x20) ioctl$PERF_EVENT_IOC_PERIOD(r2, 0xc0c0583b, &(0x7f0000000000)) 07:11:00 executing program 2: 07:11:00 executing program 4: 07:11:00 executing program 2: 07:11:00 executing program 4: [ 274.488559] binder: BINDER_SET_CONTEXT_MGR already set [ 274.494244] binder: 16333:16346 ioctl 40046207 0 returned -16 07:11:00 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x800}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = dup3(r0, r1, 0x0) dup2(r3, r2) 07:11:00 executing program 0: r0 = socket$unix(0x1, 0x0, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000600)='cpuacct.usage_user\x00', 0x26e1, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000080)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x20) ioctl$PERF_EVENT_IOC_PERIOD(r2, 0xc0c0583b, &(0x7f0000000000)) 07:11:00 executing program 2: 07:11:00 executing program 4: 07:11:00 executing program 0: r0 = socket$unix(0x1, 0x0, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000600)='cpuacct.usage_user\x00', 0x26e1, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000080)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x20) ioctl$PERF_EVENT_IOC_PERIOD(r2, 0xc0c0583b, &(0x7f0000000000)) 07:11:00 executing program 2: 07:11:00 executing program 4: 07:11:01 executing program 4: 07:11:01 executing program 2: 07:11:01 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000180)="b000b5443a5a6157bce6ae99756107f2708eac4d9f28acef01d105cf2bc307b108ed15ed083678cc261cb5b46e69e3400ff09624c90c7f224d8323f0624be399e25d0524ab5bd9655334f49dd943e69c53ca6d2c6dde2967e03b0a6af39c8e75f8ecab217195556a462635508f2ecc41552020e786ee10963e157936646f605d51aa4dcf21e290ca10f9c707f51904cac2af6fc671027cdf794c10392c9b9cb35346d692bf2a16", 0xa7}, {&(0x7f0000000240)="99086d1549433a9681f12db6dc842a4425d148428fcc670f7a1f2b04acd60a49b86e474869b34ec3b9d239b794919bad235c0027c602025e0070802c40a58ddb74613874901e405a60ec5c815e96873077a19d7c0cdfabce866723f8a8e4b60e252acbdf4d9b60755bc19961aa812b46042cc72dd058af2ce791de31dc169e7453c19daae1541f7fe963b6f34ee93610f79024b1fe0674702f7099b78ce4c3cd09f2200c05e0a579d81522bd7849bb6ec911fe247f51d7c27f8c018c2fa1ccce4df6b250b923f1dabbafe20717460618fa82b218875d9cc5c8a86eccb8771f4360cc84a360", 0xe5}], 0x2, 0x4) r4 = dup3(r0, r1, 0x0) dup2(r4, r2) 07:11:01 executing program 0: r0 = socket$unix(0x1, 0x2, 0x0) r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000600)='cpuacct.usage_user\x00', 0x26e1, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000080)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x20) ioctl$PERF_EVENT_IOC_PERIOD(r2, 0xc0c0583b, &(0x7f0000000000)) 07:11:01 executing program 4: 07:11:01 executing program 2: 07:11:01 executing program 0: r0 = socket$unix(0x1, 0x2, 0x0) r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000600)='cpuacct.usage_user\x00', 0x26e1, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000080)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x20) ioctl$PERF_EVENT_IOC_PERIOD(r2, 0xc0c0583b, &(0x7f0000000000)) 07:11:01 executing program 2: 07:11:01 executing program 4: 07:11:01 executing program 2: 07:11:01 executing program 4: 07:11:01 executing program 0: r0 = socket$unix(0x1, 0x2, 0x0) r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000600)='cpuacct.usage_user\x00', 0x26e1, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000080)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x20) ioctl$PERF_EVENT_IOC_PERIOD(r2, 0xc0c0583b, &(0x7f0000000000)) 07:11:01 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = gettid() tkill(r2, 0xb) ptrace$setopts(0x4206, r2, 0x0, 0x0) ptrace(0x8, r2) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r4 = dup3(r0, r1, 0x0) dup2(r4, r3) 07:11:01 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) r3 = open(&(0x7f0000000180)='./bus\x00', 0x151042, 0x0) sendfile(r3, 0xffffffffffffffff, 0x0, 0x0) r4 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000040)='NLBL_CALIPSO\x00') sendmsg$NLBL_CALIPSO_C_REMOVE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x34, r4, 0x0, 0x0, 0x0, {}, [@NLBL_CALIPSO_A_DOI={0x8}, @NLBL_CALIPSO_A_DOI={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x3}]}, 0x34}, 0x1, 0x0, 0x0, 0x8005}, 0x4) sendmsg$NLBL_CALIPSO_C_LISTALL(r3, &(0x7f00000018c0)={&(0x7f0000001800)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000001880)={&(0x7f0000001840)={0x2c, r4, 0x200, 0x70bd2a, 0x25dfdbfd, {}, [@NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x3}, @NLBL_CALIPSO_A_DOI={0x8}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x3}]}, 0x2c}}, 0x4000000) sendmsg$NLBL_CALIPSO_C_LISTALL(r2, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r4, 0x1, 0x70bd2b, 0x25dfdbff, {}, [@NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0xb5712740400e67c0}, 0x4000) r5 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x4, 0x20000000007ffd, 0x7c, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100]}, 0x2c) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r5, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096}, 0x20) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000002640)=ANY=[@ANYRES32], 0x32600) 07:11:01 executing program 4: 07:11:01 executing program 2: 07:11:01 executing program 0: r0 = socket$unix(0x1, 0x2, 0x0) r1 = fcntl$dupfd(r0, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000600)='cpuacct.usage_user\x00', 0x26e1, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000080)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x20) ioctl$PERF_EVENT_IOC_PERIOD(r2, 0xc0c0583b, &(0x7f0000000000)) 07:11:01 executing program 4: 07:11:01 executing program 2: 07:11:01 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x10022}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = gettid() tkill(r3, 0xb) ptrace$setopts(0x4206, r3, 0x0, 0x0) capset(&(0x7f0000000000)={0x19980330, r3}, &(0x7f0000000040)={0x8, 0x6, 0xd1, 0x8, 0x4, 0x6}) r4 = dup3(r0, r1, 0x0) dup2(r4, r2) [ 275.187275] binder_alloc: 16408: binder_alloc_buf, no vma 07:11:01 executing program 4: 07:11:01 executing program 2: 07:11:01 executing program 0: r0 = socket$unix(0x1, 0x2, 0x0) r1 = fcntl$dupfd(r0, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000600)='cpuacct.usage_user\x00', 0x26e1, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000080)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x20) ioctl$PERF_EVENT_IOC_PERIOD(r2, 0xc0c0583b, &(0x7f0000000000)) [ 275.277884] binder: BINDER_SET_CONTEXT_MGR already set 07:11:01 executing program 2: 07:11:01 executing program 3: bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x4, 0x20000000007ffd, 0x7c, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100]}, 0x2c) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="00000000030f5b2abc075e84120956cfca70422b7b3c947159bf53f99e9b3b2cd3f99fd18d325a111997d09b3c4a36645e1a70bc003ae0a92f275a3cc1159b2d73616d9d9349f8ee635f7602d4386fa3224276e3ec852c4d53161fc9655dd3d51c81b3488488f49c7f6e3c4c138dd1d7a6c09dd4316665ff3f5198"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)=ANY=[@ANYBLOB="852a74700000000000000000000000000000000000000000852a687300000000000000000000000000000000000000008561646600000000000000000000000000000000002300"/80], &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000080)={r2, &(0x7f0000000380)="6acde4c38a5d04d88ce77028824f951552f59fd2e8cbd2ca457d02cee31b1be7eee3f875dda83d928be46c6e3b0aeec3684e7c1af23fe44f1abaf9a6f4684330ee24257121b95ac417309743d07c6d3f3df200e784b8c8a76a251f87b1c9ff3727bbfe8bd1e96dc219731e5c708d8be5161158fbc00d9dbd0ecf2d7a207e49af1322a90549dd8e0768639da1b8f81d481aba6d39345accd9dceffe930605057a8d2c7ce5426a0acfca0b002abf184c33cf02fde5bfeac05c3653437dff6eae4569d599361a08db2310c56bec452f0c37a4f58e3d32787ac552d247aefac19668a0909f3df319cab3872ed87e9db92f751186a5a3c0c485dbe19663ebe571a244d05d837232546f84cdef37d389feb8a38293f02bba75e475244cf2d3f786447ea810f45bea7ff661ae1cf26423e3d7eda6dc978f8d0da658dc86d4af7c177d6aaf4052493a595b97f4f369690de3dab1305b090c1dd601fea9a61a195ec6fb783baf596689e98204dc6f39b7110cd6362771643cced99c47a4a46df21d96c4a42044e26ecb4af2862fb1", &(0x7f0000002680)=""/4098}, 0x20) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000002640)=ANY=[@ANYRES32], 0x32600) 07:11:01 executing program 4: [ 275.307199] binder: 16408:16413 ioctl 40046207 0 returned -16 07:11:01 executing program 0: r0 = socket$unix(0x1, 0x2, 0x0) r1 = fcntl$dupfd(r0, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000600)='cpuacct.usage_user\x00', 0x26e1, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000080)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x20) ioctl$PERF_EVENT_IOC_PERIOD(r2, 0xc0c0583b, &(0x7f0000000000)) 07:11:01 executing program 2: 07:11:01 executing program 4: 07:11:01 executing program 2: 07:11:01 executing program 0: r0 = socket$unix(0x1, 0x2, 0x0) fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000600)='cpuacct.usage_user\x00', 0x26e1, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000080)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x20) ioctl$PERF_EVENT_IOC_PERIOD(r1, 0xc0c0583b, &(0x7f0000000000)) 07:11:01 executing program 1: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0xd5, 0xfe, 0x1, 0x61, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0, 0x6}, 0x41121, 0x0, 0x0, 0x0, 0x8, 0x4000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = dup3(r0, r1, 0x0) r4 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="10003386"], 0x0, 0x0, 0x0}) r6 = dup2(r5, r4) ioctl$BINDER_SET_CONTEXT_MGR(r6, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f0000000880)=ANY=[@ANYBLOB="850010000000000000000000000000000000000000000000852a6873000000000000000000000800000000000000000085616466000000000000000000000000000000000000000000000000000000005aab2b7316019ce49c10768ffba5fafdcec05eebb9291b7c9b90"], &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) getsockopt$inet_pktinfo(r6, 0x0, 0x8, &(0x7f0000000040)={0x0, @initdev, @initdev}, &(0x7f00000000c0)=0xc) sendmsg$NL80211_CMD_LEAVE_MESH(r3, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x24, 0x0, 0x2, 0x70bd2c, 0x25dfdbfc, {}, [@NL80211_ATTR_IFINDEX={0x8, 0x3, r7}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x20040001}, 0x20004800) dup2(r3, r2) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) io_submit(0x0, 0x6, &(0x7f0000000840)=[&(0x7f0000000340)={0x0, 0x0, 0x0, 0x7, 0x9, 0xffffffffffffffff, &(0x7f0000000300)="ea8453ad19ee374099b749b75090cf546fe4ec67e8165ecb3b04136d88a7a1eb8b758eb94c03e7", 0x27, 0x3, 0x0, 0x2, r3}, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x7, 0x80, 0xffffffffffffffff, &(0x7f0000000380)="9dee75e6ae717cce8e18a645b8d4ab61899e16a5bb65e95c198fb0f3f28f398077bfcc78c9132724ab5b8103546ea9758c82618cf6165d9fc9b5365c4538481218c3a0d6c61ed0826366052e74c16ec7b66af8231b6a2ef8106ff59093c2eb283701ccaa7b3cddb42c03dc2b0551d2fd4c0d525cdd3d39f54fa0a3e20ad341d3729ef9e747bf1b2b74c6f2b4c71f8de81a51fa38e8ba08611f3f5ae3a269af80d3b6610ec25d98e28866b002d02f4b6557eb32b3e1e4a446f55eccf3e500f571059e538d1059306e48589e1e6e151ed2d6786050f5bb10e3de5345834b", 0xdd, 0xbf, 0x0, 0x4}, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x6, 0x3f, 0xffffffffffffffff, &(0x7f00000004c0)="e906027f16c383334c43f4bada4d2e943e21172f3b13", 0x16, 0x80000001, 0x0, 0x2}, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x6, 0x3, 0xffffffffffffffff, &(0x7f00000005c0)="abdf80d2facca5005c0e9436519626d592055f556248a5828de65a99305fb47797e7e6fcdc4fe44e576a91d92c2a854c50a7", 0x32, 0x8, 0x0, 0x1}, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x0, 0x4, 0xffffffffffffffff, &(0x7f0000000640)="d6e63723472db7caecc7976a7562236d23358dee996e3b313e2d68c7d4c1ae4e42f6fe00e86cc9d84671d2babe4a9552bb4af58585bbc96341f60f8a931d9c6b47433b8c90b311405394f1dd1392f6f480bbb6f24f7430f2875b35a7dd281f7f4ab3454a95992e090f218cbf6a8d303a02478461e05658b854b59c9a845f255c79e5b010584862e8806fbc7dd971a5785d1da3a57322b1bbd9b78e3c924871a211c63946bd5d22b8e64aaf68ea503411e1a73da5edf4c9ee5da30bd3c21e21369110fdd7965bac8c06c2cff4cacaf2800005", 0xd2, 0x3bfc, 0x0, 0x1}, &(0x7f0000000800)={0x0, 0x0, 0x0, 0x6, 0xd3, r0, &(0x7f0000000780)="c418ba6848bfc505e16941fddf4af9507b076d870764534bb72006cd199c265cf0843b5b3259064947cada801621192faa36c4229842433d2d70309ac6156e98d19d187d78a6d25d2a571a07be4e2b13d1af97606852786b2f0e113e39799f6c1825", 0x62, 0x4}]) 07:11:01 executing program 4: [ 275.447296] binder: 16432:16434 unknown command 0 [ 275.467384] binder: 16432:16434 ioctl c0306201 20000280 returned -22 [ 275.524466] binder: 16432:16441 unknown command 0 [ 275.529518] binder: 16432:16441 ioctl c0306201 20000280 returned -22 07:11:01 executing program 2: 07:11:01 executing program 3: r0 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x4, 0x20000000007ffd, 0x7c, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100]}, 0x2c) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r0, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096}, 0x20) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000002640)=ANY=[@ANYRES32], 0x32600) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = dup2(r2, r1) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x18, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) r4 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05e2f040"], 0x0, 0x0, 0x0}) r6 = dup2(r5, r4) ioctl$BINDER_SET_CONTEXT_MGR(r6, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) perf_event_open$cgroup(&(0x7f00000000c0)={0x4, 0x70, 0x6, 0x3f, 0x5, 0x80, 0x0, 0x6, 0x6, 0x2, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x8, 0x4, @perf_bp={&(0x7f0000000080), 0xa}, 0x10004, 0x400000, 0x5, 0x7, 0x40, 0x8, 0x4}, r3, 0xf, r6, 0x6) 07:11:01 executing program 4: 07:11:01 executing program 0: r0 = socket$unix(0x1, 0x2, 0x0) fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000600)='cpuacct.usage_user\x00', 0x26e1, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000080)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x20) ioctl$PERF_EVENT_IOC_PERIOD(r1, 0xc0c0583b, &(0x7f0000000000)) 07:11:01 executing program 2: 07:11:01 executing program 4: [ 275.658934] binder: 16445:16449 unknown command -2043478000 [ 275.690890] binder: 16445:16449 ioctl c0306201 20000200 returned -22 07:11:02 executing program 0: r0 = socket$unix(0x1, 0x2, 0x0) fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000600)='cpuacct.usage_user\x00', 0x26e1, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000080)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x20) ioctl$PERF_EVENT_IOC_PERIOD(r1, 0xc0c0583b, &(0x7f0000000000)) [ 275.749015] binder_alloc: 16454: binder_alloc_buf, no vma [ 275.763616] binder: 16445:16458 unknown command -2043478000 [ 275.782053] binder: 16445:16458 ioctl c0306201 20000200 returned -22 [ 275.792300] binder: BINDER_SET_CONTEXT_MGR already set 07:11:02 executing program 2: 07:11:02 executing program 4: 07:11:02 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = dup2(r2, r1) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x18, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@binder={0x73622a85, 0x180, 0x2}, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) mmap$snddsp_status(&(0x7f0000ffc000/0x3000)=nil, 0x1000, 0x3000002, 0x30, r3, 0x82000000) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) r6 = dup3(r0, r4, 0x0) dup2(r6, r5) [ 275.806800] binder: 16454:16457 ioctl 40046207 0 returned -16 [ 275.838716] binder: 16454:16457 unknown command 1089528325 07:11:02 executing program 4: 07:11:02 executing program 0: r0 = socket$unix(0x1, 0x2, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000600)='cpuacct.usage_user\x00', 0x26e1, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000080)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x20) ioctl$PERF_EVENT_IOC_PERIOD(r2, 0xc0c0583b, &(0x7f0000000000)) [ 275.869718] binder: 16454:16457 ioctl c0306201 20000200 returned -22 [ 275.894911] binder: BINDER_SET_CONTEXT_MGR already set [ 275.934984] binder: 16454:16473 ioctl 40046207 0 returned -16 [ 275.975659] binder_alloc: 16474: binder_alloc_buf, no vma [ 276.013699] binder: BINDER_SET_CONTEXT_MGR already set [ 276.049396] binder: 16454:16480 ioctl 40046207 0 returned -16 [ 276.060830] binder: BINDER_SET_CONTEXT_MGR already set [ 276.066291] binder: 16454:16480 ioctl 40046207 0 returned -16 07:11:02 executing program 3: bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x4, 0x20000000007ffd, 0x78, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100]}, 0x40) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)=ANY=[@ANYBLOB="852a747000000000000000687300000000000000000000000000000000000000008561646600"/80], &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r2, &(0x7f00000002c0)="1cfc9d41a7cb21d8d5e9a611004ca9bd7ddafecc37ac20d343141d7d66e2b1a7abb750813de8bdfa51dbde9cf098127542866a2ea63892b1765031fe88678d7197ceab53a8e767be2d617af42488cf1b4899327a3a65e00a3875b4da4f5011cca9fc186d9d98641e146fdee63ea22754611b198952ce8fe448c5753100797f05de2e97e814bb04cec04e6a34f01eabe1b8ae4699c9d28ffbf94ac3f27bb300a328ff229e2926bc243aeed93700c57ab7b576631b26eb00735f97c3f0a62495118b52c0c13f234cec71e9672a02bcd6840b5e28df96ce142e3aaaa8dfc4eacf69f73779c6", &(0x7f00000005c0)=""/4096, 0x4}, 0x20) r3 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r5 = dup2(r4, r3) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0563044047464258d8b7c3988b1289b85afee24389743d128c919f68f80d08c98fcdd8b295519412bd073d91cd891b98ddecc29e24b452469463e7ed21515dcf164b0a"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x18, &(0x7f00000000c0)={@flat=@binder={0x70742a85, 0xa}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000280)={&(0x7f0000000080)="2407d774236ea71e62781e84ccd2eec929f2f72e7d55b7f536951783fbedfd4a53dd8a21332b68249ab8e16fba7382a3a8be4c75516a5bff8fbe315d432dbe992f58dc81e3c37097d3ff5bb9064cb35d3d6c5ecb49b01d9ab74d0ed2bc33c694b067b42e4d91cefbe0374edb1d7b5803fe8a6257e1f77bffc207f5fdcc0aad3b4540c1ba878d2ee542713ffcc952341b29c396334571fc9263306176ecf8ee738079eb9d3feb5e", &(0x7f0000000140)=""/102, &(0x7f00000001c0)="72e727a8dc759e69aafc063abfa1ecf9cd691215c30e5f34c982485870755706e9677ea18702abfd789e8c7c66342b97d2d2d3ae96135fc4d03e71c6723c4355f8", &(0x7f0000000240)="a518e4416258b38f534bad7bb4766cc056ec23b948c9", 0x588, r5}, 0x38) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000002640)=ANY=[@ANYRES32], 0x32600) 07:11:02 executing program 2: 07:11:02 executing program 4: 07:11:02 executing program 0: r0 = socket$unix(0x1, 0x2, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000600)='cpuacct.usage_user\x00', 0x26e1, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000080)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x20) ioctl$PERF_EVENT_IOC_PERIOD(r2, 0xc0c0583b, &(0x7f0000000000)) [ 276.094716] binder_alloc: 16474: binder_alloc_buf, no vma 07:11:02 executing program 4: 07:11:02 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3804, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = dup2(r2, r1) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$VIDIOC_G_AUDOUT(r3, 0x80345631, &(0x7f00000000c0)) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) r6 = dup3(r0, r4, 0x0) r7 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcsa\x00', 0x201, 0x0) ioctl$SNDCTL_DSP_SUBDIVIDE(r7, 0xc0045009, &(0x7f0000000040)=0x7) dup2(r6, r5) 07:11:02 executing program 2: 07:11:02 executing program 0: r0 = socket$unix(0x1, 0x2, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000600)='cpuacct.usage_user\x00', 0x26e1, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000080)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x20) ioctl$PERF_EVENT_IOC_PERIOD(r2, 0xc0c0583b, &(0x7f0000000000)) [ 276.220069] binder_alloc: 16493: binder_alloc_buf, no vma [ 276.256476] binder: BINDER_SET_CONTEXT_MGR already set 07:11:02 executing program 2: 07:11:02 executing program 4: [ 276.278444] binder: 16493:16497 ioctl 40046207 0 returned -16 [ 276.295735] binder_alloc: 16500: binder_alloc_buf, no vma 07:11:02 executing program 2: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000100)="6653070000053c27bc33760036b9405cb4aed12f0000001500ae47a825d8680027805acf2c347fe8c3238ec1c12c4677ddbeaee3b99383fc2df644999fee76ff5d9d5743bad58e9af7a85022085286b7f1d09818edf248af164072d990264b8c4741bbee4a761093e2fae6e49342b149c87a39f876a83e8068d08b2c0adf3ac23d53b05d93c0a311e69cde42e1b77e92d7f5ee1a5ac17de511e072ffeb0828a76d3025ab5437d8b8c646c943bab2ed5d12b0a19e85b3379a753a2c1ce9651aaa218dca66a2062fea75ded3309473a4e06ea1fbfd6b14431e20c83ed605aa6876abee05aa24ef58622afb44bbb56026395c6b0e2b48491f1e7d600162776042c735a32b5e8391b6b709f04e9d0c626a2a140d7f669fa3ba15cdc2fdfde1d6e721fd", 0x121}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x39) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 07:11:02 executing program 0: r0 = socket$unix(0x1, 0x2, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000080)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x20) ioctl$PERF_EVENT_IOC_PERIOD(r2, 0xc0c0583b, &(0x7f0000000000)) [ 276.333756] binder: 16500:16504 ioctl 80345631 200000c0 returned -22 [ 276.334693] binder: BINDER_SET_CONTEXT_MGR already set [ 276.393400] binder: 16493:16506 ioctl 40046207 0 returned -16 07:11:02 executing program 0: r0 = socket$unix(0x1, 0x2, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000080)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x20) ioctl$PERF_EVENT_IOC_PERIOD(r2, 0xc0c0583b, &(0x7f0000000000)) 07:11:02 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) time(0x0) 07:11:02 executing program 3: r0 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x4, 0x20000000007ffd, 0x7c, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100]}, 0x2c) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x400c080) ioctl$sock_netdev_private(r1, 0x89ff, &(0x7f0000000080)="4f212cabe7b451665b65e0cd47eeb62e3f4982446ae5254ea8afca2cdaa5ee6ae77bdc3fa2cec04ed45f3756b61f350dedc21e6e79ec56c6971b869276e5b1a5cd77fc568046b5ca2573960dc7666ec26b2bc1bdbb209150e136b2ddf095383e4b68e012c17096162b81d5533935ffc23a6c812126d4f077711c0e00c27551c07c3b56efe54a255a83e7cbe29a9981256e6d3c58d78aabe4c8283670c14330515c6d26ad7ad4c5e5b0e0e19e91de50fe01d5e27afd281abf66e30f8f018af3f735c2f2af42ba") bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r0, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096}, 0x20) r2 = socket$kcm(0x10, 0x2, 0x0) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/sys/net/ipv4/vs/lblcr_expiration\x00', 0x2, 0x0) sendmsg$kcm(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) r3 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r5 = dup2(r4, r3) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$PPPIOCSACTIVE(r5, 0x40107446, &(0x7f0000000300)={0x6, &(0x7f00000002c0)=[{0x2, 0xfb, 0x1, 0xd5}, {0x9, 0x9, 0x0, 0x81}, {0x2, 0x8, 0x7f, 0x1}, {0x8, 0x20, 0x81, 0x1}, {0x7ff, 0x4, 0xfe, 0x3ff}, {0x74, 0x0, 0x3, 0x1}]}) ioctl$sock_SIOCBRDELBR(r2, 0x89a1, &(0x7f00000001c0)='bridge_slave_0\x00') write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000002640)=ANY=[@ANYRES32], 0x32600) [ 276.438381] binder: 16500:16519 ioctl 80345631 200000c0 returned -22 [ 276.438544] binder_alloc: 16500: binder_alloc_buf, no vma 07:11:02 executing program 0: r0 = socket$unix(0x1, 0x2, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000080)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x20) ioctl$PERF_EVENT_IOC_PERIOD(r2, 0xc0c0583b, &(0x7f0000000000)) 07:11:02 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0x1000000c8) fcntl$setpipe(r2, 0x407, 0x0) write(r2, &(0x7f0000000340), 0x41395527) clock_gettime(0x0, &(0x7f0000000380)={0x0, 0x0}) sched_setattr(0x0, &(0x7f0000000400)={0x38, 0x1, 0x0, 0x0, 0x1}, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b8}, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 07:11:02 executing program 0: r0 = socket$unix(0x1, 0x2, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000600)='cpuacct.usage_user\x00', 0x26e1, 0x0) bpf$BPF_PROG_QUERY(0x10, 0x0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(r2, 0xc0c0583b, &(0x7f0000000000)) 07:11:02 executing program 0: r0 = socket$unix(0x1, 0x2, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000600)='cpuacct.usage_user\x00', 0x26e1, 0x0) bpf$BPF_PROG_QUERY(0x10, 0x0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(r2, 0xc0c0583b, &(0x7f0000000000)) [ 276.670177] binder_alloc: 16533: binder_alloc_buf, no vma [ 276.677524] binder: 16533:16537 ioctl 40107446 20000300 returned -22 [ 276.750048] binder: BINDER_SET_CONTEXT_MGR already set [ 276.829577] binder: 16533:16537 ioctl 40046207 0 returned -16 [ 276.830922] binder: 16533:16557 ioctl 40107446 20000300 returned -22 07:11:03 executing program 1: r0 = perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r5 = dup2(r4, r3) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$l2tp(0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=ANY=[@ANYBLOB, @ANYRES16=r7, @ANYRES32, @ANYBLOB="265ec9"], 0x3c}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000600)={&(0x7f0000000580)={0x4c, r7, 0x300, 0x70bd25, 0x25dfdbfb, {}, [@L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x3}, @L2TP_ATTR_L2SPEC_TYPE={0x5}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={[], [], @empty}}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @local}, @L2TP_ATTR_FD={0x8, 0x17, @udp6}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40840}, 0x80) sendmsg$L2TP_CMD_SESSION_CREATE(r5, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x1c, r7, 0x800, 0x70bd26, 0x25dfdbff, {}, [@L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x2}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, 0xffffffffffffffff) r8 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r9 = dup3(r1, r2, 0x0) dup2(r9, r8) 07:11:03 executing program 0: r0 = socket$unix(0x1, 0x2, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000600)='cpuacct.usage_user\x00', 0x26e1, 0x0) bpf$BPF_PROG_QUERY(0x10, 0x0, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(r2, 0xc0c0583b, &(0x7f0000000000)) 07:11:03 executing program 3: bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x4, 0x20000000007ffd, 0x7c, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100]}, 0x2c) r0 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cachefiles\x00', 0x204000, 0x0) prctl$PR_SET_CHILD_SUBREAPER(0x24, 0x0) ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, &(0x7f0000000100)={0x1e}) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000180)={0x980000, 0x10001, 0x10001, r1, 0x0, &(0x7f0000000140)={0xa00966, 0x6, [], @p_u16=&(0x7f00000000c0)=0xffff}}) syz_open_dev$sndctrl(&(0x7f0000000400)='/dev/snd/controlC#\x00', 0x9, 0x22001) r3 = socket(0x10, 0x803, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(0xffffffffffffffff, 0xc0bc5351, &(0x7f0000001600)={0x9, 0x2, 'client1\x00', 0x0, "607b45fcdd0d0851", "fc504f3bd86ed13df26323a751a429eba7892a466b7b18e0cb6ea4e69c7b8382", 0x8}) sendmsg$nl_route_sched(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001880)=ANY=[@ANYBLOB="0000000000000000000000000000000010200000", @ANYRES32=r4, @ANYBLOB="0000000000000000040000000a00010072737670360000001800020014000200200100"/48], 0x48}}, 0x0) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f00000003c0)='TIPCv2\x00') sendmsg$TIPC_NL_UDP_GET_REMOTEIP(r3, &(0x7f0000000600)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000440)={0x158, r5, 0x200, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_MEDIA={0x10, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}]}]}, @TIPC_NLA_BEARER={0x80, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x9}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5efc3560}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7f}, @TIPC_NLA_PROP_MTU={0x8}]}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x2}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e22, 0x7f, @mcast2, 0x3ff}}, {0x14, 0x2, @in={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}}}}]}, @TIPC_NLA_BEARER={0xb4, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_NAME={0x15, 0x1, @l2={'eth', 0x3a, 'veth1_to_hsr\x00'}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffff0001}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}]}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e20, @loopback}}, {0x14, 0x2, @in={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x2e}}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x20}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x80000000}]}]}, 0x158}, 0x1, 0x0, 0x0, 0x4}, 0x80) sendmsg$TIPC_NL_UDP_GET_REMOTEIP(r2, &(0x7f0000000380)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000340)={&(0x7f0000000200)={0x10c, r5, 0x100, 0x70bd28, 0x25dfdbff, {}, [@TIPC_NLA_BEARER={0x9c, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x400}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xdf}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x4}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'ib', 0x3a, 'macvlan0\x00'}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x4}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e24, @broadcast}}, {0x20, 0x2, @in6={0xa, 0x4e20, 0x2cd9, @ipv4={[], [], @private=0xa010101}, 0x1}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x7}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xfff}]}, @TIPC_NLA_LINK={0x5c, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x1c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7fffffff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9d}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}]}, @TIPC_NLA_LINK_PROP={0x3c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7fffffff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x52b}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x913}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1f}]}]}]}, 0x10c}, 0x1, 0x0, 0x0, 0x20000400}, 0x4008000) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000015c0)) ioctl$RTC_EPOCH_READ(r2, 0x8008700d, &(0x7f0000000640)) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000002640)=ANY=[@ANYRES32], 0x32600) [ 277.127178] binder_alloc: 16559: binder_alloc_buf, no vma 07:11:05 executing program 2: r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uhid\x00', 0x0, 0x0) fsetxattr$trusted_overlay_upper(r0, 0x0, 0x0, 0x0, 0x0) 07:11:05 executing program 0: r0 = socket$unix(0x1, 0x2, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000600)='cpuacct.usage_user\x00', 0x26e1, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000080)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x20) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0xc0c0583b, &(0x7f0000000000)) 07:11:05 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x20a401, 0x0) r4 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x4, 0xffffffff, 0x5746, 0x0, r2, 0x0, [0x0, 0x0, 0x0, 0x400100], 0x0, r3}, 0x35) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r4, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096}, 0x20) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000002640)=ANY=[@ANYRES32], 0x32600) 07:11:05 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = dup2(r2, r1) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$SIOCAX25GETINFOOLD(r3, 0x89e9, &(0x7f00000000c0)) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) preadv(r6, &(0x7f00000014c0)=[{&(0x7f0000000180)=""/195, 0xc3}, {&(0x7f0000000000)=""/14, 0xe}, {&(0x7f0000000280)=""/221, 0xdd}, {&(0x7f0000000380)=""/125, 0x7d}, {&(0x7f0000000400)=""/4096, 0x1000}, {&(0x7f0000001400)=""/153, 0x99}, {&(0x7f0000000040)=""/10, 0xa}], 0x7, 0x3) r7 = dup3(r0, r4, 0x0) dup2(r7, r5) 07:11:05 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0x1000000c8) fcntl$setpipe(r2, 0x407, 0x0) write(r2, &(0x7f0000000340), 0x41395527) clock_gettime(0x0, &(0x7f0000000380)={0x0, 0x0}) sched_setattr(0x0, &(0x7f0000000400)={0x38, 0x1, 0x0, 0x0, 0x1}, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b8}, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 07:11:05 executing program 5: bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x4, 0x20000000007ffd, 0x7c, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100]}, 0x2c) r0 = socket$inet6(0xa, 0x2, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) r4 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/qat_adf_ctl\x00', 0x338480, 0x0) getsockopt$inet_sctp_SCTP_INITMSG(r4, 0x84, 0x2, &(0x7f0000000300), &(0x7f0000000340)=0x8) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r5 = dup2(r3, r2) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f0000000380)=ANY=[@ANYBLOB="852a74700000000000000000000000000000000002000000852a687300000000000000000000000000000000000000008561646600000000000000000000000000000000000000000000000000000000d454edfce71f42fb3e7eea0f68ffa215af312f24bdba6f13cd007a9a"], &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$DRM_IOCTL_MODE_CREATEPROPBLOB(r1, 0xc01064bd, &(0x7f0000000180)={&(0x7f00000000c0)="25e9deed3150781e7f7f67e72a45e092e8cc9476e5d882db9345b4a159eb7a069235c72f6cd406f5005c458f21cd1581ef1f292ab9e78a6143f2db90f62c5557df5f4229767bfa0b8ee6e66cb14c1162cb6c3041eb72ed3425b6f0c5c89114ded0fba095ac43d1f12c5e64ce9f4600d98fb2037f1b4ec2ec8280bf4912c009607cbde8ac7621013055370226a9efde521c241e302a7aa835bc1a97fbfff9069c", 0xa0, 0x2}) ioctl$DRM_IOCTL_MODE_GETPROPBLOB(r5, 0xc01064ac, &(0x7f0000000200)={r6, 0x1a, &(0x7f00000001c0)=""/26}) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r1, &(0x7f0000000080)="07e5b199766267fd", &(0x7f00000015c0)=""/4096, 0x4}, 0x20) 07:11:05 executing program 0: r0 = socket$unix(0x1, 0x2, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000600)='cpuacct.usage_user\x00', 0x26e1, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000080)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x20) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0xc0c0583b, &(0x7f0000000000)) 07:11:05 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getsockopt$sock_buf(r0, 0x1, 0x3b, 0x0, &(0x7f0000000180)) [ 279.474764] binder_alloc: 16591: binder_alloc_buf, no vma [ 279.482007] binder: 16591:16595 ioctl 89e9 200000c0 returned -22 [ 279.510641] binder_alloc: 16589: binder_alloc_buf, no vma 07:11:05 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$BATADV_CMD_GET_MESH(r1, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x4000) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="38000000100039af00"/20, @ANYRES32=0x0, @ANYBLOB="001500009b0000001800128008000100736974000c00028008000100", @ANYRES32=r2], 0x38}}, 0x0) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000000)={@private2, r2}, 0x14) r3 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r5 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0a630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$VIDIOC_CROPCAP(r5, 0xc02c563a, &(0x7f00000000c0)={0xa, {0x0, 0x5037ba8b, 0x10000, 0x5000000}, {0x90000, 0x1f, 0x81, 0x7}, {0x3, 0x7ff}}) r6 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x4, 0x20000000007ffd, 0x4, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100], r2}, 0x40) r7 = socket$inet6(0xa, 0x2, 0x0) dup(r7) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r6, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096}, 0x20) [ 279.527850] binder: BINDER_SET_CONTEXT_MGR already set [ 279.534938] binder: 16589:16600 ioctl 40046207 0 returned -16 [ 279.550305] binder_alloc: 16591: binder_alloc_buf, no vma [ 279.550725] binder: 16591:16603 ioctl 89e9 200000c0 returned -22 07:11:05 executing program 3: r0 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x4, 0x20000000007ffd, 0x7c, 0x0, 0xffffffffffffffff, 0x9e3, [0x0, 0x0, 0x0, 0x400100], 0x0, 0xffffffffffffffff, 0x0, 0x3}, 0x40) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r0, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096}, 0x20) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000002640)=ANY=[@ANYRES32], 0x32600) 07:11:06 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getsockopt$sock_buf(r0, 0x1, 0x3b, 0x0, &(0x7f0000000180)) 07:11:06 executing program 0: r0 = socket$unix(0x1, 0x2, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000600)='cpuacct.usage_user\x00', 0x26e1, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000080)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x20) ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0xc0c0583b, &(0x7f0000000000)) 07:11:06 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x2400, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) r6 = dup3(r3, r4, 0x0) dup2(r6, r5) 07:11:06 executing program 5: r0 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x4, 0x20000000007ffd, 0x7c, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100]}, 0x2c) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r4 = dup2(r3, r2) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) setsockopt$pppl2tp_PPPOL2TP_SO_RECVSEQ(r4, 0x111, 0x2, 0x0, 0x4) r5 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r0, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096}, 0x20) 07:11:06 executing program 3: r0 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x4, 0x20000000007ffd, 0x7c, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100]}, 0x2c) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r0, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096}, 0x20) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000002640)=ANY=[@ANYRES32], 0x32600) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000140)={&(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000080)="28eae659dcad84b51a2a57f7d3779be8d06b74e9461a0291a5b4b154d5881b89e8bf250df5bbf65e4e0aea74ad4b0a5ffe132007e132381cda8bd6ae861b0ff60cec977acba7f37bd5417b92cd9d9fee1668e603954ad5aeca03c0db7628271d2496c1cb93ca18e0ca546d7a28e5da2fc57ff8ab4dc19e1207d96982a7ca6f9ec2f3f872fbcc80a6fb4e27ccbfd627d1e39192f3d6e8f4f36d6c394e4363", 0x9e, r0}, 0x68) 07:11:06 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getsockopt$sock_buf(r0, 0x1, 0x3b, 0x0, &(0x7f0000000180)) [ 279.960588] binder_alloc: 16623: binder_alloc_buf, no vma [ 279.989233] binder: 16623:16628 ioctl 2400 0 returned -22 [ 280.003128] binder_alloc: 16624: binder_alloc_buf, no vma [ 280.073533] binder_alloc: 16623: binder_alloc_buf, no vma [ 280.080439] binder: 16623:16628 ioctl 2400 0 returned -22 07:11:06 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0) memfd_create(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0xff}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0x1000000c8) fcntl$setpipe(r2, 0x407, 0x0) write(r2, &(0x7f0000000340), 0x41395527) clock_gettime(0x0, &(0x7f0000000380)={0x0, 0x0}) sched_setattr(0x0, &(0x7f0000000400)={0x38, 0x1, 0x0, 0x0, 0x1}, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b8}, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 07:11:06 executing program 0: r0 = socket$unix(0x1, 0x2, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000600)='cpuacct.usage_user\x00', 0x26e1, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000080)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x20) ioctl$PERF_EVENT_IOC_PERIOD(r2, 0xc0c0583b, 0x0) 07:11:06 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = dup3(r0, r1, 0x0) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) tee(r4, r5, 0x7, 0x2) dup2(r3, r2) 07:11:06 executing program 5: r0 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x4, 0x20000000007ffd, 0x7c, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100]}, 0x2c) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r5 = dup2(r4, r3) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x18, &(0x7f00000000c0)={@fd, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$BATADV_CMD_GET_MESH(r7, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={0x0, 0x8}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="38000000100039af00"/20, @ANYRES32=0x0, @ANYBLOB="001500009b0000001800128008000100736974000c00028008000100", @ANYRES32=r8], 0x38}}, 0x0) ioctl$sock_inet6_SIOCADDRT(r5, 0x890b, &(0x7f0000000080)={@mcast2, @private0={0xfc, 0x0, [], 0x1}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x3cae, 0x8, 0x8, 0x100, 0x9, 0x40, r8}) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r0, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096}, 0x20) 07:11:06 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getsockopt$sock_buf(r0, 0x1, 0x3b, 0x0, &(0x7f0000000180)) 07:11:06 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0x1f, 0x6, 0x8, 0x100}, 0x14) r3 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x4, 0x20000000007ffd, 0x7c, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100]}, 0x2c) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r3, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096}, 0x20) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000002640)=ANY=[@ANYRES32], 0x32600) 07:11:06 executing program 0: r0 = socket$unix(0x1, 0x2, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000600)='cpuacct.usage_user\x00', 0x26e1, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000080)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x20) ioctl$PERF_EVENT_IOC_PERIOD(r2, 0xc0c0583b, 0x0) 07:11:06 executing program 2: getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x3b, 0x0, &(0x7f0000000180)) 07:11:06 executing program 5: bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x4, 0x20000000007ffd, 0x7c, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100]}, 0x2c) r0 = socket$inet6(0xa, 0x2, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ocfs2_control\x00', 0x22100, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r2, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096}, 0x20) [ 280.336981] binder_alloc: 16656: binder_alloc_buf, no vma [ 280.407250] binder: BINDER_SET_CONTEXT_MGR already set [ 280.431883] binder: 16656:16665 ioctl 40046207 0 returned -16 07:11:06 executing program 0: r0 = socket$unix(0x1, 0x2, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000600)='cpuacct.usage_user\x00', 0x26e1, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000080)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x20) ioctl$PERF_EVENT_IOC_PERIOD(r2, 0xc0c0583b, 0x0) 07:11:06 executing program 2: getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x3b, 0x0, &(0x7f0000000180)) 07:11:06 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$FICLONE(r2, 0x40049409, 0xffffffffffffffff) mlock2(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sysvipc/sem\x00', 0x0, 0x0) r4 = gettid() tkill(r4, 0xb) ptrace$setopts(0x4206, r4, 0x0, 0x0) timer_create(0x2, &(0x7f00000000c0)={0x0, 0x10, 0x1, @tid=r4}, &(0x7f0000000180)) ioctl$KVM_ASSIGN_PCI_DEVICE(r3, 0x8040ae69, &(0x7f0000000040)={0x7ff, 0x0, 0x80, 0x5, 0xffffffe1}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r5 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$TIOCGSID(r5, 0x5429, &(0x7f00000001c0)) r6 = dup3(r0, r1, 0x0) dup2(r6, r2) 07:11:07 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000100)="6653070000053c27bc33760036b9405cb4aed12f0000001500ae47a825d8680027805acf2c347fe8c3238ec1c12c4677ddbeaee3b99383fc2df644999fee76ff5d9d5743bad58e9af7a85022085286b7f1d09818edf248af164072d990264b8c4741bbee4a761093e2fae6e49342b149c87a39f876a83e8068d08b2c0adf3ac23d53b05d93c0a311e69cde42e1b77e92d7f5ee1a5ac17de511e072ffeb0828a76d3025ab5437d8b8c646c943bab2ed5d12b0a19e85b3379a753a2c1ce9651aaa218dca66a2062fea75ded3309473a4e06ea1fbfd6b14431e20c83ed605aa6876abee05aa24ef58622afb44bbb56026395c6b0e2b48491f1e7d600162776042c735a32b5e8391b6b709f04e9d0c626a2a140d7f669fa3ba15", 0x118}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x39) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 07:11:07 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) r3 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000140)={0x11, 0x5, 0x20000000007ffd, 0x4000007c, 0x0, r2, 0x800, [0x0, 0x0, 0x0, 0x400100], 0x0, r2, 0xfffffffc, 0x0, 0x1000000}, 0x40) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r3, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096}, 0x20) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000002640)=ANY=[@ANYRES32], 0x32600) 07:11:07 executing program 2: getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x3b, 0x0, &(0x7f0000000180)) 07:11:07 executing program 0: syz_mount_image$vfat(&(0x7f0000000440)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x2, &(0x7f0000000040)=[{&(0x7f0000000140)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}, {&(0x7f0000000740)="e744df7230d9627318729511681067c7654b695f41d862c01eb9306d87208d7abf3a722417b3b3572d72ed6c8ac46840f02aa8ce737bdeed7f2c46ef109ece60c40eb71599b413d4ec854b37c6ed2a3acc58a61080426e086f92ac8522e7245df293772ebf2093bd670a553714ac153028d5706dbb32b002d11ca3ae0d877415ec3b3961c7918e5806e5990d8faae8afde2303111c54b609654e4ab6d764db80ee42cd34dd1726f57353daf8a5ab97150b5844ca3b6e928dae517e8c838a7a5897b8f42fd376401e9f040c830fac64eae1bb7715b845f6e710f9940940d288226c6bff9c3c0321afca4ac9eddf0055d95008d94845f2588ed442a24fcd2f0f77ceba3f892b0c88bf82b4beedb42bf4155ece987808ee561de56007604dc8f848714b8af4417d65fa7d7f16be29ba3925681f1a032eabbae26e918ca1fbe102a3c8ca0f7b925c7612921d9ff2408002bc1a60ee04d896c4468ac394018b65e7f5fdd884e15d88c1947435fd52fc12dac76be19d54a85a0617e5a79279b364474d9145", 0x182, 0x7f}], 0x0, 0x0) 07:11:07 executing program 5: r0 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x4, 0x20000000007ffd, 0x7c, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100]}, 0x2c) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r3 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r5 = dup2(r4, r3) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) r6 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r6, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$KVM_SET_XCRS(r6, 0x4188aea7, &(0x7f0000000040)={0x3, 0x0, [{0x7}, {0x8, 0x0, 0x400}, {0x4, 0x0, 0x16400}]}) r7 = socket$inet6(0xa, 0x2, 0x0) r8 = dup(r7) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000080)={r0, &(0x7f00000000c0)="d019ec86cad196aa7d54078782be3bdbeceddab46929e0578c78a5362ef533268c7b3f208646e48de4171ba703e027d30ec440b89c0bd9d5ca573af5730f9eb351552557b5b8932aacc6fd48ae6c7f99de5679c29e779c5cd3c63aafea57d51ff3662ac395a2d096f69a5489afd70193e2ce30851c7087f5198470300da6949464bd6b1c96fa62c3db8789b8c8c72f5d067bd57f10d9c057efca8291f0255ca06f30d6fd85f59ed60852a4ec5a308010e1151e356be71f1d0c82ad4ef2c5558dbfa39a", &(0x7f00000015c0)=""/4096}, 0x20) 07:11:07 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm_plock\x00', 0x2, 0x0) ioctl$BLKFRASET(r1, 0x1264, &(0x7f0000000040)=0x4) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000001c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x70, 0x70, 0x4, [@fwd={0xd}, @const={0xf, 0x0, 0x0, 0xa, 0x1}, @int={0x0, 0x0, 0x0, 0x1, 0x0, 0x33, 0x0, 0x1a, 0x7}, @fwd={0x3}, @func={0xc, 0x0, 0x0, 0xc, 0x4}, @volatile={0xb, 0x0, 0x0, 0x9, 0x2}, @struct={0x6, 0x1, 0x0, 0x4, 0x0, 0x6, [{0x1, 0x5, 0x800}]}, @restrict={0x5, 0x0, 0x0, 0xb, 0x2}]}, {0x0, [0x30, 0x2e]}}, &(0x7f0000000280)=""/90, 0x8c, 0x5a, 0x1}, 0x20) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) r6 = dup3(r5, r4, 0x0) dup2(r6, r3) 07:11:07 executing program 0: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000002700)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000002480)=""/179, 0xb3}, 0x1000}], 0x1, 0x0, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$SO_TIMESTAMP(r3, 0x1, 0x0, &(0x7f00000001c0)=0x1c8, 0x4) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x1, 0x0, 0x8}, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x6a, 0x1, 0x0, 0x0, 0x0, 0x0, 0x90342, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x1}, 0x0, 0x0, 0x5, 0x4, 0x2}, 0x0, 0x1, 0xffffffffffffffff, 0x0) write$FUSE_INTERRUPT(0xffffffffffffffff, &(0x7f0000000080)={0x10}, 0x10) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = creat(&(0x7f00000000c0)='./bus\x00', 0x176) write$cgroup_type(r4, &(0x7f0000000200)='threaded\x00', 0x175d900f) 07:11:07 executing program 2: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getsockopt$sock_buf(r0, 0x1, 0x3b, 0x0, &(0x7f0000000180)) 07:11:07 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40808, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, @perf_bp={0x0}, 0x1, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x3}, 0x0, 0xfffffffffffffffb, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="456304400586c581b6a080a14455245acef20f428bd22b3ef0f523f463a750dfc79386fd7e4c50b1888f3ef718cad7aa0ce960"], 0x0, 0x0, 0x0}) r4 = dup2(r3, r2) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) r5 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r6 = dup3(r0, r1, 0x0) r7 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r7, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000000380)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x58, 0x18, &(0x7f00000002c0)={@ptr={0x70742a85, 0x0, &(0x7f00000001c0)=""/19, 0x13, 0x0, 0x1f}, @fd={0x66642a85, 0x0, r3}, @fd}, &(0x7f0000000340)={0x0, 0x28, 0x40}}}], 0x0, 0x73b000, 0x0}) ioctl$VIDIOC_G_CTRL(r7, 0xc008561b, &(0x7f0000000180)={0x2db, 0x8}) dup2(r6, r5) 07:11:07 executing program 2: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getsockopt$sock_buf(r0, 0x1, 0x3b, 0x0, &(0x7f0000000180)) [ 281.227443] binder_alloc: 16704: binder_alloc_buf, no vma [ 281.256380] binder: BINDER_SET_CONTEXT_MGR already set [ 281.264189] binder: BINDER_SET_CONTEXT_MGR already set 07:11:07 executing program 3: r0 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x4, 0x20000000007ffd, 0x7c, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100]}, 0x2c) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r0, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096}, 0x20) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="5b6467b0c999f7c3ca76f94f8a6109eedcb780592edbad3ffc2e88a5d69c51f6f2efa99562aebd386a48033156e3bed4012447841f1579b48bd799a34a7f6b"], 0x0, 0x0, 0x0}) r3 = dup2(r2, r1) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) r4 = socket$inet(0x2, 0x80001, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000000)={r4}) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$tipc(&(0x7f0000000240)='TIPC\x00') sendmsg$TIPC_CMD_GET_REMOTE_MNG(r6, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)={0x1c, r7, 0x1}, 0x1c}}, 0x0) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r5, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x1c, r7, 0x400, 0x70bd26, 0x25dfdbfe, {}, ["", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000811}, 0x8012) sendmsg$TIPC_CMD_SET_NODE_ADDR(r3, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r7, 0x1, 0x70bd2a, 0x25dfdbfb, {{}, {}, {0x8, 0x11, 0x9}}, ["", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0xd02b08e6a01e7c09}, 0x44812) [ 281.279577] binder: 16704:16717 ioctl 40046207 0 returned -16 [ 281.286305] binder: 16706:16719 ioctl 40046207 0 returned -16 [ 281.348363] binder: 16735:16738 unknown command 1074029381 [ 281.367309] binder: 16735:16738 ioctl c0306201 20000200 returned -22 07:11:07 executing program 2: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getsockopt$sock_buf(r0, 0x1, 0x3b, 0x0, &(0x7f0000000180)) [ 281.398171] binder: 16735:16738 ioctl ae60 0 returned -22 [ 281.505902] binder: 16744:16751 unknown command -1335401381 [ 281.523731] binder: 16744:16751 ioctl c0306201 20000200 returned -22 [ 281.580368] binder: BINDER_SET_CONTEXT_MGR already set [ 281.586002] binder: 16744:16758 ioctl 40046207 0 returned -16 07:11:10 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000100)="6653070000053c27bc33760036b9405cb4aed12f0000001500ae47a825d8680027805acf2c347fe8c3238ec1c12c4677ddbeaee3b99383fc2df644999fee76ff5d9d5743bad58e9af7a85022085286b7f1d09818edf248af164072d990264b8c4741bbee4a761093e2fae6e49342b149c87a39f876a83e8068d08b2c0adf3ac23d53b05d93c0a311e69cde42e1b77e92d7f5ee1a5ac17de511e072ffeb0828a76d3025ab5437d8b8c646c943bab2ed5d12b0a19e85b3379a753a2c1ce9651aaa218dca66a2062fea75ded3309473a4e06ea1fbfd6b14431e20c83ed605aa6876abee05aa24ef58622afb44bbb56026395c6b0e2b48491f1e7d600162776042c735a32b5e8391b6b709f04e9d0c626a2a140d7f669fa3ba15", 0x118}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x39) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 07:11:10 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$BATADV_CMD_GET_MESH(r1, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={0x0, 0x8}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="38000000100039af00"/20, @ANYRES32=0x0, @ANYBLOB="001500009b0000001800128008000100736974000c0034db888c4b6b", @ANYRES32=r2], 0x38}}, 0x0) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000000)={@private2, r2}, 0x14) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/nvram\x00', 0x60540, 0x0) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(r4, 0x8933, &(0x7f0000000280)={'wg0\x00', r2}) r6 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x19, 0x4, 0x20000000007ffd, 0x7c, 0x294, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100], r5, r3}, 0x40) r7 = socket$inet6(0xa, 0x2, 0x0) r8 = dup(r7) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r6, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096}, 0x20) 07:11:10 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, &(0x7f00000000c0)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) setsockopt$inet_MCAST_MSFILTER(r2, 0x0, 0x30, &(0x7f0000000380)={0x2, {{0x2, 0x0, @multicast2}}, 0x0, 0x4, [{{0x2, 0x0, @multicast1}}, {{0x2, 0x4e20, @empty}}, {}, {{0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}}]}, 0x290) 07:11:10 executing program 2: socketpair$unix(0x1, 0x1, 0x0, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x3b, 0x0, &(0x7f0000000180)) 07:11:10 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = dup3(r0, r1, 0x0) dup2(r3, r2) r4 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendto$inet(r4, &(0x7f0000fa3fff)='\t', 0x1, 0x0, &(0x7f00006f7000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000000080)={0x2, [0x0, 0x0]}, &(0x7f0000a8a000)=0xc) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r4, 0x84, 0x6c, &(0x7f000059aff8)={r5}, &(0x7f000034f000)=0x2059b000) setsockopt$inet_sctp6_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000a40)=@assoc_value={r5}, 0x8) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, &(0x7f0000000000)={r5, 0x49, "d4c8a3ee3ebdf99b8db28b898dc124ecb99d88c9e9d15be8cd5e80acc64ab382da571cf6bee4aa69452e7cf96cb20f7965de4fbd8b8ea8f26f5c82b04b7560c5dc21f22c531f25bb8a"}, &(0x7f00000000c0)=0x51) 07:11:10 executing program 3: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001b00)=[{&(0x7f00000005c0)=""/2, 0x2}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000040)='stack\x00') preadv(r0, &(0x7f00000017c0), 0x375, 0x0) 07:11:10 executing program 2: socketpair$unix(0x1, 0x1, 0x0, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x3b, 0x0, &(0x7f0000000180)) 07:11:10 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup2(r1, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = socket$inet6(0xa, 0x3, 0x7) connect$inet6(r4, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000340)={{{@in6=@private2, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@remote, 0x0, 0x33}, 0x0, @in, 0x0, 0x0, 0x0, 0x6}}, 0xe8) sendmmsg(r4, &(0x7f0000000480), 0x2e9, 0x0) 07:11:10 executing program 5: r0 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x4, 0x20000000007ffd, 0x7c, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100]}, 0x2c) r1 = socket$inet6(0xa, 0x7, 0x0) setsockopt$inet6_dccp_int(r1, 0x21, 0x1, &(0x7f0000000080)=0x4, 0x4) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r0, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096}, 0x20) 07:11:10 executing program 2: socketpair$unix(0x1, 0x1, 0x0, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x3b, 0x0, &(0x7f0000000180)) 07:11:10 executing program 3: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x69, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001b00)=[{&(0x7f00000005c0)=""/2, 0x2}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000040)='stack\x00') preadv(r0, &(0x7f00000017c0), 0x375, 0x0) 07:11:10 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x3b, 0x0, &(0x7f0000000180)) 07:11:13 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000100)="6653070000053c27bc33760036b9405cb4aed12f0000001500ae47a825d8680027805acf2c347fe8c3238ec1c12c4677ddbeaee3b99383fc2df644999fee76ff5d9d5743bad58e9af7a85022085286b7f1d09818edf248af164072d990264b8c4741bbee4a761093e2fae6e49342b149c87a39f876a83e8068d08b2c0adf3ac23d53b05d93c0a311e69cde42e1b77e92d7f5ee1a5ac17de511e072ffeb0828a76d3025ab5437d8b8c646c943bab2ed5d12b0a19e85b3379a753a2c1ce9651aaa218dca66a2062fea75ded3309473a4e06ea1fbfd6b14431e20c83ed605aa6876abee05aa24ef58622afb44bbb56026395c6b0e2b48491f1e7d600162776042c735a32b5e8391b6b709f04e9d0c626a2a140d7f669fa3ba15", 0x118}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x39) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 07:11:13 executing program 1: r0 = perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x8, 0xb, 0x56, 0x0, 0x0, 0x44, 0x49049, 0x4, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0xffff, 0x0, @perf_config_ext={0x20, 0x1}, 0x40808, 0x1, 0x1, 0x9, 0xff, 0x0, 0x1000}, 0x0, 0xffffffffffffffff, r0, 0x3) r4 = dup3(r1, r2, 0x0) dup2(r4, r3) 07:11:13 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x3b, 0x0, &(0x7f0000000180)) 07:11:13 executing program 3: symlink(&(0x7f0000000040)='./file0\x00', &(0x7f0000000140)='.\x00') 07:11:13 executing program 5: r0 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x4, 0x20000000007ffd, 0x7c, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100]}, 0x2c) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = dup(r1) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$BATADV_CMD_GET_MESH(r4, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={0x0, 0x8}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="a0d703119923f0fe0e3140474c1f686731b979321ebdd71915e2be00552a1e00a5ed7d423f764d0d2af1544c95e3c4839d76162684a49296d1f8e60588bd641a3e0dd2ec9ab7ef46362b4f469c1ae23709457711517e5ed0fb130036e4a5eb7b4046832c0292197ed3b9754e73b2f6cd353c0503bc37cf23d6afb771da2e3d8855fe6e5d2e4d98aa52692683485cfd5d40fc5b292666362a8c84d182783e0799ee374a13975eb60897571a0d5de6c27d8fc984dff729aeb6e507eb83fdcab2f2bdc778d655b72a88c4833193d0989856b2f1fce045350324cac0bcdfeff9cecfc44f25edf3abf6ad46d82cb4b144b981abfc143e3fd7d48029d6757fc263feb252fe7cfc91d8790dccc79f97f1d463891fbe38b818ef9e01766525db009698b440798ed09880ce3ad9f54de589b8b9cbe32c2b4b41dff8b9d6c51250931a9cac361cf2313616cb2c9f1fa252925be7b2b2f90383db2edc78c4e644413a61044b49249e05d34d24e5c16b30a7eb1ca1c56378eea1849282215bd3fab3bcba2ae581f8219a61be22dd0a639c0b4c33146f857a4faadfae496088a2d704136508991c2fdf73ca89b6783db557f45e1acebddec5", @ANYRES32=0x0, @ANYBLOB="001580009b0000001800128026000100736974000c00028008000100", @ANYRES32=r5], 0x38}}, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r3, 0x10e, 0x3, &(0x7f00000000c0)=0x4, 0x4) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000000)={@private2, r5}, 0x14) setsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f0000000080)={r5, @rand_addr=0x64010102, @broadcast}, 0xc) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r0, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096}, 0x20) 07:11:13 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup2(r1, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = socket$inet6(0xa, 0x3, 0x7) connect$inet6(r4, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000340)={{{@in6=@private2, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@remote, 0x0, 0x33}, 0x0, @in, 0x0, 0x0, 0x0, 0x6}}, 0xe8) sendmmsg(r4, &(0x7f0000000480), 0x2e9, 0x0) 07:11:13 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x3b, 0x0, &(0x7f0000000180)) 07:11:13 executing program 3: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$sock_inet_tcp_SIOCOUTQ(r1, 0x5411, &(0x7f0000000080)) 07:11:13 executing program 5: r0 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x4, 0x20000000007ffd, 0x7c, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100]}, 0x2c) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r0, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096}, 0x20) r3 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r5 = dup2(r4, r3) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$ION_IOC_ALLOC(r5, 0xc0184900, &(0x7f0000000080)={0x1, 0x20, 0x1}) 07:11:13 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x40000, 0x0) fsetxattr$trusted_overlay_redirect(r0, &(0x7f0000000040)='trusted.overlay.redirect\x00', &(0x7f00000000c0)='./file0\x00', 0x8, 0x1) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000180)='/dev/btrfs-control\x00', 0x10080, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f00000001c0)={0x0, 0x0, 0x10000, 0x5}) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000280)={&(0x7f0000ffd000/0x3000)=nil, 0x3000}, &(0x7f00000002c0)=0x10) ioctl$DRM_IOCTL_AGP_BIND(r1, 0x40106436, &(0x7f0000000200)={r2, 0xb1e}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) r6 = dup3(r3, r4, 0x0) ioctl$TUNSETVNETLE(r6, 0x400454dc, &(0x7f0000000240)=0x1) dup2(r6, r5) 07:11:13 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getsockopt$sock_buf(r0, 0x1, 0x0, 0x0, &(0x7f0000000180)) 07:11:13 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000140)="665f07000005eb3014203873bc33760036f300000000007dc0c6b18f7f8054617cbed5f8000400001500a9744708ad7fcabeae77cc6dd986a1b959f374cac3f1db9dd914b8863ca4f971ab241ebd3f2f35e5d324718f9d", 0x57}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 07:11:16 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000100)="6653070000053c27bc33760036b9405cb4aed12f0000001500ae47a825d8680027805acf2c347fe8c3238ec1c12c4677ddbeaee3b99383fc2df644999fee76ff5d9d5743bad58e9af7a85022085286b7f1d09818edf248af164072d990264b8c4741bbee4a761093e2fae6e49342b149c87a39f876a83e8068d08b2c0adf3ac23d53b05d93c0a311e69cde42e1b77e92d7f5ee1a5ac17de511e072ffeb0828a76d3025ab5437d8b8c646c943bab2ed5d12b0a19e85b3379a753a2c1ce9651aaa218dca66a2062fea75ded3309473a4e06ea1fbfd6b14431e20c83ed605aa6876abee05aa24ef58622afb44bbb56026395c6b0e2b48491f1e7d600162776042c735a32b5e8391b6b709f04e9d0c626a2a140d7f669fa3ba15", 0x118}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x39) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) 07:11:16 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getsockopt$sock_buf(r0, 0x1, 0x0, 0x0, &(0x7f0000000180)) 07:11:16 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r2 = dup3(r0, r0, 0x80000) getsockopt$inet_sctp_SCTP_RESET_STREAMS(r2, 0x84, 0x77, &(0x7f0000000000)={0x0, 0x0, 0xa, [0xd, 0x1ff, 0x9, 0x83a, 0x8, 0x800, 0x1, 0x1, 0x8001, 0x7]}, &(0x7f0000000040)=0x1c) r4 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r6 = dup2(r5, r4) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$SCSI_IOCTL_SYNC(0xffffffffffffffff, 0x4) ioctl$BINDER_SET_CONTEXT_MGR(r6, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$SNDRV_PCM_IOCTL_XRUN(r6, 0x4148, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r2, 0x84, 0x6, &(0x7f0000000180)={r3, @in={{0x2, 0x4e21, @remote}}}, &(0x7f00000000c0)=0x84) dup2(0xffffffffffffffff, r0) 07:11:16 executing program 5: bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x19, 0x4, 0x0, 0x8, 0x0, 0xffffffffffffffff, 0x1}, 0x40) syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000300)={0xffffffffffffffff, 0x81, &(0x7f00000001c0)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000200)={r0}, 0xc) r1 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000100)={r0, 0x0, 0x8}, 0xc) r2 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x4, 0x20000000007ffd, 0x79, 0x0, r1, 0x0, [0x0, 0x0, 0x0, 0x400100]}, 0x40) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r2, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096}, 0x20) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) close(r5) r6 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendto$inet(r6, &(0x7f0000fa3fff)='\t', 0x1, 0x0, &(0x7f00006f7000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000000280)=ANY=[@ANYBLOB="12179795a9bbf11606ecb057aab30635a21cef91a9ed2612db9efd192ff2c0ebf8e35b73d4cf07527783ab1cb689be442f5ef8ef95b11f45354c2956cb304909a206286006a79e", @ANYRES32=0x0, @ANYRES32=0x0], &(0x7f0000a8a000)=0xc) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r6, 0x84, 0x6c, &(0x7f000059aff8)={r7}, &(0x7f000034f000)=0x2059b000) setsockopt$inet_sctp_SCTP_RECVRCVINFO(r6, 0x84, 0x20, &(0x7f0000000140)=0x1, 0x4) setsockopt$inet_sctp6_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000a40)=@assoc_value={r7}, 0x8) setsockopt$inet_sctp6_SCTP_RTOINFO(r3, 0x84, 0x0, &(0x7f00000000c0)={r7, 0x10000, 0x7, 0x4}, 0x10) 07:11:16 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup2(r1, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = socket$inet6(0xa, 0x3, 0x7) connect$inet6(r4, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000340)={{{@in6=@private2, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@remote, 0x0, 0x33}, 0x0, @in, 0x0, 0x0, 0x0, 0x6}}, 0xe8) sendmmsg(r4, &(0x7f0000000480), 0x2e9, 0x0) 07:11:16 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getsockopt$sock_buf(r0, 0x1, 0x0, 0x0, &(0x7f0000000180)) 07:11:16 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getsockopt$sock_buf(r0, 0x1, 0x3b, 0x0, 0x0) [ 290.356534] binder_alloc: 16883: binder_alloc_buf, no vma [ 290.366394] binder: 16883:16890 ioctl 4148 0 returned -22 07:11:16 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) chdir(0x0) symlink(&(0x7f0000000140)='..', &(0x7f00000000c0)='./file0\x00') mount$fuseblk(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0) 07:11:16 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getsockopt$sock_buf(r0, 0x1, 0x3b, 0x0, 0x0) 07:11:16 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) r3 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x2, 0x2000) ioctl$EVIOCGLED(r3, 0x80404519, &(0x7f00000000c0)=""/58) write(r2, &(0x7f0000000180)="a0d1116fd49a5df758f84b562ede380f62d6b26c7f3cea864f21bbef730e847c972524280e56d0ffd0ae887841d78b9cc877fd4d791bc94de6afc8a81d924b02cca654570f5cc008ff42750540bfa90aea81ff02323f5ed45d9582fdcb90ebadc3177ba03f8e1a741ea7c758deb6ed31ad707ebb08f0f974023f170676019a15433123e87f0e6bac14b3", 0x8a) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r5 = dup3(r0, r1, 0x0) dup2(r5, r4) [ 290.433188] binder: BINDER_SET_CONTEXT_MGR already set [ 290.446536] binder: 16883:16901 ioctl 40046207 0 returned -16 [ 290.471716] binder: 16883:16890 ioctl 4148 0 returned -22 07:11:16 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getsockopt$sock_buf(r0, 0x1, 0x3b, 0x0, 0x0) 07:11:16 executing program 3: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) clone(0x2182001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) [ 291.638768] NOHZ: local_softirq_pending 08 07:11:19 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) mkdir(0x0, 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001081, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffffff, 0xc00c642e, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000000280)='./file0\x00', &(0x7f0000000080)='./file0\x00') socket$nl_sock_diag(0x10, 0x3, 0x4) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000080), 0xfff2) recvmmsg(0xffffffffffffffff, &(0x7f00000092c0)=[{{0x0, 0x0, &(0x7f0000008f40)=[{&(0x7f0000007dc0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) write$UHID_INPUT2(0xffffffffffffffff, &(0x7f0000000540)={0xc, {0x50, "6245c7fa6267a098b07d23492b7dd0bb3ef65e6b048b9191df3a09c8e2662322f46993dca1a6fe412479bda6da2fc54adb9d31116bbff0936c6196bcbf5a47a4768868d705f864b451ce7f63ef0f24ce"}}, 0x56) socket$nl_route(0x10, 0x3, 0x0) sendmsg$BATADV_CMD_GET_BLA_CLAIM(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) openat$pidfd(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/self\x00', 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="280000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="000400000000000008001b00000000003555a5e314ee5140a04ffc64bc517bb5152f0baab5f963835186d09b579d7f85edc46be204891220750da595af5264a99915151311fcb276b269"], 0x28}}, 0x0) 07:11:19 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) syz_mount_image$iso9660(&(0x7f0000000380)='iso9660\x00', &(0x7f00000003c0)='./bus\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={[{@uid={'uid'}}]}) 07:11:19 executing program 5: r0 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x4, 0x20000000007ffd, 0x7c, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100]}, 0x2c) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)={0x7, 0x4, 0x8, 0xf1a}, 0x2c) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r4, 0x28, &(0x7f0000000240)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000200)={r5}, 0xc) bpf$BPF_MAP_GET_NEXT_ID(0xc, &(0x7f00000001c0)={0x1, r5}, 0x8) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) r6 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r7 = dup2(r6, r3) ioctl$BINDER_SET_CONTEXT_MGR(r7, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="08630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) recvfrom$inet6(r7, &(0x7f0000000080)=""/218, 0xda, 0x0, &(0x7f0000000180)={0xa, 0x4e21, 0x8, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x8000}, 0x1c) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r0, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096}, 0x20) 07:11:19 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000140)="665f07000005eb3014203873bc33760036f300000000007dc0c6b18f7f8054617cbed5f8000400001500a9744708ad7fcabeae77cc6dd986a1b959f374cac3f1db9d", 0x42}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 07:11:19 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000000)={0x0, 0x0}) setitimer(0x0, &(0x7f0000000040)={{r1, r2/1000+10000}, {0x0, 0xea60}}, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r4 = dup2(r3, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000001300)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x18, &(0x7f00000000c0)=ANY=[@ANYBLOB="c52a74700000000000000000000000000000000000000000852a687300000000000000000000000000000000000000008561646600000000000000000000000000000000000000000300000000000000"], &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x0, 0x73b000, 0x0}) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) ioctl$VIDIOC_G_EXT_CTRLS(r4, 0xc0205647, &(0x7f0000000180)={0xf000000, 0x200, 0x9, r5, 0x0, &(0x7f00000000c0)={0x9f0901, 0x5, [], @string=0xffffffffffffffff}}) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00') sendmsg$NL80211_CMD_JOIN_MESH(r6, &(0x7f00000012c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000001280)={&(0x7f0000001780)=ANY=[@ANYBLOB="3c10c024b99e720000", @ANYRES16=r7, @ANYBLOB="20002cbd7000ffdbdf25440000001410700004000500041003002e5b9039e03d68f7947fe4a20fdf55a84981f4a924aad8e3e30cf9882b94e23efa24bdd5df486782276c8e3306d9fdcc5056f81f89e2a9fe98f3d73d6c5c5b7562eeda880a879f6c462836b8bb27755ab60ea00bfd9b0375763f210e07f4d02ae8f82c58733d497ff776bbd487d74ea4bd1b7a459167683fa4bd283fb8c61fb0ab41d717056de20c00000000163b51db41bcb3463fa32b2799fd7fd8a0436b6f77ee47d86567d978855cff4cca0c4a4f206c012e5b8d2d0ba5752710533ae68b7db9ef26ac681fe781cc48ec9e7a891fab0535800472cfccd581aa62fed82f0a5f8ffc848e845a69eb0ccd0403349835fc803b1c5a77c7c01a94174daf14d37fb1961d9ab0f53ff29d871212691de8299a1cabf369eee9f48ec42e519d0cd5f0dada31c4f493e44301d77421b5451d57a8de94531a86ceff3454c880b2f5efbf7f40dec7098e42cbbee6276d53c05322218ac8bd5ac907a13a969a522729db31536f759ed10fc13a642c3c09f352c37b5a602724fe3c7624db7aa8361e7a51d98132f0907ba4993e1b1037547ca998eea742529ef30d26b0784331530782425e1776125ad8e485dcecff7e962ede3032d2336e2e70b93c57e6e7f878343b32735d00eea85c608ce173d0398b7d5a67a8d196415b7c13d05e7a25bb06fac17dfcae1a4aaf3cca569af042e28e57d785a3754ee94734776fb76f34cd08d4c045618ff6a692d8b8cc892253fbcc71dc088d66a2d88b8d7fb89d77ba7c05283a6532f16b274cc6eb31ba2b8e19b79e5035e6949502f75d737d66e20f48da51d058c6df6853a1f3f2a6765febdfe9531c0556bce300773a989296c30d39625b2a64827db2c4a9fac2c09c211e38aa327dd224b348199a49aaf2a4465db5689ed690bda01736066c65bf9e9069adae101b46a1307a52797324a33131f24da4b1d81ffadc81ca5c2593796dd8affcec7a7dddf96cb78110f5db5afc1c0e0e868bff09192bfe8ce16cba3834cda2bc7f4f83e0f08fd846800fc4a0319e9c0ff2519d0a12e9a9ae46c95e1fd9562c74d1414b9dbfb96161895267f2f098701b83d1c346fd91bd274fae0ef0f4136e8198141e0f65cd9125021f05c472fe49644e065767864656c885f3ad67396ac0a71b80b159103826ec2bbe95b7063bd6f1188fcd5b9576911a917cb8dc6973b0134b0ee90554461b84ae18bab3c00a77398ffd269bb6edd97db16c798b2f1dd520a27f4453fe9e28a52d97e4b74e605070d5b6086dacffe40c0e2d2eedf47cbb7e6aadbb2e389b346b518d3a65f3f358ea60a4ffdbc6e10e415c08b6f061185960a16405fa4085a53f25262d35b4037302241555ae3168e256521fb615be28591701d84e7a637a53228a1ee3de14ae76d9dafaa05d61227f68c224a803bb41d6f18c9cea8bb2543b47a154ef0f981d877f7b5484aab435ccbc396ed844dfef1606496101f5183100ec9708eb65d6dc0ce6b6d346926d66bc398163ace7374338d5e2a96eff391c88b14498c30ce25f25c7a1dcfeae072b82d628f61530a7491e6449ef1471d1e360d84f08eb6f4b9e40b8e80b534b954bedad5d66e544d6140643aa6b05b40158c6650b31241702ea9adb49dce4764469c5746b19c89ee2dd7a070f26ecee024201dc6a81ab95d004c495cf3b05810ea1efd65e4433b1c5dfd2413d7ca95697a9e2857bf59b4cb46f51bbbbcbc88777f3494e3ae7e7c956d33b1d35a1e77a6179817da0fc125b5c1bddc1b5d8680b1b7bb0598ff0dd816f7d5c25e9f640428ddb75f9dce6c8da34ae8e7aa364bce568341f986d34ce5de7481a74faf8327d166cb6dcb115c8d460edfd9c91496a1a2117bde25851411f3379988c3639b3362145ac3c494603dd85d4532b267fb480e8e2cace7ba3b89d620fd4f708ed79bd68698d0c298fe806c81864a2350c3612038f0baf875df8df82ba1fd8cc061bb9182771efcd622a57421f79544a02d38bfa58214b58b8985e81c391b55bfb36f5ae6b56f13301d0cfdab8ce9296dd818164935c9358225e1508801810a4b9415ac729269dee19f7f3bb3c19623f64175f43712793f2f580ca6a8990f33aff1ec726a09877e61e9e352aa64410d43d0f947946868faaceea07d71799476e7006a1a74fe602e6ca56d074c867bdc9e8d107249b1cd20292d72af28e0e30dea85efd6a0d7344be9b6982605b4a3f894fa763e6f9c309fb682b86fdb904ff74dfc3cd95743a48003c3055ceaa527386d7961559a1ae6f61f149be1e5cc5dfc7110a67d424296c236bb250bbe98e4f4b8d972ef23425c77a02d3c7f6de1eae0337024f43047ba3b773c3cfbc8ea1d6ac13998820d561f252794a629a7af55bfeb8020ca7820a65e31cc47bbea68a339259a93e2131417ee749317818f91d1882ab4f5365c46cab9b4392a9b34939001bf804d6a6b4d78303d35dcd07c17fc3cd441819b709d632c5160c83b50465dad01f766331eb150490afbd8113a4ae5437c12b11d67b22f1115664ba0b9bad698274f11442962544461a7b1bb0470aa53a723e69b0062098c79ddf8b9a4349c9fba730d6f0b45bad2ca565c0569b7980e071ca08dd687663060ec387a1da7abad8ddeade4945cdca39debe9fd32bcf3b69c61924f0cf9a8a562acb7e6cadd6684384f6729bf4bc97a0f1c89a99d65d89487d0bad9ba910d7dc43d733b4f47baff76e52236700e6d4f5f993f748551bd70f5f4abacdcd12aa395657cf36eda51bdab339ebee725185099bb9278a929e93200b1712a8ae3d6b0dd050fa907d9b5324b8bd52e27073f30994231564d321060637b11dfe17a4a4e62e2b9fed8016cac6a1d01272d8542feb5d758d4647bac1d5071524ce87dd4806617f983ae2364431b84290a4330e7a136f6b6d3b23ab5123c4cfb93e6833145d3e0d3757c9a9490952d282dbd79a138d476849152b3784c81a6e5676892c41cccbdb8f679aac4ebdf006444f63f82132f1159b9f3b22e92ade7e922e2f48b4958fae33673be998233bcd3ebf0da19c1c2d54bd0c7adeb511a28161800f387b320a7328f6e315e7d9efe1f1a75fb30c4008c9d4edb9f4ef8fba3ce797a148e711254f62a19ac8a1afa675a45b7b3c749c8314762cfccd6d2de51a0e0f18de74f0bcec751019e2e920b73a0a46ce76b86de19846d8ae2b9f8a270800575d132b67cc63dfa405a9ce1a9fbfd2f35f0af71e3090c61ae2dc1483c8ad78957c3e384bb0d93434d17a4c1a7f4636561005c59238d9989157fab9ef800ba85410deaabda6191fb67523c749289a756e15ec37e8ba0c15f8d78d778d226c8a8bb2095f2a9aca1d4e7a0507a43f7da0428c8ebdf1894cee3315eee30fe901dcbf7154097797ab20364ca5a55d1cf3c12854738ece10ab5f7a71e0240b62a47e44e0a56839fcb9ef015643d95d42797215dbbd652097cbcac36f64f659a3f8be591dc2b91a038f6baf6773cccd7a99852d656c82c5cfc5238d70d53168c9ca6574f606929e67028024026411f22358b602ccb07f65b856854b6ea22b672c65d5b356a553fb44144d3a535e220ddd4a6f013e320825fac3ac34bfddb92e645a8d9f050a434d7500c7b4c0feb7c7bcb49ceae60148d405d763c6d2659a583291eee5937b1395e23269152daa1f72add3ee18c804e83fe1bb7df3d87b2afefb45998c12bad265145af9960ea153185d35de62e0e1f5bd9f281165083bda0fb9634b271fd5941e702186d16a5a209c527aa60fceeb6878e304e743e29dc8692cd6322a5b68d1cddc48022824baea76dde48056dff333b0a245ce1a38da0cf3cc98effc421d8930fb2733646fbd22e65fe74721513ef5aa309e2ea7d1509eaa4c0cc8b4751a011174022c5e7709f96c36078a73159323c0f3250efb02b876b37485d8c53b47e28ad9e04d6961567b1b491e0c346662e55bc51902062f43eddd49c4e2114925432e755c6446fd608c60a309b609dc79a6c761ec2cc3812e2c9ce2cac3b5c85bf104c07ae87ca9bc8652923cd7bc5c4ce9f42e290b1840cc35467aad2a4c2cf46cb5a2c15f829da695cabecd39f99609d803f6da75dc7223241cc6d6ca5aa1182da596d45ce3df54565956f0ba5c2ce467ccf708b2decb234aa0a8faceb7ee79a90e9103ba5c67aae6f004a244471692508cd9f240dab69b480ce2677032603f1dcd7abf94491f407f4c706cda7b8aff0f127cea5a495352cd0be73ca7b9765bb58c5651d57a4d77aebb9e0e341c2804e812bdd47c9e3e9b155c11b44b6a187ecd1f79e226653fdb15b82ce69bb482a0677a55a3a4bccd57b01e14077829f7207de9eb31c8697afb116777cff2477ecceb12f398ead51c2ec8552b087dad0f6e180ec9e2102f2893204ff598cc906548c0aa5b45c6571fd424b2b768f02d62af482e097b645f7763da1291eaae687e351966794ff61e6056d4f9244b6d3e03d9574e03bd8f35db29ebe1d063c0b15ceaec337cfa9b2f487aac88ea45d64dd8407a4afe611de089ea95f774961397bbd7b88bca0ef692d791a9e1369d2e5702e9f864e7d2884f7c09b4a641c1ca501455fcbdf68c259c84f94f38b0bc93fa501e1e7f3303bbc5a373ee1f858e4c76a5dfd399913d95b81815e0db92d0388f85f9d1c55ac0fda1582812f241910a2b5e4c2e6f6548fc5f3f4ccfe2511ce3ddd20cd063a18908137aef3d10065c29ca67edcbae8819d99aba19a65e743f8367617fde60141ff662df169bfe5cb57b9240322e0b33d8de12e79f4695d5ce5e08d748d29a8aa8af27ad9af06dd0c49c5690470a0d470b8293a2654024d773fcf88ec1638ec3de95f37eecb77703db5549b8a9a1b83a3080116307c6ceab9418890c4eefadad647744eccecd3fc5c101329ac134a874097a5eacbe3110a49fe23f8b278c5b4c299193386d5b68af6f96c461dbedee3f5caffb73a0267a7c0c1c6c6841fa9391536f04f1db53a6296a18c0dfb8eb1688e6e187e9ed14961954453bef4fee649c4b9afc63fe06e57dd6184f22d685aab79a9ab33ca135f55ab1c36b6a7b1aa92ff9911b9fbe98404e2c986ddde11e4d4efcd25b6647fb254dad15a0251d7a21ff5e94261268d5446ca85cac6c4a919b3491be34fdf472adb2a82094110e52a8ed5a3d1deefd57737c7083e1a83fc3283d2e657c7e5eb9047448ed94770e30f53f1075fd8eb4cdb7f3c9bb7ac47ad45626aeb3b2224642e280808864b8d1b76a9b4a5fa9a48457bc6678247ed1cdf84bf273bb9619108084a7b5ef64e1e2f03d24d868f1c186d1c2fb53086074a48e05aa4247f1ea0d6780b41cae999eb82af1abcf918b245f82f6de3cbd78575574768d2c82b87f9e643debffb8f1005903ea78a5c66b727fe5892d2dec0112a8dab87292de728e0ce03d82ac2e1a391a3b6c7d3fea16bdf14776b62501d8c06739103654961615eff748fce226e98cfb61525009c276cf556681b39924ba7ff8b70b5f9416ac3bf3446715a538e1a53e10eb5b3133165d0fe7b33ebdd47ee13f7db7f0e9ba7d69bde0a98f5f4d55ed78a365b14542df6cbc6ebf609e12558242bcb90f18ab2f16351241f777311df9a2dbe9761c1092c8bd459e98fb13c997e7dceb42795d4748eb192c8ac580fcc7a46782f4a29b6930097d5149440c80abecf03849a66b0b5601aba936f74b9622d83351e34036c6dea1846a5b096667433f7164212ce0d592eb2d2d8af6c6cac6460222db04716e864cdd29ffed3152b2350277f4f2047329a39089280f6c77299e0326e1042617dfe97590ad19708f05000200010000000c009900060000000300000008000c0008000000"], 0x103c}, 0x1, 0x0, 0x0, 0x20048080}, 0x4081) r8 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) r10 = dup3(r0, r8, 0x0) dup2(r10, r9) 07:11:19 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup2(r1, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = socket$inet6(0xa, 0x3, 0x7) connect$inet6(r4, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000340)={{{@in6=@private2, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@remote, 0x0, 0x33}, 0x0, @in, 0x0, 0x0, 0x0, 0x6}}, 0xe8) sendmmsg(r4, &(0x7f0000000480), 0x2e9, 0x0) 07:11:19 executing program 5: r0 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0xc24, 0x4, 0x7c, 0x206, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100], 0x0, 0xffffffffffffffff, 0x0, 0xffffffff}, 0x40) socket$inet6(0xa, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r0, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096}, 0x20) r1 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_WINDOW(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x68, r1, 0x800, 0x70bd2a, 0x25dfdbfe, {{}, {}, {0x4c, 0x18, {0x4, @media='ib\x00'}}}, ["", "", "", ""]}, 0x68}, 0x1, 0x0, 0x0, 0x1}, 0x20000000) [ 293.432693] ISOFS: Unable to identify CD-ROM format. 07:11:19 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd3, 0x0, 0x5a, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0xcb04}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = dup3(r0, r1, 0x0) dup2(r3, r2) 07:11:19 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) r3 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x4, 0x20000000007ffd, 0x7ff, 0x2a0, r2, 0x0, [0x0, 0x0, 0x0, 0x400100]}, 0x40) r4 = socket$inet6(0xa, 0x2, 0x0) dup(r4) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r3, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096}, 0x20) [ 293.631972] binder_alloc: 16968: binder_alloc_buf, no vma [ 293.665799] binder: BINDER_SET_CONTEXT_MGR already set [ 293.697272] binder: 16968:16971 ioctl 40046207 0 returned -16 07:11:20 executing program 1: r0 = gettid() tkill(r0, 0xb) ptrace$setopts(0x4206, r0, 0x0, 0x0) perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa1500, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x2, 0x164d}}, r0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x20000, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000040)=0x2, 0x4) r3 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) dup3(r1, r3, 0x0) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="2e00000011008108040f80ecdb4cb92e0a480e0a07000000e3bd6efb250009000e000d00400000ff050005001201", 0x2e}], 0x1}, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0)='l2tp\x00') r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r6, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f00000001c0)="b10dc3514321130078d41448086e5f2c54d45cad86f025bddfd4e100f22d9aff135156949e65f9f7354f8d0a6bf00001f8e34eb5fdaa1b3172519d14ea571d42f525a2cdbb0a2b05b6bc1f0f2f4960cdb83f03fb507aafd619a637656db3191c54ed6d3f3ad0eefdf43fcba0e95ed37853c950f02e359d655ab2fad325e3f43c5b4bda3f73ae6dec5ae4650180bb2d19e7d23ff7e2e94fdff6797d85bbb9e6c949417930", 0xa4}, {&(0x7f0000000280)="a6d5d0d4968d426f11b1167e46a84316146f6bca08465a065fa70058a794cc7e94e35c7c27edd424f725028618b65d4214edc51200398b5e218ea0408d561e94b595f355e2dabe5ed760f90629", 0x4d}], 0x2}, 0x40010) dup2(r5, r5) 07:11:20 executing program 5: r0 = bpf$MAP_CREATE(0xd00000000000000, &(0x7f0000000000)={0x6, 0x4, 0x20000000007ffd, 0x7c, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x400100]}, 0x2c) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$sock_ifreq(r1, 0x8935, &(0x7f0000000140)={'vxcan1\x00', @ifru_hwaddr=@multicast}) r3 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) r4 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r5 = dup2(r4, r3) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) write$FUSE_NOTIFY_INVAL_ENTRY(r5, &(0x7f0000000080)={0x31, 0x3, 0x0, {0x5, 0x10, 0x0, ':\\[:\'/+\\(@%-@,\xfb:'}}, 0x31) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r0, &(0x7f00000004c0), &(0x7f00000005c0)=""/4096}, 0x20) 07:11:20 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) dup3(r0, r1, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="eb62044018773e23913915180e5460d0360da578fb101a279417799fd94c2b06be22b3681db7b93161acbbb5cd7a7e9438360b0d83bb5d1adaadb4e7cc0e89fbcf038699d56cd598a94811db62bb6c18f07f382ecf30176d993dd27d709c50d37f947d4eab9a1e"], 0x0, 0x0, 0x0}) r4 = dup2(r3, r2) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r5 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)=ANY=[@ANYBLOB="852a74700000000000000000000000000000000000000000852a68730000000000000000000000000000000000000000856164660000000000000000000000423194d8b3d759ad000000000000000000"], &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) bpf$ITER_CREATE(0x21, &(0x7f0000000180)={r5}, 0x8) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) getsockopt$inet_sctp6_SCTP_HMAC_IDENT(r4, 0x84, 0x16, &(0x7f0000000000)={0x5, [0x101, 0x1, 0x3f, 0x20, 0x85]}, &(0x7f0000000040)=0xe) [ 293.842087] bridge0: port 2(bridge_slave_1) entered disabled state [ 293.852792] bridge0: port 1(bridge_slave_0) entered disabled state [ 293.943211] binder_alloc: 16984: binder_alloc_buf, no vma [ 294.010251] binder: 16989:16991 unknown command 1074029291 [ 294.033235] binder: 16989:16991 ioctl c0306201 20000200 returned -22 [ 294.192008] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 294.202892] batman_adv: batadv0: Interface deactivated: batadv_slave_1 07:11:20 executing program 4: socketpair$unix(0x1, 0x0, 0x0, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) mkdir(0x0, 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001081, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffffff, 0xc00c642e, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000000280)='./file0\x00', &(0x7f0000000080)='./file0\x00') socket$nl_sock_diag(0x10, 0x3, 0x4) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000080), 0xfff2) recvmmsg(0xffffffffffffffff, &(0x7f00000092c0)=[{{0x0, 0x0, &(0x7f0000008f40)=[{&(0x7f0000007dc0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) write$UHID_INPUT2(0xffffffffffffffff, &(0x7f0000000540)={0xc, {0x50, "6245c7fa6267a098b07d23492b7dd0bb3ef65e6b048b9191df3a09c8e2662322f46993dca1a6fe412479bda6da2fc54adb9d31116bbff0936c6196bcbf5a47a4768868d705f864b451ce7f63ef0f24ce"}}, 0x56) socket$nl_route(0x10, 0x3, 0x0) sendmsg$BATADV_CMD_GET_BLA_CLAIM(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) openat$pidfd(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/self\x00', 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="280000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="000400000000000008001b00000000003555a5e314ee5140a04ffc64bc517bb5152f0baab5f963835186d09b579d7f85edc46be204891220750da595af5264a99915151311fcb276b269"], 0x28}}, 0x0) 07:11:20 executing program 2: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000)='ramfs\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) chdir(&(0x7f00000002c0)='./file0\x00') symlink(&(0x7f0000000140)='..', &(0x7f00000000c0)='./file0\x00') mount$fuseblk(0x0, 0x0, 0x0, 0x0, 0x0) umount2(&(0x7f0000000040)='./file0/file0\x00', 0x2) 07:11:20 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = dup3(r0, r1, 0x0) dup2(r3, r2) 07:11:22 executing program 3: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f00000003c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x338, 0x178, 0xffffff80, 0x178, 0x178, 0xc7, 0x268, 0x258, 0x258, 0x268, 0x258, 0x3, 0x0, {[{{@uncond, 0x0, 0x130, 0x178, 0x0, {}, [@common=@unspec=@connmark={{0x30, 'connmark\x00'}}, @common=@inet=@hashlimit1={{0x58, 'hashlimit\x00'}, {'vlan0\x00'}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'syz0\x00'}}}, {{@uncond, 0x0, 0xa8, 0xf0}, @common=@unspec=@LED={0x48, 'LED\x00', 0x0, {'syz1\x00'}}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x398) 07:11:22 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup2(r1, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = socket$inet6(0xa, 0x3, 0x7) connect$inet6(r4, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendmmsg(r4, &(0x7f0000000480), 0x2e9, 0x0) 07:11:22 executing program 5: prctl$PR_SET_FP_MODE(0x2d, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x4e23, @multicast1}, 0x10) recvmmsg(0xffffffffffffffff, &(0x7f0000005540)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f4}}], 0x1, 0x100, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000b00)={0x14, 0x17, 0x101, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) ioctl$sock_bt_hci(0xffffffffffffffff, 0x400448cc, 0x0) 07:11:22 executing program 4: perf_event_open(&(0x7f0000000000)={0x1000000002, 0x70, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0x7, &(0x7f0000000040)={0x5, 0x8f}, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) 07:11:22 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x341080, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = dup3(r0, r1, 0x0) dup2(r3, r2) 07:11:22 executing program 2: r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x2, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0xa) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r5, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="4800000024000705000000000000000000001f00", @ANYRES32=r5, @ANYBLOB="00000400f1ffffff0000000008000100687462001c0002001800020003"], 0x48}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000340)=@delchain={0x68, 0x28, 0xf31, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x4}, {0x0, 0xffff}}, [@filter_kind_options=@f_cgroup={{0xb, 0x1, 'cgroup\x00'}, {0x38, 0x2, [@TCA_CGROUP_ACT={0x34, 0x1, [@m_mpls={0x30, 0x0, 0x0, 0x0, {{0x9, 0x1, 'mpls\x00'}, {0x4}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x68}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000180)=@newqdisc={0x24, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0x4, 0xffff}}}, 0x24}}, 0x0) 07:11:22 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000240)="665f07000005eb3014203873bc33760036f300000000007dc0c6b18f7f8054617cbed5f8000400001500a9744708ad7fcabeae77cc6dd986a1b959f374cac3f1db9dd914b8863ca4f971ab241ebd3f2f35e5d324718f9d24d3bf38fffa13959bbf7ca35df1043f6681f0582ca0ddca87af85c1a0a67968541f8f60de2d957635d9b97f696a2d53b12fd50ae531567de63cdfdac303d5192800b3e8f40d7634a8cdc445fafa7922c4911376b540c3c356e7d6fe822c61d6741db0973488404ddc23b7975901313b826092622a942f90160fb20f2eade913866d7a1c745a1b7560f3c146108cd8c22cb3ee4c1973e9da1d81cb034bf00571057e7261817e97135058f71a2f16d0bb", 0x107}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000080)={0x78, 0x0, 0x0, {0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x37b8}}}, 0x78) tkill(r0, 0x3c) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 07:11:22 executing program 4: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x46802) io_setup(0x1, &(0x7f0000000080)=0x0) r2 = open(&(0x7f0000000040)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000008000/0x600000)=nil, 0x600000, 0x800002, 0x11, r2, 0x0) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x0) fallocate(r3, 0x0, 0x0, 0x1000f4) r4 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_REFRESH(0xffffffffffffffff, 0x2402, 0x0) write$P9_RREMOVE(r4, &(0x7f0000000280)={0xfffffffffffffcd2}, 0xff7f) r5 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) fdatasync(r4) ioctl$EXT4_IOC_MOVE_EXT(r5, 0xc028660f, &(0x7f0000000480)={0x100000, r4, 0xa}) io_submit(r1, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 07:11:22 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x507880, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x40000, 0x0) write$P9_RSYMLINK(r2, &(0x7f0000000080)={0x14, 0x11, 0x1, {0x1, 0x2, 0x4}}, 0x14) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r4 = dup3(r0, r1, 0x0) dup2(r4, r3) [ 296.360528] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. [ 296.418747] cannot load conntrack support for proto=10 07:11:22 executing program 3: open_by_handle_at(0xffffffffffffff9c, &(0x7f0000000040)={0x9, 0x20000000001, '\v'}, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') lseek(r0, 0xfffffffffffffffd, 0x2) getdents64(r0, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x41, &(0x7f0000000000), 0x4) 07:11:22 executing program 2: r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000004180)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) openat(r3, &(0x7f0000000280)='./file1\x00', 0x400000, 0x2) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000080)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xfffffffffffff57a, 0x1, &(0x7f00000005c0)=[{&(0x7f00000000c0)="eb3c906d6b66732e66617400020401ed01000270fff8", 0x16}], 0x0, 0x0) r4 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0xf0) fchdir(r4) dup(0xffffffffffffffff) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, &(0x7f0000000140)=0x5) socket$packet(0x11, 0x3, 0x300) ioctl$FIDEDUPERANGE(0xffffffffffffffff, 0xc0189436, &(0x7f0000000240)=ANY=[@ANYBLOB, @ANYRES32, @ANYRESHEX, @ANYRES32]) r5 = open(&(0x7f0000000180)='./bus\x00', 0x14107e, 0x0) write$binfmt_aout(r5, &(0x7f0000000300)=ANY=[@ANYBLOB="42d12b1c0000008400"], 0x32) sendfile(r5, r5, &(0x7f00000001c0), 0x8080fffffffe) 07:11:22 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = dup3(r0, r1, 0x0) dup2(r3, r2) r4 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r6 = dup2(r5, r4) ioctl$BINDER_SET_CONTEXT_MGR(r6, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) accept$ax25(r6, &(0x7f0000000000)={{0x3, @null}, [@default, @rose, @default, @rose, @null, @bcast, @rose, @netrom]}, &(0x7f00000000c0)=0x48) [ 296.483762] HTB: quantum of class FFFF0004 is big. Consider r2q change. 07:11:22 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup2(r1, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = socket$inet6(0xa, 0x3, 0x7) connect$inet6(r4, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendmmsg(r4, &(0x7f0000000480), 0x2e9, 0x0) 07:11:22 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) syz_mount_image$iso9660(&(0x7f0000000380)='iso9660\x00', &(0x7f00000003c0)='./bus\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={[{@cruft='cruft'}]}) 07:11:22 executing program 3: open_by_handle_at(0xffffffffffffff9c, &(0x7f0000000040)={0x9, 0x20000000001, '\v'}, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') lseek(r0, 0xfffffffffffffffd, 0x2) getdents64(r0, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x41, &(0x7f0000000000), 0x4) [ 296.677317] binder_alloc: 17065: binder_alloc_buf, no vma [ 296.730083] binder: BINDER_SET_CONTEXT_MGR already set [ 296.735396] binder: 17065:17077 ioctl 40046207 0 returned -16 [ 296.767563] ================================================================== [ 296.775237] BUG: KASAN: use-after-free in __ext4_check_dir_entry+0x2f9/0x340 [ 296.782438] Read of size 2 at addr ffff88808b5a7001 by task syz-executor.3/17086 [ 296.789976] [ 296.790308] ISOFS: Unable to identify CD-ROM format. [ 296.791604] CPU: 0 PID: 17086 Comm: syz-executor.3 Not tainted 4.14.184-syzkaller #0 [ 296.791619] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 296.791624] Call Trace: [ 296.791643] dump_stack+0x1b2/0x283 [ 296.791658] ? __ext4_check_dir_entry+0x2f9/0x340 [ 296.825717] print_address_description.cold+0x54/0x1dc [ 296.831083] ? __ext4_check_dir_entry+0x2f9/0x340 [ 296.835910] kasan_report.cold+0xa9/0x2b9 [ 296.840056] __ext4_check_dir_entry+0x2f9/0x340 [ 296.844738] ext4_readdir+0x819/0x27e0 [ 296.848616] ? HARDIRQ_verbose+0x10/0x10 [ 296.852857] ? __ext4_check_dir_entry+0x340/0x340 [ 296.857726] ? lock_acquire+0x170/0x3f0 [ 296.861812] ? iterate_dir+0xbc/0x5e0 [ 296.865642] iterate_dir+0x1a0/0x5e0 [ 296.870167] SyS_getdents64+0x130/0x240 [ 296.874131] ? nsecs_to_jiffies+0x30/0x30 [ 296.878373] ? SyS_getdents+0x260/0x260 [ 296.882340] ? filldir+0x390/0x390 [ 296.885866] ? SyS_clock_settime+0x1a0/0x1a0 [ 296.890280] ? do_syscall_64+0x4c/0x640 [ 296.894256] ? SyS_getdents+0x260/0x260 [ 296.898230] do_syscall_64+0x1d5/0x640 [ 296.902123] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 296.907295] RIP: 0033:0x45ca59 [ 296.910467] RSP: 002b:00007f6582fcdc78 EFLAGS: 00000246 ORIG_RAX: 00000000000000d9 [ 296.918332] RAX: ffffffffffffffda RBX: 00000000004dd060 RCX: 000000000045ca59 [ 296.926029] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 [ 296.933280] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 296.940642] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff [ 296.947896] R13: 00000000000000f7 R14: 00000000004c3a09 R15: 00007f6582fce6d4 [ 296.955175] [ 296.956809] Allocated by task 16701: [ 296.960612] kasan_kmalloc.part.0+0x4f/0xd0 [ 296.965093] kmem_cache_alloc_trace+0x14d/0x3f0 [ 296.969758] proc_reg_open+0x6d/0x3a0 [ 296.973543] do_dentry_open+0x44b/0xec0 [ 296.977501] vfs_open+0x105/0x220 [ 296.980934] path_openat+0xb68/0x2aa0 [ 296.984748] do_filp_open+0x18e/0x250 [ 296.988536] do_sys_open+0x292/0x3e0 [ 296.992247] do_syscall_64+0x1d5/0x640 [ 296.996123] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 297.001296] [ 297.002903] Freed by task 16701: [ 297.006372] kasan_slab_free+0xaf/0x190 [ 297.010350] kfree+0xcb/0x260 [ 297.013445] close_pdeo+0x125/0x140 [ 297.017057] proc_reg_release+0xca/0x110 [ 297.021190] __fput+0x25f/0x7a0 [ 297.024476] task_work_run+0x113/0x190 [ 297.028349] exit_to_usermode_loop+0x1ad/0x200 [ 297.032929] do_syscall_64+0x4a3/0x640 [ 297.036821] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 297.042002] [ 297.043613] The buggy address belongs to the object at ffff88808b5a7000 [ 297.043613] which belongs to the cache kmalloc-64 of size 64 [ 297.056183] The buggy address is located 1 bytes inside of [ 297.056183] 64-byte region [ffff88808b5a7000, ffff88808b5a7040) [ 297.067843] The buggy address belongs to the page: [ 297.072756] page:ffffea00022d69c0 count:1 mapcount:0 mapping:ffff88808b5a7000 index:0x0 [ 297.080890] flags: 0xfffe0000000100(slab) [ 297.085032] raw: 00fffe0000000100 ffff88808b5a7000 0000000000000000 0000000100000020 [ 297.092894] raw: ffffea0002205020 ffffea00028544a0 ffff8880aa800340 0000000000000000 [ 297.100769] page dumped because: kasan: bad access detected [ 297.106469] [ 297.108074] Memory state around the buggy address: [ 297.113156] ffff88808b5a6f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 297.120511] ffff88808b5a6f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07:11:23 executing program 1: perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000200)={0x1, 0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) r4 = dup2(r3, r2) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000280)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000540)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0xffffffffffffffae, &(0x7f00000000c0)={@flat=@binder={0x70742a85}, @flat=@handle, @fda}, &(0x7f0000000080)={0x0, 0x18, 0x30}}}], 0x2, 0x73b000, 0x0}) ioctl$SIOCPNGETOBJECT(r4, 0x89e0, &(0x7f0000000000)=0x8) r5 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r6 = dup3(r0, r1, 0x0) dup2(r6, r5) [ 297.127941] >ffff88808b5a7000: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 297.135294] ^ [ 297.138644] ffff88808b5a7080: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 297.145983] ffff88808b5a7100: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 297.153357] ================================================================== [ 297.160706] Disabling lock debugging due to kernel taint 07:11:23 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) sendmsg$TIPC_NL_MEDIA_SET(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=ANY=[@ANYBLOB="fd0100060000000000a90c8dff9c"], 0x2}}, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 07:11:23 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup2(r1, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = socket$inet6(0xa, 0x3, 0x7) connect$inet6(r4, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendmmsg(r4, &(0x7f0000000480), 0x2e9, 0x0) [ 297.286564] binder_alloc: 17096: binder_alloc_buf, no vma [ 297.320205] binder: 17096:17099 ioctl 89e0 20000000 returned -22 [ 297.359381] FAT-fs (loop2): error, fat_get_cluster: invalid cluster chain (i_pos 970769) [ 297.380479] FAT-fs (loop2): Filesystem has been set read-only [ 297.396896] FAT-fs (loop2): error, fat_free: invalid cluster chain (i_pos 970769) [ 297.467159] binder: BINDER_SET_CONTEXT_MGR already set [ 297.497476] binder: 17096:17114 ioctl 40046207 0 returned -16 [ 297.519680] binder: 17096:17099 ioctl 89e0 20000000 returned -22 [ 297.605461] Kernel panic - not syncing: panic_on_warn set ... [ 297.605461] [ 297.612863] CPU: 1 PID: 17086 Comm: syz-executor.3 Tainted: G B 4.14.184-syzkaller #0 [ 297.621976] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 297.631452] Call Trace: [ 297.634029] dump_stack+0x1b2/0x283 [ 297.637654] panic+0x1f9/0x42d [ 297.641018] ? add_taint.cold+0x16/0x16 [ 297.645032] ? preempt_schedule_common+0x4a/0xc0 [ 297.649787] ? __ext4_check_dir_entry+0x2f9/0x340 [ 297.654998] ? ___preempt_schedule+0x16/0x18 [ 297.659442] ? __ext4_check_dir_entry+0x2f9/0x340 [ 297.664357] kasan_end_report+0x43/0x49 [ 297.668508] kasan_report.cold+0x12f/0x2b9 [ 297.673009] __ext4_check_dir_entry+0x2f9/0x340 [ 297.678283] ext4_readdir+0x819/0x27e0 [ 297.682205] ? HARDIRQ_verbose+0x10/0x10 [ 297.686532] ? __ext4_check_dir_entry+0x340/0x340 [ 297.691369] ? lock_acquire+0x170/0x3f0 [ 297.695468] ? iterate_dir+0xbc/0x5e0 [ 297.699258] iterate_dir+0x1a0/0x5e0 [ 297.703090] SyS_getdents64+0x130/0x240 [ 297.707201] ? nsecs_to_jiffies+0x30/0x30 [ 297.711336] ? SyS_getdents+0x260/0x260 [ 297.715298] ? filldir+0x390/0x390 [ 297.718844] ? SyS_clock_settime+0x1a0/0x1a0 [ 297.723246] ? do_syscall_64+0x4c/0x640 [ 297.727204] ? SyS_getdents+0x260/0x260 [ 297.731180] do_syscall_64+0x1d5/0x640 [ 297.735087] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 297.740316] RIP: 0033:0x45ca59 [ 297.743500] RSP: 002b:00007f6582fcdc78 EFLAGS: 00000246 ORIG_RAX: 00000000000000d9 [ 297.751204] RAX: ffffffffffffffda RBX: 00000000004dd060 RCX: 000000000045ca59 [ 297.758648] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 [ 297.765910] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 297.773171] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff [ 297.780561] R13: 00000000000000f7 R14: 00000000004c3a09 R15: 00007f6582fce6d4 [ 297.789384] Kernel Offset: disabled [ 297.793019] Rebooting in 86400 seconds..