, &(0x7f0000000880)=0xe8) lstat(&(0x7f00000008c0)='./file0\x00', &(0x7f0000000900)) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000980)) getuid() getgroups(0x6, &(0x7f00000009c0)=[0xee01, 0xee01, 0xee00, 0xee01, 0xee01, 0xee00]) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000a00)) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000a40)={{{@in=@local, @in=@local}}, {{@in=@multicast2}, 0x0, @in=@local}}, &(0x7f0000000b40)=0xe8) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) getpid() getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000e80)={{{@in6=@dev, @in6=@mcast2}}, {{@in6=@remote}, 0x0, @in6}}, &(0x7f0000000f80)=0xe8) getgid() ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f00000012c0)) getuid() getgroups(0xa, &(0x7f0000001300)=[0xee01, 0xee00, 0xee00, 0x0, 0x0, 0xee01, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xee00]) gettid() lstat(&(0x7f0000001340)='./file0\x00', &(0x7f0000001380)) getgid() 10:18:11 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0x2e40, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:11 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x5450, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:11 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000001c0)={'eql\x00', 0x803}) read(r1, &(0x7f0000000200)=""/228, 0xe4) socketpair$inet6_icmp_raw(0xa, 0x3, 0x3a, &(0x7f0000000000)) openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/attr/current\x00', 0x2, 0x0) ioctl$sock_ifreq(r0, 0x8914, &(0x7f00000000c0)={"65716c000000a95b00", @ifru_mtu=0x1}) 10:18:11 executing program 5: semop(0x0, &(0x7f0000000080), 0x13) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCNOTTY(r0, 0x5422) read(r0, &(0x7f0000000040)=""/11, 0xffffff3a) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x50200, 0x0) r2 = openat$mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/mixer\x00', 0x400000, 0x0) fanotify_mark(r1, 0x1, 0x2, r2, &(0x7f00000001c0)='./file0\x00') ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000240)={0x0}, &(0x7f0000000280)=0xc) ptrace$PTRACE_SECCOMP_GET_METADATA(0x420d, r3, 0x10, &(0x7f00000002c0)={0xfffffffffffffff8}) syz_open_pts(r0, 0x490000) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000140), &(0x7f0000000180)=0x8) ioctl$TIOCGETD(r0, 0x545d, &(0x7f0000000000)) 10:18:11 executing program 3: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) syz_mount_image$vfat(&(0x7f0000001800)='vfat\x00', &(0x7f0000001840)='./file0\x00', 0x0, 0xaaaaaaaaaaaab46, &(0x7f0000000440)=[{&(0x7f0000000380), 0xffffffffffffffb6}], 0x0, &(0x7f00000000c0)=ANY=[]) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000000100)={0x0, 0x0, 0x0, @thr={&(0x7f0000000180), &(0x7f0000000240)="a09a43"}}, &(0x7f0000000340)) ioctl$IOC_PR_REGISTER(r0, 0x401870c8, &(0x7f0000000380)={0x0, 0x9, 0x1}) lseek(r0, 0x0, 0x4) getsockopt$EBT_SO_GET_INIT_INFO(r0, 0x0, 0x82, &(0x7f0000000280)={'filter\x00'}, &(0x7f0000000200)=0x78) 10:18:11 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xa1e0, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 688.088124] binder_alloc: binder_alloc_mmap_handler: 23230 20001000-20004000 already mapped failed -16 [ 688.106101] binder: BINDER_SET_CONTEXT_MGR already set [ 688.116370] binder: 23230:23238 ioctl 40046207 0 returned -16 10:18:11 executing program 0: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) getpgid(0xffffffffffffffff) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000780)={{{@in=@local, @in=@local}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000880)=0xe8) lstat(&(0x7f00000008c0)='./file0\x00', &(0x7f0000000900)) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000980)) getuid() getgroups(0x6, &(0x7f00000009c0)=[0xee01, 0xee01, 0xee00, 0xee01, 0xee01, 0xee00]) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000a00)) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000a40)={{{@in=@local, @in=@local}}, {{@in=@multicast2}, 0x0, @in=@local}}, &(0x7f0000000b40)=0xe8) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) getpid() getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000e80)={{{@in6=@dev, @in6=@mcast2}}, {{@in6=@remote}, 0x0, @in6}}, &(0x7f0000000f80)=0xe8) getgid() ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f00000012c0)) getuid() getgroups(0xa, &(0x7f0000001300)=[0xee01, 0xee00, 0xee00, 0x0, 0x0, 0xee01, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xee00]) gettid() lstat(&(0x7f0000001340)='./file0\x00', &(0x7f0000001380)) 10:18:11 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0189436, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:11 executing program 0: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) getpgid(0xffffffffffffffff) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000780)={{{@in=@local, @in=@local}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000880)=0xe8) lstat(&(0x7f00000008c0)='./file0\x00', &(0x7f0000000900)) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000980)) getuid() getgroups(0x6, &(0x7f00000009c0)=[0xee01, 0xee01, 0xee00, 0xee01, 0xee01, 0xee00]) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000a00)) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000a40)={{{@in=@local, @in=@local}}, {{@in=@multicast2}, 0x0, @in=@local}}, &(0x7f0000000b40)=0xe8) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) getpid() getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000e80)={{{@in6=@dev, @in6=@mcast2}}, {{@in6=@remote}, 0x0, @in6}}, &(0x7f0000000f80)=0xe8) getgid() ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f00000012c0)) getuid() getgroups(0xa, &(0x7f0000001300)=[0xee01, 0xee00, 0xee00, 0x0, 0x0, 0xee01, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xee00]) gettid() 10:18:11 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xed08, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:11 executing program 0: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) getpgid(0xffffffffffffffff) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000780)={{{@in=@local, @in=@local}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000880)=0xe8) lstat(&(0x7f00000008c0)='./file0\x00', &(0x7f0000000900)) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000980)) getuid() getgroups(0x6, &(0x7f00000009c0)=[0xee01, 0xee01, 0xee00, 0xee01, 0xee01, 0xee00]) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000a00)) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000a40)={{{@in=@local, @in=@local}}, {{@in=@multicast2}, 0x0, @in=@local}}, &(0x7f0000000b40)=0xe8) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) getpid() getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000e80)={{{@in6=@dev, @in6=@mcast2}}, {{@in6=@remote}, 0x0, @in6}}, &(0x7f0000000f80)=0xe8) getgid() ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f00000012c0)) getuid() getgroups(0xa, &(0x7f0000001300)=[0xee01, 0xee00, 0xee00, 0x0, 0x0, 0xee01, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xee00]) 10:18:11 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xb90, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:11 executing program 0: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) getpgid(0xffffffffffffffff) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000780)={{{@in=@local, @in=@local}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000880)=0xe8) lstat(&(0x7f00000008c0)='./file0\x00', &(0x7f0000000900)) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000980)) getuid() getgroups(0x6, &(0x7f00000009c0)=[0xee01, 0xee01, 0xee00, 0xee01, 0xee01, 0xee00]) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000a00)) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000a40)={{{@in=@local, @in=@local}}, {{@in=@multicast2}, 0x0, @in=@local}}, &(0x7f0000000b40)=0xe8) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) getpid() getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000e80)={{{@in6=@dev, @in6=@mcast2}}, {{@in6=@remote}, 0x0, @in6}}, &(0x7f0000000f80)=0xe8) getgid() ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f00000012c0)) getuid() 10:18:11 executing program 0: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) getpgid(0xffffffffffffffff) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000780)={{{@in=@local, @in=@local}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000880)=0xe8) lstat(&(0x7f00000008c0)='./file0\x00', &(0x7f0000000900)) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000980)) getuid() getgroups(0x6, &(0x7f00000009c0)=[0xee01, 0xee01, 0xee00, 0xee01, 0xee01, 0xee00]) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000a00)) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000a40)={{{@in=@local, @in=@local}}, {{@in=@multicast2}, 0x0, @in=@local}}, &(0x7f0000000b40)=0xe8) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) getpid() getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000e80)={{{@in6=@dev, @in6=@mcast2}}, {{@in6=@remote}, 0x0, @in6}}, &(0x7f0000000f80)=0xe8) getgid() ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f00000012c0)) [ 688.729318] binder_alloc: binder_alloc_mmap_handler: 23256 20001000-20004000 already mapped failed -16 [ 688.741568] binder: BINDER_SET_CONTEXT_MGR already set [ 688.748215] binder: 23256:23259 ioctl 40046207 0 returned -16 10:18:11 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000001c0)={'eql\x00', 0x803}) read(r1, &(0x7f0000000300)=""/228, 0xfffffffffffffca3) ioctl$sock_ifreq(r0, 0x8914, &(0x7f00000000c0)={"65716c000000a95b00", @ifru_mtu=0x1}) 10:18:12 executing program 5: semop(0x0, &(0x7f0000000080), 0x13) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000040)=""/11, 0xffffff3a) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000140), &(0x7f0000000180)=0x8) fcntl$setstatus(r0, 0x4, 0x40000) ioctl$TIOCSSOFTCAR(r0, 0x541a, &(0x7f0000000000)=0x7) r1 = openat$vhci(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/vhci\x00', 0x8c040, 0x0) r2 = syz_genetlink_get_family_id$team(&(0x7f0000000280)='team\x00') getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000380)={{{@in=@dev, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@rand_addr}, 0x0, @in6=@mcast1}}, &(0x7f0000000480)=0xe8) accept$packet(0xffffffffffffffff, &(0x7f00000004c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000500)=0x14) getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f0000000540)={0x0, @remote, @rand_addr}, &(0x7f0000000580)=0xc) accept(0xffffffffffffff9c, &(0x7f00000005c0)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000640)=0x80) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f00000002c0)={0x0, @dev, @dev}, &(0x7f0000000300)=0xc) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000700)={{{@in6=@remote, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f0000000800)=0xe8) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1f, &(0x7f0000000840)={@dev, 0x0}, &(0x7f0000000880)=0x14) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000001c40)={{{@in6=@mcast1, @in6=@ipv4={[], [], @broadcast}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in6=@dev}}, &(0x7f0000001d40)=0xe8) getpeername$packet(0xffffffffffffff9c, &(0x7f0000002000)={0x11, 0x0, 0x0}, &(0x7f0000002040)=0x14) accept4$packet(0xffffffffffffffff, &(0x7f0000002080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000020c0)=0x14, 0x80000) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000002100)={'team0\x00', 0x0}) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000002180)={{{@in, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}}}, &(0x7f0000002280)=0xe8) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f00000022c0)={0x0, @local, @broadcast}, &(0x7f0000002300)=0xc) getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x24, &(0x7f0000002340)={@multicast1, @rand_addr, 0x0}, &(0x7f0000002380)=0xc) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000002440)={{{@in, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}}}, &(0x7f0000002540)=0xe8) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000002580)={{{@in6=@loopback, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in=@rand_addr}}, &(0x7f0000002680)=0xe8) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f00000026c0)={'vcan0\x00', 0x0}) accept4$packet(0xffffffffffffff9c, &(0x7f0000002700)={0x11, 0x0, 0x0}, &(0x7f0000002740)=0x14, 0x800) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000002780)={'veth0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000002880)={'vcan0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f0000002dc0)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000002d80)={&(0x7f00000028c0)={0x4b4, r2, 0x0, 0x70bd28, 0x25dfdbff, {}, [{{0x8, 0x1, r3}, {0x100, 0x2, [{0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r4}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x9}}, {0x8, 0x6, r5}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r6}}, {0x8}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r7}}, {0x8}}}]}}, {{0x8, 0x1, r8}, {0x80, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r9}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x3}}, {0x8, 0x6, r10}}}]}}, {{0x8, 0x1, r11}, {0x10c, 0x2, [{0x4c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0x1c, 0x4, 'hash_to_port_mapping\x00'}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x1d2ad3e7}}, {0x8, 0x6, r12}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r13}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0xfffffffffffffc00}}, {0x8, 0x6, r14}}}]}}, {{0x8, 0x1, r15}, {0xb0, 0x2, [{0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r16}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x100000000}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}, {{0x8, 0x1, r17}, {0x3c, 0x2, [{0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x5}}}]}}, {{0x8, 0x1, r18}, {0x78, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r19}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x1}}}]}}, {{0x8, 0x1, r20}, {0x78, 0x2, [{0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r21}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r22}}}]}}]}, 0x4b4}, 0x1, 0x0, 0x0, 0x4000}, 0x80) ioctl$TIOCGETD(r0, 0x545d, &(0x7f00000000c0)) 10:18:12 executing program 0: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) getpgid(0xffffffffffffffff) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000780)={{{@in=@local, @in=@local}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000880)=0xe8) lstat(&(0x7f00000008c0)='./file0\x00', &(0x7f0000000900)) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000980)) getuid() getgroups(0x6, &(0x7f00000009c0)=[0xee01, 0xee01, 0xee00, 0xee01, 0xee01, 0xee00]) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000a00)) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000a40)={{{@in=@local, @in=@local}}, {{@in=@multicast2}, 0x0, @in=@local}}, &(0x7f0000000b40)=0xe8) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) getpid() getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000e80)={{{@in6=@dev, @in6=@mcast2}}, {{@in6=@remote}, 0x0, @in6}}, &(0x7f0000000f80)=0xe8) getgid() 10:18:12 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0x6dd8, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:12 executing program 3: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) syz_mount_image$vfat(&(0x7f0000001800)='vfat\x00', &(0x7f0000001840)='./file0\x00', 0x0, 0xaaaaaaaaaaaab46, &(0x7f0000000440)=[{&(0x7f0000000380), 0xffffffffffffffb6}], 0x0, &(0x7f00000000c0)=ANY=[]) timer_create(0x7, &(0x7f00000001c0)={0x0, 0x33, 0x2, @thr={&(0x7f0000000040)="3a57cda23a8c330c1f0816508e330a556d4d83ad70d6ed1c553fe27283a512fa1a5586732825b6e115969d4378edd75f05396376911c7d62b12fc16ddcc6cb137047fabdc71028b2b6cbc54d17739570f1bcda61d52ce26ae81efc878d7a5ea1d5224eb03d134fea162bb54fb7d8149124150b4d019023ee52e4ab68413fa9fa20a565a278712fb81c8522b5511b4892f0601375a036bb5802d98a9d4c03865cd262c4a9f4380a9c89daa35c1ef2e40077df7bff4665fa09439fc46e4e1e2d421e487136475c01467e1e0585913ca221fc7d13d9889283", &(0x7f0000000140)="349a50c18490fbe7424f06873bdf2d2284357bb0a2eff496714ad6a7eb9933a9974e467c9d4645f48f3cdc6b08982a5b28796cdcc3f7512bff16c61e4a80eee8a3e229bb8cf49741fdff18d3b991ca57a0ae"}}, &(0x7f00000003c0)=0x0) timer_settime(r1, 0x1, &(0x7f0000000400)={{0x0, 0x1c9c380}}, &(0x7f0000000480)) r2 = add_key$user(&(0x7f00000004c0)='user\x00', &(0x7f0000000500)={'syz', 0x1}, &(0x7f0000000540)="f4fbdd7055bb55ac0786013fb93900b208749f7edcb5", 0x16, 0xfffffffffffffffb) r3 = add_key(&(0x7f0000000580)='keyring\x00', &(0x7f00000005c0)={'syz', 0x0}, &(0x7f0000000600)="16b80e29a039bcb99b87462e", 0xc, 0xfffffffffffffff9) keyctl$unlink(0x9, r2, r3) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_init_net_socket$llc(0x1a, 0x1, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x0, 0x0, @thr={&(0x7f0000000180), &(0x7f0000000240)="a09a43"}}, &(0x7f0000000340)) ioctl$IOC_PR_REGISTER(r0, 0x401870c8, &(0x7f0000000380)={0x0, 0x9, 0x1}) lseek(r0, 0x0, 0x4) getsockopt$EBT_SO_GET_INIT_INFO(r0, 0x0, 0x82, &(0x7f0000000280)={'filter\x00'}, &(0x7f0000000200)=0x78) 10:18:12 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40049409, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:12 executing program 0: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) getpgid(0xffffffffffffffff) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000780)={{{@in=@local, @in=@local}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000880)=0xe8) lstat(&(0x7f00000008c0)='./file0\x00', &(0x7f0000000900)) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000980)) getuid() getgroups(0x6, &(0x7f00000009c0)=[0xee01, 0xee01, 0xee00, 0xee01, 0xee01, 0xee00]) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000a00)) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000a40)={{{@in=@local, @in=@local}}, {{@in=@multicast2}, 0x0, @in=@local}}, &(0x7f0000000b40)=0xe8) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) getpid() getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000e80)={{{@in6=@dev, @in6=@mcast2}}, {{@in6=@remote}, 0x0, @in6}}, &(0x7f0000000f80)=0xe8) 10:18:12 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0x2001006b, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 689.093204] binder_alloc: binder_alloc_mmap_handler: 23296 20001000-20004000 already mapped failed -16 10:18:12 executing program 4: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xc490, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 689.157103] binder: BINDER_SET_CONTEXT_MGR already set 10:18:12 executing program 0: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) getpgid(0xffffffffffffffff) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000780)={{{@in=@local, @in=@local}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000880)=0xe8) lstat(&(0x7f00000008c0)='./file0\x00', &(0x7f0000000900)) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000980)) getuid() getgroups(0x6, &(0x7f00000009c0)=[0xee01, 0xee01, 0xee00, 0xee01, 0xee01, 0xee00]) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000a00)) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000a40)={{{@in=@local, @in=@local}}, {{@in=@multicast2}, 0x0, @in=@local}}, &(0x7f0000000b40)=0xe8) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) getpid() 10:18:12 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0x22b0, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 689.178294] binder: 23296:23303 ioctl 40046207 0 returned -16 10:18:12 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620b, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:12 executing program 4 (fault-call:5 fault-nth:0): openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getdents64(r0, &(0x7f0000000100)=""/111, 0x18) getdents(r0, &(0x7f0000000380)=""/246, 0xffffffff00000018) [ 689.350208] binder: BINDER_SET_CONTEXT_MGR already set [ 689.378910] binder: 23326:23330 ioctl 40046207 0 returned -16 10:18:13 executing program 5: semop(0x0, &(0x7f0000000080), 0x13) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000040)=""/11, 0xffffff3a) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x4000, 0x0) clock_gettime(0x7, &(0x7f0000000340)) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r1, 0x40045542, &(0x7f00000001c0)=0x1bf48a78) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000140), &(0x7f0000000180)=0x8) ioctl$TIOCGETD(r0, 0x545d, &(0x7f0000000000)) r2 = request_key(&(0x7f00000000c0)='encrypted\x00', &(0x7f0000000240)={'syz', 0x0}, &(0x7f0000000280)='/dev/ptmx\x00', 0xfffffffffffffffb) keyctl$restrict_keyring(0x1d, r2, &(0x7f00000002c0)='id_resolver\x00', &(0x7f0000000300)='/dev/ptmx\x00') 10:18:13 executing program 0: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) getpgid(0xffffffffffffffff) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000780)={{{@in=@local, @in=@local}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000880)=0xe8) lstat(&(0x7f00000008c0)='./file0\x00', &(0x7f0000000900)) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000980)) getuid() getgroups(0x6, &(0x7f00000009c0)=[0xee01, 0xee01, 0xee00, 0xee01, 0xee01, 0xee00]) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000a00)) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000a40)={{{@in=@local, @in=@local}}, {{@in=@multicast2}, 0x0, @in=@local}}, &(0x7f0000000b40)=0xe8) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) 10:18:13 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xb338, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:13 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getdents64(r0, &(0x7f0000000100)=""/111, 0x18) getdents(r0, &(0x7f0000000380)=""/246, 0xffffffff00000018) 10:18:13 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x5460, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:13 executing program 3: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) syz_mount_image$vfat(&(0x7f0000001800)='vfat\x00', &(0x7f0000001840)='./file0\x00', 0x0, 0xaaaaaaaaaaaab46, &(0x7f0000000440)=[{&(0x7f0000000380), 0xffffffffffffffb6}], 0x0, &(0x7f00000000c0)=ANY=[]) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x103080, 0x0) timer_create(0x0, &(0x7f0000000100)={0x0, 0x0, 0x0, @thr={&(0x7f0000000180), &(0x7f0000000240)="a09a43"}}, &(0x7f0000000340)) ioctl$IOC_PR_REGISTER(r0, 0x401870c8, &(0x7f0000000380)={0x0, 0x9, 0x1}) lseek(r0, 0x0, 0x4) getsockopt$EBT_SO_GET_INIT_INFO(r0, 0x0, 0x82, &(0x7f0000000280)={'filter\x00'}, &(0x7f0000000200)=0x78) [ 689.942262] binder: BINDER_SET_CONTEXT_MGR already set 10:18:13 executing program 0: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) getpgid(0xffffffffffffffff) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000780)={{{@in=@local, @in=@local}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000880)=0xe8) lstat(&(0x7f00000008c0)='./file0\x00', &(0x7f0000000900)) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000980)) getuid() getgroups(0x6, &(0x7f00000009c0)=[0xee01, 0xee01, 0xee00, 0xee01, 0xee01, 0xee00]) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000a00)) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) [ 689.973975] binder: 23350:23354 ioctl 40046207 0 returned -16 10:18:13 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0x84f8, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:13 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0046209, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:13 executing program 0: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) getpgid(0xffffffffffffffff) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000780)={{{@in=@local, @in=@local}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000880)=0xe8) lstat(&(0x7f00000008c0)='./file0\x00', &(0x7f0000000900)) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000980)) getuid() getgroups(0x6, &(0x7f00000009c0)=[0xee01, 0xee01, 0xee00, 0xee01, 0xee01, 0xee00]) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) [ 690.129369] binder_alloc_mmap_handler: 2 callbacks suppressed [ 690.129388] binder_alloc: binder_alloc_mmap_handler: 23372 20001000-20004000 already mapped failed -16 10:18:13 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0x1ce8, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:13 executing program 0: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) getpgid(0xffffffffffffffff) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000780)={{{@in=@local, @in=@local}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000880)=0xe8) lstat(&(0x7f00000008c0)='./file0\x00', &(0x7f0000000900)) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000980)) getuid() getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) [ 690.234506] binder: BINDER_SET_CONTEXT_MGR already set [ 690.251764] binder: 23372:23373 ioctl 40046207 0 returned -16 10:18:14 executing program 5: semop(0x0, &(0x7f0000000080), 0x13) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000040)=""/11, 0xffffff3a) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000140), &(0x7f0000000180)=0x8) ioctl$TIOCGETD(r0, 0x545d, &(0x7f0000000000)) r1 = dup3(r0, r0, 0x80000) ioctl$VHOST_SET_VRING_ENDIAN(r1, 0x4008af13, &(0x7f0000000080)={0x3}) 10:18:14 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc020660b, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:14 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xa7a8, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:14 executing program 0: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) getpgid(0xffffffffffffffff) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000780)={{{@in=@local, @in=@local}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000880)=0xe8) lstat(&(0x7f00000008c0)='./file0\x00', &(0x7f0000000900)) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000980)) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) 10:18:14 executing program 3: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) close(r1) syz_mount_image$vfat(&(0x7f0000001800)='vfat\x00', &(0x7f0000001840)='./file0\x00', 0x0, 0xaaaaaaaaaaaab46, &(0x7f0000000440)=[{&(0x7f0000000380), 0xffffffffffffffb6}], 0x0, &(0x7f00000000c0)=ANY=[]) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000000100)={0x0, 0x0, 0x0, @thr={&(0x7f0000000180), &(0x7f0000000240)="a09a43"}}, &(0x7f0000000340)) ioctl$IOC_PR_REGISTER(r1, 0x401870c8, &(0x7f0000000380)={0x0, 0x9, 0x1}) lseek(r1, 0x0, 0x4) getsockopt$EBT_SO_GET_INIT_INFO(r1, 0x0, 0x82, &(0x7f0000000280)={'filter\x00'}, &(0x7f0000000200)=0x78) ioctl$EVIOCREVOKE(r0, 0x40044591, &(0x7f0000000000)=0x9) ioctl$TIOCCONS(r1, 0x541d) 10:18:14 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getdents64(r0, &(0x7f0000000100)=""/111, 0x18) getdents(r0, &(0x7f0000000380)=""/246, 0xffffffff20000398) 10:18:14 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xfe60, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:14 executing program 0: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) getpgid(0xffffffffffffffff) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000780)={{{@in=@local, @in=@local}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000880)=0xe8) lstat(&(0x7f00000008c0)='./file0\x00', &(0x7f0000000900)) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) [ 690.903806] binder_alloc: binder_alloc_mmap_handler: 23404 20001000-20004000 already mapped failed -16 [ 690.961782] binder: BINDER_SET_CONTEXT_MGR already set 10:18:14 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xdbb0, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 690.993541] binder: 23404:23405 ioctl 40046207 0 returned -16 10:18:14 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x2, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:14 executing program 0: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) getpgid(0xffffffffffffffff) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000780)={{{@in=@local, @in=@local}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000880)=0xe8) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) 10:18:14 executing program 0: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) getpgid(0xffffffffffffffff) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) [ 691.150578] binder_alloc: binder_alloc_mmap_handler: 23431 20001000-20004000 already mapped failed -16 [ 691.185564] binder: BINDER_SET_CONTEXT_MGR already set [ 691.203114] binder: 23431:23433 ioctl 40046207 0 returned -16 10:18:14 executing program 5: semop(0x0, &(0x7f0000000080), 0x13) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) r1 = semget(0x3, 0x1, 0x1) semop(r1, &(0x7f0000000000)=[{0x3, 0x9, 0x800}, {0x6, 0x800, 0x800}, {0x3, 0x6, 0x800}, {0x2, 0x7f, 0x1800}, {0x4, 0x2, 0x1000}, {0x2, 0xba}], 0x6) ioctl$VHOST_SET_VRING_BUSYLOOP_TIMEOUT(r0, 0x4008af23, &(0x7f0000000080)={0x3, 0x100000000}) read(r0, &(0x7f0000000040)=""/11, 0x10000015a) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000140), &(0x7f0000000180)=0x8) r2 = syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x0, 0x201) ioctl$KVM_SET_PIT2(r2, 0x4070aea0, &(0x7f0000000240)={[{0x5, 0x20, 0x4, 0x6, 0x1, 0x24f3, 0xff, 0x20, 0x7fffffff, 0x2, 0x3, 0x6, 0x9c9d}, {0xc34, 0x7, 0x5, 0x4, 0x1, 0xffffffffffffffc9, 0xc8d6, 0x4, 0x8, 0x6, 0x100, 0x29, 0x44db}, {0x3, 0x6, 0xfffffffffffffe00, 0x8, 0x79, 0xffff, 0x9, 0x4000000000000000, 0x10000, 0x100000001, 0x8, 0x5, 0x6be}], 0x1}) ioctl$TIOCGETD(r0, 0x545d, &(0x7f00000000c0)) 10:18:14 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xf2d0, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:14 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306209, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:14 executing program 0: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) 10:18:14 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getdents64(r1, &(0x7f0000000100)=""/111, 0x18) getdents(r1, &(0x7f0000000380)=""/246, 0xffffffff00000018) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000040)={0x0, 0x10000}, &(0x7f0000000080)=0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f00000000c0)={r2, 0x3}, 0x8) 10:18:14 executing program 3: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) close(r1) sendto$inet(r1, &(0x7f0000000000)="804c774a1fa8b472f003a30158cdb9098fd015819e9d1fcd6ecb8626d8f3d49f7654bbc08191476603e542e8c10d65461682193eae72daa5e3efca6a28f8a8b82e87107c74c36cfd95ba0b952786835f794b8c9b32f5dbd9caea51e643553e12244b53ede7a2947c1629330b6a46792e9f451d9c6ee95cf522f57a04dd2d58bd92b90e3b93dd8ecaae152b0a723a1f4db55a17c1096b26f29762f2eca7c33f6113f6eca4aaac2c6bc5fc33b1af2597a1d8da1c78f526b7a561dae40bc770fc5a0026772a5a30ca435f8577d5872a3ac026c2574b8278ee30f4fa534a570076232705d7", 0xe3, 0x80, &(0x7f0000000140)={0x2, 0x4e23, @local}, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000000100)={0x0, 0x0, 0x0, @thr={&(0x7f0000000180), &(0x7f0000000240)="a09a43"}}, &(0x7f0000000340)) ioctl$IOC_PR_REGISTER(r1, 0x401870c8, &(0x7f0000000380)={0x0, 0x9, 0x1}) lseek(r0, 0x0, 0x2) syz_open_pts(r0, 0x40) getsockopt$EBT_SO_GET_INIT_INFO(r1, 0x0, 0x82, &(0x7f0000000280)={'filter\x00'}, &(0x7f0000000200)=0x78) 10:18:15 executing program 0: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) 10:18:15 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0x1158, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 691.852101] binder: 23455:23463 ioctl c0306209 20000440 returned -22 [ 691.888729] binder_alloc: binder_alloc_mmap_handler: 23455 20001000-20004000 already mapped failed -16 [ 691.918859] binder: BINDER_SET_CONTEXT_MGR already set [ 691.925576] binder: 23455:23472 ioctl c0306209 20000440 returned -22 [ 691.937008] binder: 23455:23469 ioctl 40046207 0 returned -16 10:18:15 executing program 3: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) close(r1) syz_mount_image$vfat(&(0x7f0000001800)='vfat\x00', &(0x7f0000001840)='./file0\x00', 0x0, 0xaaaaaaaaaaaab46, &(0x7f0000000440)=[{&(0x7f0000000380), 0xffffffffffffffb6}], 0x0, &(0x7f00000000c0)=ANY=[]) setxattr$trusted_overlay_nlink(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='trusted.overlay.nlink\x00', &(0x7f0000000080)={'L-', 0xfffffffffffff560}, 0x28, 0x2) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(&(0x7f0000000400)='./file0\x00', &(0x7f0000000500)='trusted.overlay.nlink\x00', &(0x7f00000004c0)={'L+', 0x7fc}, 0x138, 0x1) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(r1, 0x84, 0x1b, &(0x7f0000000140)={0x0, 0x75, "1a6f651f761d3f54f42b2996ac7f82882db59da123818ab1690a9a5311bfb2c1bb53f7be7e4dd2916b5d674e265147002d688483784c041d6589958a2bd14a4f1d06127a4400f20de59cdb6ee28ff8b6e0cd86ee7c55564057645ef105b5e21bdff322539a020ec99040e515cbeecf640b254394ec"}, &(0x7f00000000c0)=0x50) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f00000001c0)={r3, 0x9}, &(0x7f00000003c0)=0x8) timer_create(0x0, &(0x7f0000000100)={0x0, 0x0, 0x0, @thr={&(0x7f0000000180), &(0x7f0000000240)="a09a43"}}, &(0x7f0000000340)) ioctl$IOC_PR_REGISTER(r1, 0x401870c8, &(0x7f0000000380)={0x0, 0x9, 0x1}) lseek(r2, 0x0, 0x4) getsockopt$EBT_SO_GET_INIT_INFO(r1, 0x0, 0x82, &(0x7f0000000280)={'filter\x00'}, &(0x7f0000000200)=0x78) 10:18:15 executing program 0: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) 10:18:15 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xe740, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:15 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40046208, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) [ 692.151143] binder_alloc: binder_alloc_mmap_handler: 23488 20001000-20004000 already mapped failed -16 [ 692.188527] binder: BINDER_SET_CONTEXT_MGR already set [ 692.205312] binder: 23488:23490 ioctl 40046207 0 returned -16 10:18:15 executing program 5: socketpair(0x1d, 0x0, 0x5, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f00000000c0)=0xfffffffffffffff9, 0x4) r1 = semget(0x0, 0x3, 0x20) semop(r1, &(0x7f00000001c0)=[{0x6, 0x200, 0x800}, {0x3, 0xfa8, 0x1800}, {0x3, 0x7, 0x800}], 0x3) semop(0x0, &(0x7f0000000080), 0x13) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) read(r2, &(0x7f0000000040)=""/11, 0xffffff3a) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000100)) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000140), &(0x7f0000000180)=0x8) ioctl$TIOCGETD(r2, 0x545d, &(0x7f0000000000)) 10:18:15 executing program 0: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) 10:18:15 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0x6248, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:15 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306261, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:15 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) preadv(r0, &(0x7f0000000080)=[{&(0x7f0000000180)=""/211, 0xd3}, {&(0x7f0000000040)=""/60, 0x3c}], 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f00000004c0)={0x0, 0x1, &(0x7f00000000c0)=""/57, &(0x7f0000000280)=""/242, &(0x7f0000000480)=""/16, 0x4002}) getdents64(r1, &(0x7f0000000100)=""/111, 0x18) ioctl$FICLONE(r1, 0x40049409, r1) getdents(r1, &(0x7f0000000380)=""/246, 0xffffffff00000018) 10:18:15 executing program 3: r0 = fcntl$getown(0xffffffffffffff9c, 0x9) tkill(r0, 0x3e) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) close(r2) syz_mount_image$vfat(&(0x7f0000001800)='vfat\x00', &(0x7f0000001840)='./file0\x00', 0x0, 0xaaaaaaaaaaaab46, &(0x7f0000000440)=[{&(0x7f0000000380), 0xffffffffffffffb6}], 0x0, &(0x7f00000000c0)=ANY=[]) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000016c0)={{{@in=@dev, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in6=@mcast2}}, &(0x7f00000017c0)=0xe8) getresuid(&(0x7f0000001880), &(0x7f00000018c0), &(0x7f0000001900)=0x0) getsockopt$inet_sctp6_SCTP_PR_STREAM_STATUS(r1, 0x84, 0x74, &(0x7f0000001a00)=""/4096, &(0x7f0000002a00)=0x1000) syz_mount_image$jfs(&(0x7f0000000000)='jfs\x00', &(0x7f0000000040)='./file0\x00', 0x5, 0x7, &(0x7f0000001600)=[{&(0x7f0000000480)="7d4702df2454808dff5e5e936f9bf719d41bb03626e67772ddd66c0c65adee28899f381bc374067f6f8cdbaa924017333bd9bdc2291667a16acb8537a8c0fe37a70a1df83b22a437780bf697f13920cf5752ca529fcee67113538ecea2bb85560355b2f82343f2a588ce00c0749f2d02de532477bac445139c70969405b2310942e0d01f0a1488ac51dbab7f828dfd3e7acfd783f7eb8f84bcdf78cf69c2954a7d56836ace46e257e3b0520cae9b30606192fa7bcc854096d3055fad05bf70728fdacf5725f8c284cd5e4ec4976782a27482040479313abfbfc30d3eee109ce11a39b52b73b77a69e94fad8443069b07077deb5795651369e39eff5a09cf32b37325b1739eace67477da2ecfc1061a05a902bfd7674f8e40b3c2b5a915e78a270ecf6efa8d265c9b99e3ae648b9a0989afe4ce298ff7edf1d6def34a7a84f1a88a6b4910241816d6d494f62d6ce4d517f6f0654b2e439567a28cdb2dfc63166f920adafe50dfdfef81295e837d63ddda9f23c4271392a8111ba60e54b49fc9c4af5ed5ada57061e7361efb47fd0f4d851b029392da5e0b472b9ead3ceae0f44b65cb16d8b05f6f12fd09e49635f3581f764ea1d288d4595d9ce3a35ff14a779e42f08ab15b990b2f13285b9f056a1e627745bdea36181a161fd06c1755d84c976e6252680f9e75ceacf3fadbf85fc207129ec4a7d0b876e0680916a620275103ce77df2b1ffd99d4abf535d56d863c1808c56d7cdd65e78bb401dfb7c299cc86dea309b5f2d959f73630a6591e046a61eb4d9b623595fcb55c7a7d07d327dc8a4255ca0ea65702b1d4b7f29cc588963c75f34284fa3e90cb8d78fbcc7d2f2e525ff9d0899faed094c5001f4ac9f47dea8b424000e5c752bcc6ed35c4306c8b6779d83e879c1912179df750a095ccd3049d6c21ffc40c11ccb3bc55a308fb46f49038fbcfb47f95845221369e750baf4c9d301eb6a697d082658bd78651ba4a5c752847c4167a7ae22b9ca417ff1f4d56f267684575a1ada8a0a9bc6051377360424764c7febfc56bf1ca4fefa45217c66646e649549e2332ad24c2649d8daa3f5e960892edb30f5a90ba15c5415187b296c9f2acb15f946dd90aa23b95def8ccf3d71c9274a0e9b5e902c6771e453b4109e2a783e72c9918ba436f9469bae5849aa0790e1ab0ffe6040affc00e6f2fe3072ead5f73bac1e64fd411fc6cf73b09622667e030e1b208a6bb47bdd29734d8551ed137d82eef84577baa3532531b8bb9fa3dce264162eca07451c15e3af53b4b4802cd7f890be8f69142cb2486745e6fe67c4618dbe3e560aae9c288dd133de4f583291249e637102e4f33018c7a4156772f6e96868751acc40e55e92f94e97f39505a57be8c968839f058b7c9e3fcb4c8150eb5d789e4c69bf1ba6f9ebc8f62d6da3f260a06f0099e073acf989e7c927d1e97a8c3b1203b91bbf758f6ad208eff6990664710ab3d341a0710b8f0caa2217a4e45bd8fa79534aaa8a6b3407012b0c253ab8eb6098555191c4f6adcaaa45b4bb7225cfb450cb51e67f32cc2f8225e4749c7919168ef1bb020e75f73fd5be759cc5c0d8e6ddb85aa7f82a90f43cfcfa24446186c670985720a569f1e137b5ed4c310312525b5fdd4c8399cb506d8555d726323f6bf671d7c25e93ac537911556a825823bdf9fe82d0753bac2e951b26b7784a8a6705e5c7666f1b6307236b47e23d7e2deac38307918277f76068496781436e8424d3ee1883fc175960dc2bdc1ec7469d62a8ed9da85248bcd8168d5c7d91bc6a33ca01c3ffab6b6934cc75da58ebebb8f59113f3c7d457ee43cadb034c52e794617ac13180db2a2522349d6c47f0be1293c48e14c1a275e0fe2310b66f0f0f3652f515295fcdf1a1383b87678c11270f9a7d4d545be6e673143f08aa49f56458ea86ace1abcf49d6c218e2af035fcd7eb212305e1f2716f1109c74e930a2cf07a67787ec13f5e7b76021bec6116e52fce5669cffc915092e027f522e2bbefa94ae06824913e831e214fa7516377236309fbc966de8a94181ecd653e75c963e6688ab3b1e59aff8ec42510b8939c5837b04c2ba51949fd268e869007eb5651c6673527e265ab6b420a3000c1659f5599d4e3c190a3e77ab6b1e255c58b41767f51ccbbd0a4fe0c99e93d67e51cdfb5feac03e68adec7d8c9f477424b86b7d7a5f3a08761723e09c0c03ab4dc1fca4bb6caf2dbba68023c468cd25c99301b3e9778b276383a03e30a5ac3ab471a1bc779d82bcb430d059a9ca9765992b69ecc19600345db0f14560de4c3c10e224c620766ca3a25c672b2a2befb20f7bb577d0c8328563d0cf1ab6139b42a429cd9c8bb97109c222667f29eeb88b3dd3f0ca59b3954ac83eb4cfc2c3d848241da0418ebef5695868b856b461643adef9b2b08b4cbf9167a87c6e9071679b4bf0bd1d6f15343105d3167430fd293f4b2fdd9b5c49eb9d29eb070e91c390ae565cbfb8877eb1c32fcab9e482049e3855d34c8c24c583b013db58c213fed42f8ac6db0c3b15ff1b5e9d7f8b9cf823bf0d35ca1885b6f0a5f5df0d07e083c2b2bc06e5e9ab6512cd000799abd80c645d12cf055b38e0309d364f92977d3544f901e86a58514c1068b50be5f8eb18cc399722035e26ab579480a3dc4bc2de970d4fe20745a5b727243825854933b499173f5d450c5a81f12dd5333781505c507d1e576c638a648cb0aa2583350ba446bbf90328ccd2debe962321e06810622a4fe2b9f527d9e420d29f1415ab32d702d0f26e0304aa6935925af438023d768a46e9e259702f3d6eefef76cf935fa11dec847ca38c15159cbc1d19d8fe2b912ed8056c9e209831b0889ce300003c9432f2cc720bba5d2575440c43b2fbd6970f135e9d5582ccc4722a2dfc84aa5400c53816d76d1972b3c12a39a83d7877df493f3836fb4d838a89ab079a7eef60d8fcd321617c02501eb790e35ace5ddc8b1c60736cb46ee8871c59a774b73df28b5aa141b5ffc24d6e07dd6304ecaf978eef3a8b552d5348e6e9c0327d2158eb0a52bbc5bb5f81a4dfcf9d3b5c162145476fd6d92c01f07909bfacd45556fbfa1d722a10200b45db059be0445a63c3eaa7defb2daacf905a559b62c7038b9a22a7c7b36b4c96b6bdda288e83805976897f1313c31734338b071ce7fec22f523e1d3899c29f5a2a3851c2c2c0be9185b6faf3b20642192f45961f6eee8398f2ece41c5cbbf636f7d42d8c78b751b2c2d404ec67007cb39a69429ecdbcc49a676d3ad1de1d014dd0cf7c65d9c2aa5b152bbbac0128d3e4dc3ea6f4c70d402c6e65911e945f15c247877f17a3960e9900a2f177432fe129f37101d1e75bad4f40526ab36233bff8e9246c473034f036db3cd6bad5682cc22ae83c89666ae2908997cb3dfc70456da31a398cef9f3f7511ecadcd0ec2bb950ae6c7accf94c4f7fe2da9948295ee874ad0a9a6f5fc66fcd4213f0674027a785c91fb7e40ec2a435edca6d1762d30f8e64bb1ea1c16934f4e78c9b517a572924c7dd50e50a418d99d3b1286427108239ec57c34e21b26437fae8e9a56e13f02e49ec5127cf843f39d29fda6fcc52f1eebfdf42c4290deeba96507240f06a11e00dc04f01b8ccd0ce599d6e5ded503715e039ee4e9c1e4d6c7ede781bbc066717d1e3e5c5550923dbac63998208dcc5ff9e1db6311e0d63e580f84791400fd365a8947f7b496961ec594e5e443b53b9b8728e645ee3b0e9915e7618e020f8942b5bd9686652cb9aa8adbf20ed1acc53634eea966c30ea85b0868e0fa76236b82f12da3e4847a0e2ed5ead970fe704ebde519ae58802a6312c4793a1a07ef5a4d6fc1fd034e6aa3a4ff6f7bd05839f24cc5ca99d8d155d8d9daedcbe15cdb4a9441dd25722c9947fc2a58cb758ac304f4472c3d7249acca3a2ed49ae96f7e83089c987529094772124d9d20a8ba76ec74edfa2aa556c76c07ee4508f8c49784cf79319966f3461c691e513cca9f5bad67dbeb048383abe6438664bcfaa8e609370c651086d3bbe13704e51671545b1a90b9dee0f12d03e217e4a5b9ebae7296eb959ff13a51a579d92b3c2bd1251a37e51a8805b0bf165958f2da814ce4b078c5f4d9b7b3f2b2c575f650b94f9b035d6a02221370590f87dec646780327a5919164ebe37064032b16b0a98775498be5a31a7045477a93130ec1c7522c90dfaa323ef6fb85a42d79a3753f2cac5dc7e84361dc092d384e917ed1c61a513874fc2d24f253f043b3e66271961bb8519248fdae7b5a15015c0e59d8d815da4836680feb0ec90d171ea4b867d8692d8f4e05cdd9464f6b15704446437ca3a4bb24ff4906d9687b91811abae495168f1605906b0b3b2bb58d96956ae1d816447001fde9d5b0f955379c85737ea8fb0f6bb109a7fc789a02a1fa0f60e5938f6d52835e0f3f7ee15df971078f31d24ca6a0cd8182e999cc33db2081133e22603ae7d63848c12f88214d7c134ef2d9b05011f831c6c993bea185e7899d53dde275000184ca88308e68c0eb4d32950feea880f3f59b73305ef5514a4173164512ab8646c2402c527809ee10b1e8a3a7bba5d1dc6b216b254cd9b0b2b68f8ae6cd3eabd70a9df108627e59f1e92c5ad3d4ec0dfdab311bde69270eec0eeecb528091dbcd254a2b525fee8f1f8ad444b259144a86e44d19895759277a317931a1e2710ce98b759fd6498dc5b92533b5cf4cfbdebd71b513a0b249d17a5ae5a8a086735a6099d23830ad484ec582cfc3ad5d9107750635061323330201d6a45819825a7dfeb9a63071a1a35a240c4cfe063c39e44ef83c096a2438155578f5c44acb113e359d0ac47300bf89e799af746afcff86853e0423c5a30bcd23bfa9a3afc459461b3f3e2bda1a825d671e9e827a4f36c02aa23e996931bb7ca2f321e84eeb8d1b27df9b2b747aa09acb137cbf421637b5be2bdcd8220327103779b4b324e4a0565a92500b22d94f9c8638bce044266841f9411cc00478cb8dd1c0bf72c2d70c819f9f101cff4ecd2a39f2cf9842d7da1dc1603fba70a9da81a21e4cab96dee9e3f4c91344051f0b76911db6b86e4e3038f52cfd41a90381cc6737f709c0108560dada96b777a0f5fdb7dcdc8bb468e815a36e484d9245bea44d2f6b97d987a5c77f84f133df103a51a6ca3e7cc13711a883bc92ec7fdcb7139e6a5fb991aaf75ed3880f1561e5c5b920106d8aeac9e116ce90a835e0288e561f527b879abf6cf1847f13b52d1aeaa852a73e42aeaf301a5fb33bb6c5eccc7c5cd8042201e7a1ba2e29d1ad8ab73b2c7432350424f59c5aacaab934f7a845d12bde41af1f7cfe1dee06fcfc5043509323767c8e7385069898115be3b9c45f2726239c9ac2b92669c6c3c94d5e7d39a6db1465bf517b67f0873b02507be490177bbd1904aaee5e20d0119c82227a87fb438ac1f4574cb0c64f26243880eedfce3d20a89d859cfa1743832df5b4276d83a59382daeebc2e831c0be675109eafe20ca6a83f1c4634a53aed899aad80d4de2f21642de0fdd22cbbccae7a9b2847a4832ffbd06f3243fb23f95c69360da27038d2101ef68d89a4d098abbfc7bbb7301415b91e016e1441b090d8d8e3386753e8df1618e52bc6e207b98526d8601cfc7f070f57d4f92d2ec3f5f3ad586936e08899c61a6e3bcbe0b25a234bd1b2cc90a569f67fdf4623d1e7a76f2c35b7223d6adb52bc9c1f03834bf23ab2af6c107452dd2a2c42dccb11c7c64d360e4c21c645b4a606da0979410bf55d228f09e9eca9fcfca4aaee869", 0x1000, 0xde61}, {&(0x7f0000000140)="c6b2ae2a41c5cbcf9ce95499acf64f84de6e8f7930b589f215711d07b65f6fa00ecb3eddef3585053226e7fb53f44550655a1eb4dce123c28e5b3edc8d9d4cc3efb16f66406156a980a34781276ec7bcd0afcdad1c6f5df00b399a6aed8c239e85a2e9f7b3928114af57cb7ca19b83fdbe03f8bfe548f67401350cda97f1ce0a17d76e973b7a", 0x86, 0xfffffffffffffe00}, {&(0x7f0000000080)="6ff908af33666f8fd543712b1c3b6bd83c08ee691a0eb56e2737a1f8cc55ad85367c5559aaf78c17f9521977beca102f4e139b06cf2728fed5f54b40d318fd652ed6c090087f", 0x46, 0x4}, {&(0x7f00000003c0)="32b811fc8db72e72ad4f38d0312cab88e9e49d6b7fe7bb3976aeda2e7d9ba266e1eeef121aa3749233a99575e2f20fdbb397c978bd828f0921349a94a11e5ecce35d176b17bef9", 0x47, 0x4fc}, {&(0x7f0000001480)="98384d395da47a5b721adb1af98268053ba0467c119ebd4f", 0x18, 0x1}, {&(0x7f00000014c0)="dd0e9e975173427a1fcba84cc635601be602447bd9110ed2a1791927964dc097ad76df728a6becc4606ff2cda3b6fad4b0abaac5e0f1a6075dc60a200afa615b52fbdc3bb9ebea539938c0c03600bd5d77257ed62b7bef30573988c7eb734f3a29de2f2d2e1c5aa37c018712c9fb59", 0x6f, 0x9}, {&(0x7f0000001540)="b3814714740d8c780026a11064f5df21d935b68c097cc07e61095ff381932eb084187769fb7fa86737a3ae8e4c20891ab20d890e57c59ab4128645434f3ca6c65f19e29749aa64acbd8155ec067de1920daa9b58d05515e68868c29239adbbc3c944e0c58a6326a3f9b600dc98e470157f179fa81274d473d563f9a5edd1f1b539b14442cbb8974d07d505eaf4657a9cbf75f9b67c1599f202cf358fbcc8d8173f1117082041", 0xa6, 0x401}], 0x800, &(0x7f0000002c00)=ANY=[@ANYBLOB="75040080da5526d39d90b61c691cf153000000000000b04f91ef6297bcc198b0c1692c363af7172433e91ae3c087c351bb0b8091a411292ee4ed979953cab64be9c4ba5e9e2b000000000000000000", @ANYRESHEX=r4, @ANYBLOB=',grpquota,grpquota,obj_role=filter\x00,mask=MAY_EXEC,smackfsdef=-trusted,appraise,euid>', @ANYRESDEC=r5, @ANYBLOB=',\x00']) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000000100)={0x0, 0x0, 0x0, @thr={&(0x7f0000000180), &(0x7f0000000240)="a09a43"}}, &(0x7f0000000340)) ioctl$IOC_PR_REGISTER(r2, 0x401870c8, &(0x7f0000000380)={0x0, 0x9, 0x1}) ioctl$FITRIM(r1, 0xc0185879, &(0x7f00000019c0)={0x2, 0xfffffffffffffe01, 0x7}) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r2, 0xc02c5341, &(0x7f0000002b80)) lseek(r2, 0x0, 0x4) ioctl$KDGETLED(r1, 0x4b31, &(0x7f0000001940)) preadv(r2, &(0x7f0000004040)=[{&(0x7f0000002a80)=""/82, 0x52}, {&(0x7f0000002d00)=""/133, 0x85}, {&(0x7f0000002b00)=""/69, 0x45}, {&(0x7f0000002dc0)=""/187, 0xbb}, {&(0x7f0000001980)=""/48, 0x30}, {&(0x7f0000002e80)=""/119, 0x77}, {&(0x7f0000002f00)=""/4096, 0x1000}, {&(0x7f0000003f00)=""/239, 0xef}, {&(0x7f0000004000)=""/43, 0x2b}], 0x9, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000002a40)={'bond_slave_1\x00', r3}) getsockopt$EBT_SO_GET_INIT_INFO(r2, 0x0, 0x82, &(0x7f0000000280)={'filter\x00'}, &(0x7f0000000200)=0x78) 10:18:15 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xfffffdef, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:15 executing program 0: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) [ 692.770855] binder: 23512:23515 ioctl c0306261 20000440 returned -22 [ 692.819256] can: request_module (can-proto-5) failed. [ 692.831347] binder_alloc: binder_alloc_mmap_handler: 23512 20001000-20004000 already mapped failed -16 [ 692.854177] jfs: Unrecognized mount option "u" or missing value 10:18:16 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xca58, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 692.865554] binder: BINDER_SET_CONTEXT_MGR already set [ 692.880075] binder: 23512:23531 ioctl c0306261 20000440 returned -22 [ 692.896273] binder: 23512:23527 ioctl 40046207 0 returned -16 10:18:16 executing program 0: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) 10:18:16 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306262, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:16 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xd5e8, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 693.093678] binder: 23546:23548 ioctl c0306262 20000440 returned -22 [ 693.120944] binder_alloc: binder_alloc_mmap_handler: 23546 20001000-20004000 already mapped failed -16 [ 693.154194] binder: BINDER_SET_CONTEXT_MGR already set [ 693.166783] binder: 23546:23548 ioctl 40046207 0 returned -16 [ 693.188729] binder: 23546:23551 ioctl c0306262 20000440 returned -22 [ 693.585069] can: request_module (can-proto-5) failed. 10:18:16 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0x7968, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:16 executing program 0 (fault-call:1 fault-nth:0): mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) 10:18:16 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc030620a, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:16 executing program 3: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) syz_mount_image$vfat(&(0x7f0000001800)='vfat\x00', &(0x7f0000001840)='./file0\x00', 0x0, 0xaaaaaaaaaaaab46, &(0x7f0000000440)=[{&(0x7f0000000380), 0xffffffffffffffb6}], 0x0, &(0x7f00000000c0)=ANY=[]) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000000100)={0x0, 0x0, 0x0, @thr={&(0x7f0000000180), &(0x7f0000000240)="a09a43"}}, &(0x7f0000000340)) ioctl$IOC_PR_REGISTER(r0, 0x401870c8, &(0x7f0000000380)={0x0, 0x9, 0x1}) truncate(&(0x7f0000000000)='./file0\x00', 0xe47) lseek(r0, 0x0, 0x4) getsockopt$EBT_SO_GET_INIT_INFO(r0, 0x0, 0x82, &(0x7f0000000280)={'filter\x00'}, &(0x7f0000000200)=0x78) 10:18:16 executing program 5: semop(0x0, &(0x7f0000000080), 0x13) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000040)=""/11, 0xffffff3a) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/llc\x00') write$P9_RREADLINK(r1, &(0x7f00000001c0)={0x10, 0x17, 0x1, {0x7, './file0'}}, 0x10) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x8000, 0x0) ioctl$KVM_CHECK_EXTENSION_VM(r2, 0xae03, 0x6) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000140), &(0x7f0000000180)=0x8) ioctl$TIOCGETD(r0, 0x545d, &(0x7f0000000080)) 10:18:16 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000080)="2f70726f632f7179732f6e65f42f697076342f76732f706d74755f6469736300", 0x2, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000180)={0xffffffffffffffff, r0, 0x0, 0x7, &(0x7f00000000c0)='nodev(\x00', 0xffffffffffffffff}, 0x30) sendmsg$nl_generic(r0, &(0x7f00000004c0)={&(0x7f0000000040), 0xc, &(0x7f0000000480)={&(0x7f00000001c0)=ANY=[@ANYBLOB="a00100002400000527bd7000fbdbdf2511000000080096000a3a000078014000aa4b0b2d2f8cc12b64b822c996f960b3335e9dc950a489a7aa1bb6c57e9e5663ab2a0a74b8ca857009817d0a78bcbe2185eb613c526cdfcec80298e571f0e3667abe0d8fa2901c35aec6e696bbcffbc6b148a9ef4c698722b921cd3cd2c77ae6287747f9103ade230ef273d4eea006a3831c0d301b13bdb26d12fb4fa01a3fc02f443f014ad8d082b51fa3b551453e2b0abfa46d0c2de345594596c8d410c63ad997a6d1237d8465d0de258a14ec74c15129ac79a192acee826b48452103d108a8e0c0a8d1d139750739e6c63e2461aa8ead430a4767a83e07e9322fb29d42244d5e08004000ac1414aa080004000080000008001f00510e000022786f2837ad32a4b1984eee374206cca15456702f75de8c19627106c236bd57b4b1b39daa00b69362fdfa6d66fea69078cf7af0042074c3393a0c53baaf1df525e9af87b1afd4c564ddb3ef389b188cfb8e4a72182cc6ff20fd2677e857832b83497de6ccab697d85836c26e44bf8f1b1c408000700", @ANYRES32=r0, @ANYBLOB="0c000e0008007700", @ANYRES32=r1], 0x1a0}, 0x1, 0x0, 0x0, 0x1}, 0x40000) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) socket$inet6(0xa, 0xa, 0x8) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x13, 0xffffffffffffffff, 0x0) getdents64(r2, &(0x7f0000000100)=""/111, 0x18) getdents(r2, &(0x7f0000000380)=""/246, 0xffffffff00000018) 10:18:16 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xf898, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 693.685933] binder: 23565:23570 ioctl c030620a 20000440 returned -22 [ 693.716733] binder_alloc: binder_alloc_mmap_handler: 23565 20001000-20004000 already mapped failed -16 10:18:16 executing program 0: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) [ 693.768610] binder: BINDER_SET_CONTEXT_MGR already set [ 693.786008] binder: 23565:23577 ioctl c030620a 20000440 returned -22 [ 693.801653] binder: 23565:23570 ioctl 40046207 0 returned -16 10:18:17 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) ioctl$BLKBSZSET(r0, 0x40081271, &(0x7f0000000040)=0x7) getdents64(r1, &(0x7f0000000100)=""/111, 0x18) socket$bt_bnep(0x1f, 0x3, 0x4) getdents(r1, &(0x7f0000000380)=""/246, 0xffffffff00000018) 10:18:17 executing program 0: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) r0 = socket(0x19, 0x2, 0x100) getsockopt$netlink(r0, 0x10e, 0x2, &(0x7f0000000000)=""/104, &(0x7f0000000080)=0x68) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) 10:18:17 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0x6810, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:17 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:17 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0x9650, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:17 executing program 0: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) r0 = syz_open_dev$usbmon(&(0x7f0000000140)='/dev/usbmon#\x00', 0xffffffffffffff2b, 0x100) ioctl$RTC_PLL_GET(r0, 0x80207011, &(0x7f0000000180)) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) r1 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0x3f, 0xfffffffffffffff6) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f00000001c0)=ANY=[@ANYRES32=0x0, @ANYBLOB="1c100a00010003000008000007000700d60007e6f7000100287ee761da060000006e8630c4e7b1e045575b8387713f00009cd5a3ff6dc6916244d39eac1e674392d3770b0c9b67a53cb4f082e9a7399a27325a216f4108521b3452a881fdf930"], &(0x7f0000000080)=0x1c) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r1, 0x84, 0x73, &(0x7f00000000c0)={r2, 0x800, 0x20, 0x7, 0x3f1}, &(0x7f0000000100)=0x18) [ 694.009790] binder_alloc: binder_alloc_mmap_handler: 23603 20001000-20004000 already mapped failed -16 [ 694.030865] binder: BINDER_SET_CONTEXT_MGR already set [ 694.038357] binder: 23603:23609 ioctl 40046207 0 returned -16 10:18:17 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40046205, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) [ 694.208291] binder_alloc: binder_alloc_mmap_handler: 23624 20001000-20004000 already mapped failed -16 [ 694.223703] binder: BINDER_SET_CONTEXT_MGR already set [ 694.229251] binder: 23624:23625 ioctl 40046207 0 returned -16 10:18:17 executing program 3: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) syz_mount_image$vfat(&(0x7f0000001800)='vfat\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x1, &(0x7f0000000440)=[{&(0x7f0000000380)}], 0x0, &(0x7f00000000c0)=ANY=[]) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000000100)={0x0, 0x0, 0x0, @thr={&(0x7f0000000180), &(0x7f0000000240)="a09a43"}}, &(0x7f0000000340)) ioctl$IOC_PR_REGISTER(r1, 0x401870c8, &(0x7f0000000380)={0x0, 0x9, 0x1}) lseek(r1, 0x0, 0x4) getsockopt$EBT_SO_GET_INIT_INFO(r1, 0x0, 0x82, &(0x7f0000000280)={'filter\x00'}, &(0x7f0000000200)=0x78) [ 694.477185] FAT-fs (loop3): bogus number of reserved sectors [ 694.483312] FAT-fs (loop3): Can't find a valid FAT filesystem [ 694.523223] FAT-fs (loop3): bogus number of reserved sectors [ 694.529649] FAT-fs (loop3): Can't find a valid FAT filesystem 10:18:17 executing program 5: semop(0x0, &(0x7f0000000080), 0x13) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) lstat(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0}) r2 = getuid() lstat(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f00000003c0)={{{@in=@local, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in=@remote}}, &(0x7f00000004c0)=0xe8) ioctl$TIOCOUTQ(r0, 0x5411, &(0x7f0000000580)) fstat(r0, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0}) r6 = openat$vcs(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/vcs\x00', 0x0, 0x0) ioctl$BLKRRPART(r6, 0x125f, 0x0) r7 = getegid() r8 = getgid() setxattr$system_posix_acl(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000640)=ANY=[@ANYBLOB="02000000010002000000000002000100", @ANYRES32=r1, @ANYBLOB="02000400", @ANYRES32=r2, @ANYBLOB="02000000", @ANYRES32=r3, @ANYRES32=r2, @ANYRES32=r4, @ANYRES16=r8, @ANYRES32=r5, @ANYBLOB="040001000000000008000300", @ANYRES32=r7, @ANYBLOB="080004007b962f76058e0e4fe381d7f76c716704c872f2bac106ee0838b3aedf3db264617f01f94668a2170acf342b09342ca7c372b048f61723e2a0fac833e6f2480fc61e5349fe10bdb441d7e70258c42795a48f308bff4ade68b478c726", @ANYRES32=r8, @ANYBLOB="105f0000000000000000000000000000"], 0xf, 0xf098abd9dfc97cff) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(r6, 0x40086607, &(0x7f0000000600)=0x7) setsockopt$SO_TIMESTAMPING(r9, 0x1, 0x25, &(0x7f00000000c0)=0x40, 0x4) read(r0, &(0x7f0000000040)=""/11, 0xffffff3a) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000140), &(0x7f0000000180)=0x8) ioctl$TIOCGETD(r0, 0x545d, &(0x7f0000000000)) 10:18:17 executing program 3: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) close(r1) ioctl$int_out(r0, 0x2, &(0x7f0000000040)) syz_mount_image$vfat(&(0x7f0000001800)='vfat\x00', &(0x7f0000001840)='./file0\x00', 0x0, 0xaaaaaaaaaaaab46, &(0x7f0000000440)=[{&(0x7f0000000380), 0xffffffffffffffb6}], 0x0, &(0x7f00000000c0)=ANY=[]) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000000100)={0x0, 0x0, 0x0, @thr={&(0x7f0000000180), &(0x7f0000000240)="a09a43"}}, &(0x7f0000000340)) ioctl$IOC_PR_REGISTER(r1, 0x401870c8, &(0x7f0000000380)={0x0, 0x9, 0x1}) lseek(r1, 0x0, 0x4) getsockopt$EBT_SO_GET_INIT_INFO(r1, 0x0, 0x82, &(0x7f0000000280)={'filter\x00'}, &(0x7f0000000200)=0x78) 10:18:17 executing program 0: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) getresgid(&(0x7f00000000c0), &(0x7f0000000000), &(0x7f0000000080)) 10:18:17 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0x8ac0, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:17 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40046207, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:17 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f00009fe000/0x600000)=nil, 0x600000, 0x4) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) fcntl$F_GET_FILE_RW_HINT(r0, 0x40d, &(0x7f00000000c0)) getdents64(r1, &(0x7f0000000100)=""/111, 0x18) ioctl$FIBMAP(r0, 0x1, &(0x7f0000000040)=0xffff) getdents(r1, &(0x7f0000000180)=""/246, 0xf6) write$eventfd(r0, &(0x7f0000000080)=0x1000, 0x8) 10:18:17 executing program 0: mprotect(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x2) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) r0 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x4, 0x8000) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffff9c, 0x84, 0x73, &(0x7f0000000040)={0x0, 0x8420, 0x10, 0x8, 0x7}, &(0x7f0000000080)=0x18) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f00000000c0)=@assoc_value={r1, 0xfffffffffffffffa}, 0x8) [ 694.666181] binder: BINDER_SET_CONTEXT_MGR already set [ 694.671526] binder: 23652:23655 ioctl 40046207 20000440 returned -16 10:18:17 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0x4b28, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 694.728036] binder: BINDER_SET_CONTEXT_MGR already set [ 694.760200] binder: 23652:23655 ioctl 40046207 0 returned -16 10:18:17 executing program 0: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) r0 = accept(0xffffffffffffffff, &(0x7f0000000000)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f0000000080)=0x80) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(0xffffffffffffffff, 0x84, 0x70, &(0x7f00000000c0)={0x0, @in={{0x2, 0x4e24}}, [0x5, 0x8000, 0x4, 0x2, 0x1f, 0x3ff, 0x6, 0x5, 0x5, 0x2, 0xf1, 0xffffffff, 0x8, 0x6, 0x9c]}, &(0x7f00000001c0)=0x100) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000000200)={r1, 0x0, 0x30}, &(0x7f0000000240)=0xc) [ 694.806133] binder: BINDER_SET_CONTEXT_MGR already set [ 694.826027] binder: 23652:23667 ioctl 40046207 20000440 returned -16 10:18:18 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0045878, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:18 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0x3408, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:18 executing program 0: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x0, 0x0) getsockopt$XDP_STATISTICS(r0, 0x11b, 0x7, &(0x7f0000000100), &(0x7f0000000140)=0x18) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r0, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x9c51, 0x30, 0x6, 0xffffffff}, &(0x7f0000000040)=0x18) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r0, 0x84, 0x73, &(0x7f0000000080)={r1, 0xaa, 0x30, 0x7ff, 0x20}, &(0x7f0000000180)=0x18) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) [ 694.980287] binder: BINDER_SET_CONTEXT_MGR already set [ 694.999797] binder: 23685:23686 ioctl 40046207 0 returned -16 10:18:18 executing program 5: semop(0x0, &(0x7f0000000080), 0x13) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000040)=""/11, 0xffffff3a) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) r1 = syz_open_dev$sndpcmc(&(0x7f0000000080)='/dev/snd/pcmC#D#c\x00', 0xfffffffffffffffa, 0x40) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, &(0x7f00000000c0)={0x0, 0x8}, &(0x7f00000001c0)=0x8) ioctl$DRM_IOCTL_MODE_GETCRTC(r1, 0xc06864a1, &(0x7f0000000300)={&(0x7f00000002c0)=[0x7, 0xfffffffffffffffc, 0x40, 0x7f, 0x2, 0x8], 0x6, 0x6, 0x5, 0x9, 0x2, 0x7e0, {0xfbe5, 0x20, 0x10001, 0x4952, 0x1d, 0xb82, 0xfffffffffffffffd, 0x7fffffff, 0x4, 0x1, 0x3, 0x1, 0x8, 0x80, "a8fa8fb529d859372324c568b25c3f88515c92e826fc8f72d1b9678066a8e0cb"}}) getsockopt$inet_sctp_SCTP_RESET_STREAMS(r1, 0x84, 0x77, &(0x7f0000000240)={r2, 0xf199, 0x3, [0x5, 0x1fffffffc0000000, 0x3d6b]}, &(0x7f0000000280)=0xe) clone(0x800000020002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000140), &(0x7f0000000180)=0x8) ioctl$TIOCGETD(r0, 0x545d, &(0x7f0000000000)) 10:18:18 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0x39d0, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:18 executing program 0: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) r0 = socket$xdp(0x2c, 0x3, 0x0) sendto(r0, &(0x7f0000002fc0)="b37f952b417ec7eb854f36e600d13ddaaa289f243341caceeec414c00281d1278506066496354462e7fcd55c1db7594ff87e4da68bc491c7e6f0d3fca57260e988521cf07bc0ace14d875063df42e271c6070218765a4c2a02257a7458b0b2df5a69c87a", 0x64, 0x4000000, 0x0, 0x0) 10:18:18 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x61, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:18 executing program 3: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) syz_mount_image$vfat(&(0x7f0000001800)='vfat\x00', &(0x7f0000001840)='./file0\x00', 0x0, 0xaaaaaaaaaaaab46, &(0x7f0000000440)=[{&(0x7f0000000380), 0xffffffffffffffb6}], 0x0, &(0x7f00000000c0)=ANY=[]) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/net/pfkey\x00', 0x80000, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000000100)={0x0, 0x0, 0x0, @thr={&(0x7f0000000180), &(0x7f0000000240)="a09a43"}}, &(0x7f0000000340)) ioctl$IOC_PR_REGISTER(r0, 0x401870c8, &(0x7f0000000380)={0x0, 0x9, 0x1}) lseek(r0, 0x0, 0x4) getsockopt$EBT_SO_GET_INIT_INFO(r0, 0x0, 0x82, &(0x7f0000000280)={'filter\x00'}, &(0x7f0000000040)=0xffffffffffffff72) syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0xa96, 0x40000) 10:18:18 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000080)={'vlan0\x00', 0x1000000802}) ioctl$TUNSETLINK(r1, 0x400454cd, 0x306) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000140)={{0x2, 0x0, @multicast2}, {0x1, @local}, 0x0, {0x2, 0x0, @multicast1}, 'vlan0\x00'}) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0xfffffffffffffffe, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getdents64(r2, &(0x7f0000000100)=""/111, 0x18) getdents(r2, &(0x7f0000000380)=""/246, 0xffffffff00000018) 10:18:18 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0x50f0, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:18 executing program 0: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) r0 = accept$unix(0xffffffffffffff9c, &(0x7f0000000000), &(0x7f0000000080)=0x6e) ioctl$sock_netdev_private(r0, 0x89ff, &(0x7f00000000c0)="f1daf221d22edecbb58770be1d0e7a1b46debcac540ce4131e24b197a7c03d5aa6cfd6fc8b919e45f1ad2e3eac11e9dc65f87befbf0798eae9cd72d21fa73a9c898338bf565e53102f9e804ce29a727615780ae679ba5ff2040b91b30ccbdd3365c104a7c0f868167e586277bd25d44cbb38e17c2a542bacc2d78685acea160dac23416a27bfd175b50e8222ff05da99334c6ff249f04d30c3475b0a614847bd3877749ddd1fc8898dc98f496fe7cb735269db77f5fda0fc5adf6608e626c82bff176e30119cbe8d6afcf90fe2fb369a0128798769ba5d27199205de9fdc3d089421bc") getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) [ 695.620478] binder_alloc: 23710: binder_alloc_buf size 26388279066624 failed, no address space 10:18:18 executing program 0: r0 = dup(0xffffffffffffffff) ioctl$ASHMEM_GET_PROT_MASK(r0, 0x7706, &(0x7f0000000000)) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) [ 695.685875] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 695.710905] binder: 23710:23715 transaction failed 29201/-28, size 26388279066624-0 line 2970 10:18:18 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0x9088, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 695.737672] binder_alloc_mmap_handler: 2 callbacks suppressed [ 695.737690] binder_alloc: binder_alloc_mmap_handler: 23710 20001000-20004000 already mapped failed -16 [ 695.765942] binder: BINDER_SET_CONTEXT_MGR already set [ 695.775569] binder_alloc: 23710: binder_alloc_buf, no vma 10:18:18 executing program 0: mprotect(&(0x7f000037b000/0x2000)=nil, 0x2000, 0x0) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000000)) [ 695.795843] binder: 23710:23715 ioctl 40046207 0 returned -16 [ 695.817171] binder: 23710:23727 transaction failed 29189/-3, size 26388279066624-0 line 2970 10:18:19 executing program 0: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) r0 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x8276, 0x10000) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000040)={0x0, 0x9, 0x20, 0x0, 0x98fc}, &(0x7f0000000080)=0x18) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f00000000c0)={r1, 0x800}, &(0x7f0000000100)=0x8) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) [ 695.857480] binder: undelivered TRANSACTION_ERROR: 29201 [ 695.864360] binder: undelivered TRANSACTION_ERROR: 29189 10:18:19 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0x1720, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:19 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x62, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:19 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000000)={&(0x7f00001c4000/0x4000)=nil, 0x4000}, &(0x7f0000000040)=0x10) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) 10:18:19 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getdents64(r0, &(0x7f0000000080)=""/111, 0x6f) getdents(r0, &(0x7f0000000380)=""/246, 0xffffffff00000018) syz_open_dev$adsp(&(0x7f0000000040)='/dev/adsp#\x00', 0xf0f, 0x80) 10:18:19 executing program 5: semop(0x0, &(0x7f0000000080), 0x13) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000040)=""/11, 0xffffff3a) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r3, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="05000000000000000d000040050000a90000000000000000000000400000000001"]) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000000)={0x1, 0x0, [{0x485}]}) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000140), &(0x7f0000000180)=0x8) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000080)=0x0) fcntl$lock(r0, 0x7, &(0x7f00000000c0)={0x2, 0x3, 0xd2f9, 0x7ff, r4}) ioctl$TIOCGETD(r0, 0x545d, &(0x7f0000000000)) 10:18:19 executing program 3: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet6_int(r0, 0x29, 0x0, &(0x7f0000000000)=0x401, 0x4) close(r1) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000080)={0xffffffffffffffff}, 0x13f, 0x3}}, 0x20) write$RDMA_USER_CM_CMD_QUERY(r1, &(0x7f0000000140)={0x13, 0x10, 0xfa00, {&(0x7f00000003c0), r2, 0x2}}, 0x18) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = socket$inet(0x2, 0x3, 0x2) ioctl$BLKTRACESTOP(r0, 0x1275, 0x0) r5 = syz_open_dev$dri(&(0x7f0000000240)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_SET_VERSION(r5, 0xc0106407, &(0x7f0000000000)) setsockopt$inet_int(r4, 0x1f00000000000000, 0xd2, &(0x7f0000000000), 0x3c) timer_create(0x0, &(0x7f0000000100)={0x0, 0x0, 0x0, @thr={&(0x7f0000000180), &(0x7f0000000240)="a09a43"}}, &(0x7f0000000340)) ioctl$IOC_PR_REGISTER(r1, 0x401870c8, &(0x7f0000000380)={0x0, 0x9, 0x1}) lseek(r3, 0x0, 0x6) getsockopt$EBT_SO_GET_INIT_INFO(r1, 0x0, 0x82, &(0x7f0000000280)={'filter\x00'}, &(0x7f0000000200)=0x78) 10:18:19 executing program 0: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) r0 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x6, 0x40) open(&(0x7f0000000080)='./file0\x00', 0x1114c2, 0x4) renameat2(r0, &(0x7f0000000140)='./file0\x00', r0, &(0x7f0000000100)='./file0\x00', 0x0) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) 10:18:19 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xad70, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 696.514686] binder_alloc: 23764: binder_alloc_buf size 26388279066624 failed, no address space [ 696.543493] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) 10:18:19 executing program 3: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$nfc_llcp(r0, 0x118, 0x2, &(0x7f0000000140)=""/95, 0x5f) close(r1) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e20, 0x6, @remote, 0xffff}, @in6={0xa, 0x4e23, 0x7, @ipv4={[], [], @loopback}, 0x3}, @in6={0xa, 0x4e20, 0xb91, @mcast2, 0x4}, @in={0x2, 0x4e23, @remote}, @in6={0xa, 0x4e21, 0xffffffffffff9ac0, @dev={0xfe, 0x80, [], 0x1a}, 0xda}, @in={0x2, 0x4e24, @loopback}], 0x90) socketpair$inet_udp(0x2, 0x2, 0x0, &(0x7f00000001c0)) setsockopt$l2tp_PPPOL2TP_SO_RECVSEQ(r1, 0x111, 0x2, 0x1, 0x4) syz_mount_image$vfat(&(0x7f0000001800)='vfat\x00', &(0x7f0000001840)='./file0\x00', 0x0, 0x1, &(0x7f0000000440)=[{&(0x7f0000000380)}], 0x0, &(0x7f00000001c0)=ANY=[]) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000000100)={0x0, 0x0, 0x0, @thr={&(0x7f0000000180), &(0x7f0000000240)="a09a43"}}, &(0x7f0000000340)) ioctl$IOC_PR_REGISTER(r1, 0x401870c8, &(0x7f0000000200)={0x1, 0x1, 0x1000001}) lseek(r1, 0x0, 0x4) getsockopt$EBT_SO_GET_INIT_INFO(r0, 0x0, 0x82, &(0x7f0000000280)={'filter\x00'}, &(0x7f0000000000)=0x78) setsockopt$inet6_MRT6_ADD_MIF(r0, 0x29, 0xca, &(0x7f0000000380)={0x4, 0x1, 0x7fff, 0x2b, 0x3fee}, 0xc) [ 696.586188] binder: 23764:23773 transaction failed 29201/-28, size 26388279066624-0 line 2970 10:18:19 executing program 0: r0 = socket$bt_hidp(0x1f, 0x3, 0x6) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f00000000c0)={0x1, 0x800}, 0x8) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000000)=0x0) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x40000, 0x0) ioctl$TCGETA(r2, 0x5405, &(0x7f0000000140)) mprotect(&(0x7f00003d8000/0x3000)=nil, 0x3000, 0x1000000) ptrace$PTRACE_SECCOMP_GET_FILTER(0x420c, r1, 0x81, &(0x7f0000000040)=""/112) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) [ 696.660743] binder_alloc: binder_alloc_mmap_handler: 23764 20001000-20004000 already mapped failed -16 [ 696.694043] binder: BINDER_SET_CONTEXT_MGR already set 10:18:19 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0x2878, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 696.709645] FAT-fs (loop3): Unrecognized mount option "" or missing value [ 696.714709] binder: 23764:23773 ioctl 40046207 0 returned -16 [ 696.734738] binder_alloc: 23764: binder_alloc_buf, no vma 10:18:19 executing program 0: syz_open_dev$sndseq(&(0x7f00000000c0)='/dev/snd/seq\x00', 0x0, 0x80002) mprotect(&(0x7f000036e000/0x4000)=nil, 0x4000, 0x4) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000002c0)={{{@in6, @in=@dev}}, {{@in=@broadcast}, 0x0, @in6=@remote}}, &(0x7f00000003c0)=0xe8) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f0000000040)={{0x3, 0x3, 0x6, 0x2, 0x5}, 0xc6a5, 0x9}) [ 696.758790] binder: undelivered TRANSACTION_ERROR: 29201 [ 696.764981] binder: 23764:23779 transaction failed 29189/-3, size 26388279066624-0 line 2970 [ 696.819517] binder: undelivered TRANSACTION_ERROR: 29189 [ 696.837460] FAT-fs (loop3): Unrecognized mount option "" or missing value 10:18:20 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x63, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:20 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x6810, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:20 executing program 0: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) getresgid(&(0x7f0000000100), &(0x7f0000000180), &(0x7f0000000140)) r0 = syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0xffffffffffffff62, 0x20100) ioctl$FICLONERANGE(r0, 0x4020940d, &(0x7f00000000c0)={r0, 0x0, 0x1c00000000000000, 0x9, 0x8}) fcntl$getownex(r0, 0x10, &(0x7f0000000080)={0x0, 0x0}) fcntl$setown(r0, 0x8, r1) openat$cgroup_ro(r0, &(0x7f0000000200)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xae44, 0x4) clock_getres(0x7, &(0x7f0000000000)) write$P9_RXATTRCREATE(r0, &(0x7f00000001c0)={0x7, 0x21, 0x1}, 0x7) [ 696.976435] binder_alloc: 23814: binder_alloc_buf size 26388279066624 failed, no address space [ 697.025215] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 697.065462] binder: 23814:23816 transaction failed 29201/-28, size 26388279066624-0 line 2970 [ 697.081677] binder_alloc: binder_alloc_mmap_handler: 23814 20001000-20004000 already mapped failed -16 [ 697.106266] binder: BINDER_SET_CONTEXT_MGR already set 10:18:20 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f0000000040)={0xfffffffffffffffe, 0x5, 0x100, 'queue1\x00', 0x8000}) getdents64(r1, &(0x7f0000000100)=""/111, 0x18) getdents(r1, &(0x7f0000000380)=""/246, 0xffffffff00000018) [ 697.111898] binder_alloc: 23814: binder_alloc_buf, no vma [ 697.118032] binder: 23814:23816 ioctl 40046207 0 returned -16 [ 697.124667] binder: 23814:23823 transaction failed 29189/-3, size 26388279066624-0 line 2970 [ 697.134845] binder: undelivered TRANSACTION_ERROR: 29201 [ 697.141951] binder: undelivered TRANSACTION_ERROR: 29189 10:18:20 executing program 5: semop(0x0, &(0x7f0000000080), 0x13) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000040)=""/11, 0xffffff3a) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000140), &(0x7f0000000180)=0x8) rseq(&(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x4, 0x7, 0x0, 0xec}, 0x6}, 0x20, 0x0, 0x0) ioctl$TIOCGETD(r0, 0x545d, &(0x7f0000000000)) 10:18:20 executing program 3: prctl$intptr(0x6, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) syz_mount_image$vfat(&(0x7f0000001800)='vfat\x00', &(0x7f0000001840)='./file0\x00', 0x0, 0xaaaaaaaaaaaab46, &(0x7f0000000440)=[{&(0x7f0000000380), 0xffffffffffffffb6}], 0x0, &(0x7f00000000c0)=ANY=[]) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000000100)={0x0, 0x0, 0x0, @thr={&(0x7f0000000180), &(0x7f0000000240)="a09a43"}}, &(0x7f0000000340)) ioctl$IOC_PR_REGISTER(r0, 0x401870c8, &(0x7f0000000380)={0x0, 0x9, 0x1}) lseek(r0, 0x0, 0x4) getsockopt$EBT_SO_GET_INIT_INFO(r0, 0x0, 0x82, &(0x7f0000000280)={'filter\x00'}, &(0x7f0000000200)=0x78) 10:18:20 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xaf950000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:20 executing program 0: socketpair$inet6_udp(0xa, 0x2, 0x0, &(0x7f0000000000)) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) 10:18:20 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x3f000000, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:20 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r0, 0x84, 0xc, &(0x7f0000000040)=0x8, 0x4) getdents64(r1, &(0x7f0000000100)=""/111, 0x18) getdents(r1, &(0x7f0000000380)=""/246, 0xffffffff00000018) mprotect(&(0x7f00009f3000/0x2000)=nil, 0x2000, 0x3) [ 697.505738] binder_alloc: binder_alloc_mmap_handler: 23836 20001000-20004000 already mapped failed -16 10:18:20 executing program 0: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x20181, 0x0) getsockopt$inet_sctp6_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000040)=@assoc_id=0x0, &(0x7f0000000080)=0x4) prctl$setmm(0x23, 0x4, &(0x7f0000ffc000/0x2000)=nil) pipe(&(0x7f0000000380)={0xffffffffffffffff}) ioctl$VT_GETSTATE(r2, 0x5603, &(0x7f0000000100)={0x6, 0x6, 0x8}) listen(r0, 0xfffffffffffffffa) ioctl$KVM_GET_SREGS(r0, 0x8138ae83, &(0x7f0000000500)) setsockopt$inet_sctp_SCTP_AUTH_DELETE_KEY(r0, 0x84, 0x19, &(0x7f00000000c0)={r1, 0xc462}, 0x8) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) socket$inet_icmp_raw(0x2, 0x3, 0x1) 10:18:20 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xb34c000000000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 697.558851] binder: BINDER_SET_CONTEXT_MGR already set [ 697.576483] binder: 23836:23845 ioctl 40046207 0 returned -16 10:18:20 executing program 5: semop(0x0, &(0x7f0000000080), 0x13) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x10001000008000, 0x0) read(r0, &(0x7f0000000040)=""/11, 0xffffff3a) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000140), &(0x7f0000000180)=0x8) ioctl$TIOCGETD(r0, 0x545d, &(0x7f0000000000)) 10:18:20 executing program 0: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xfffffffffffffffd) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) restart_syscall() 10:18:20 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x12, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:20 executing program 0: r0 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x1, 0x280000) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000040)={0x3, 0x0, 0x0, 0x4865}) ioctl$DRM_IOCTL_AGP_UNBIND(r0, 0x40106437, &(0x7f0000000080)={r1, 0x101}) mprotect(&(0x7f000005d000/0x4000)=nil, 0x4000, 0x1) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) 10:18:20 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x98f8, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 697.767896] binder: 23869:23873 unknown command 0 [ 697.781855] binder: 23869:23873 ioctl c0306201 20000440 returned -22 [ 697.807447] binder_alloc: binder_alloc_mmap_handler: 23869 20001000-20004000 already mapped failed -16 [ 697.845884] binder: BINDER_SET_CONTEXT_MGR already set [ 697.855510] binder: 23869:23876 unknown command 0 [ 697.857290] binder: 23869:23873 ioctl 40046207 0 returned -16 [ 697.880439] binder: 23869:23876 ioctl c0306201 20000440 returned -22 10:18:21 executing program 3: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) syz_mount_image$vfat(&(0x7f0000001800)='vfat\x00', &(0x7f0000001840)='./file0\x00', 0x0, 0xaaaaaaaaaaaab46, &(0x7f0000000440)=[{&(0x7f0000000380), 0xffffffffffffffb6}], 0x0, &(0x7f00000000c0)=ANY=[]) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000000100)={0x0, 0x0, 0x0, @thr={&(0x7f0000000180), &(0x7f0000000240)="a09a43"}}, &(0x7f0000000340)) ioctl$IOC_PR_REGISTER(r0, 0x401870c8, &(0x7f0000000380)={0x0, 0x9, 0x1}) lseek(r0, 0x0, 0x4) getsockopt$EBT_SO_GET_INIT_INFO(r0, 0x0, 0x82, &(0x7f0000000280)={'filter\x00'}, &(0x7f0000000200)=0x78) 10:18:21 executing program 0: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) r0 = fcntl$dupfd(0xffffffffffffff9c, 0x406, 0xffffffffffffff9c) r1 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0xfffffffffffffff7, 0x101000) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000040)={0x3, r1}) 10:18:21 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x7b520000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:21 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x7400000000000000, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) [ 698.162636] binder_alloc: binder_alloc_mmap_handler: 23895 20001000-20004000 already mapped failed -16 [ 698.195973] binder: BINDER_SET_CONTEXT_MGR already set [ 698.207108] binder: 23895:23899 ioctl 40046207 0 returned -16 10:18:21 executing program 0: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) socketpair$inet6_dccp(0xa, 0x6, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r0, &(0x7f0000000840)=[{&(0x7f0000000200)="4a6e5400b6b1b439e56b73e053a4d27a503c3a9efd65ca8b52ed1f2ac4219be0ec226f403f857d261faea2c6b2b3952f6e557e621805395295384d15143feb264d87ae390f396e85c86f4b40d20cf44b238bf641610a817f55aab889a84bdeb614ee6261d25717b76d560a8dc45b164686c676936fcad14bb4885f84554c91042a433f3631cf691be4bd9d5b36cab9d14adb5e8e9143e58b340e0d41c5", 0x9d}, {&(0x7f00000002c0)="d244b076de07ee72faf2c2e8603c0e8f34be5cef169048c3dbf3510ce68083bd2995e73576d384561deb693119d5c96f21461634747ddaf3d33417c9e3f5896bb6113bf7e0809ab48b9800830af58524d64d06e3611602821699cb6f569619e39ec1490fc8c819a94a62ca84259dd9167a6c36cb95fc6040bcc1809b211bcc5be610f6e5c174b5bd7439dfed100a875a4712b67d51302d3d0ec24a2b2d9d625f6c12fad2ddb3af66829988e5bedbc4171917e8dd0561410e6994c796ba19ed29f5dc63e7cb71c758e1d224e4abc897458b054a8b10dc8a", 0xd7}, {&(0x7f00000003c0)="8872012fd909b7179870fbeeae8ace4c828a573f44357df93d66b85632593499567951f16583c81fa83973d396149d240fbd261004d51249c77b2c58221aec983171a8b7777e89e8130cbc35d787302da7fe3ea9ed0284c01c9367808ecbd751e58522644b6e2956f20e30f95c6771a1b16aa57f2106d8f9149da66138b1b7320e8ccbc851ad26afb3c6c9d61a98456ae4445b68ded651cac5c332c0f0b78d4dec6ea733dd509649d354c85a53e4ab752463954f0421689b4f012e6d1f7bd5408726d816c41bbf44c02d92d63ceaccf380f9b04cb26d3a39e538d07861", 0xdd}, {&(0x7f00000004c0)="a9e12e0d780e856d189f8fb99b267adc741b3b8c933d652f7b604c96fd1a4500fde80546a98367fa4689118e03a92a6ba33a26975f485f3579b175344044c31c6297ca426591bc2b324d9f26dcfbc97fd92986463c890fbe600a43f452ec", 0x5e}, {&(0x7f0000000540)="b70904c618c475ab99d2440f8f71f625f5cdbefefe45ff7c82d68d808c108fb1fd4bcfad1746c4f64e62d19b738974ad1c4fdb35954a87e58452158491757ee277c04d57f44b8870f2a594d432a3791b6ec8da57856c829fca57119af68b9777cac4df25076c39003c97b6170ea3f77e054371a2ff97ac7d48d2a24e2719c33e07591fbbba32a4922f82c921aa14d5c4921b5d3a9b68c5282243945853839763d790c92f512f8349ae01e921ab80", 0xae}, {&(0x7f0000000600)="7e0724f37abc39ad9ceffa57e8fb78963608e87a4d5b153cd50254715324ee0ef38da1f0961e7897ba3ecb116c7597d1d789f7cc5a59085664249bc3dd4c0121738e5a7ea9a40937aee035458f91169342736f326572a52c7b0b4c34bee33a5980a049511e0e00bc765dbfd86cf9682725a7c8b515dd70777184184fd9921a093d8f042a10842aaea4952ad00cdfeefe0eb45efeb5f3c15857e82a22b5843c0887c5236a3d12039d4ac8afc1cad5ebc3264059e06e7f8f5bff2f99ca233395b573b1e2a9c889cc68bc2682ef6089", 0xce}, {&(0x7f0000000700)="8fdfcb558abbad412e0abfc8ca2ee3867b2693b446423891ba7ad9dc22618f5a6d0b614a1b8cf2f95e2c9dbd68dbbf3f6ea0811cf4477b6ff1a1aff86dfb8a025c58ba3c4e110108efd4a6cc0c5f0de53b2950159c5d43a9f47e29b1db4ac624b8a86134574b0b6df6", 0x69}, {&(0x7f0000000780)="ed6f481d", 0x4}, {&(0x7f00000007c0)="054092d8cfc6425e21862d302eeb9de0ecc14398f14a07b02104ac5220d6b1d562e0d3f2c378259234bccc3fa02923b14c", 0x31}, {&(0x7f0000000800)="4a7906ea4410348ebf84ef27eb8e8ee5ac", 0x11}], 0xa, 0x2) r1 = request_key(&(0x7f0000000000)='blacklist\x00', &(0x7f0000000040)={'syz', 0x1}, &(0x7f0000000080)='system\\!%\x00', 0xfffffffffffffff8) r2 = add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffff8) keyctl$search(0xa, r1, &(0x7f00000000c0)='cifs.spnego\x00', &(0x7f0000000100)={'syz', 0x0}, r2) 10:18:21 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xf37a, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:21 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x700000000000000, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) [ 698.413725] binder_alloc: binder_alloc_mmap_handler: 23913 20001000-20004000 already mapped failed -16 [ 698.426314] binder: BINDER_SET_CONTEXT_MGR already set [ 698.441846] binder: 23913:23917 ioctl 40046207 0 returned -16 10:18:21 executing program 5: semop(0x0, &(0x7f0000000080), 0x13) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000040)=""/11, 0xffffff3a) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000140), &(0x7f0000000180)=0x8) r1 = fcntl$dupfd(r0, 0x0, r0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f00000000c0)={&(0x7f0000fff000/0x1000)=nil, 0x1000}, &(0x7f00000001c0)=0x10) write$binfmt_misc(r0, &(0x7f0000000080)=ANY=[@ANYBLOB="73797e30070eb04a08eaec896d06f88f85b77a10b003e13837a7a66e"], 0x1c) ioctl$TIOCGETD(r0, 0x545d, &(0x7f0000000000)) 10:18:21 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f00000002c0)="2f70f26f632f0100732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e005bc39ceafe9a32b8a9cc0475b6b0475ee76e8578289c03723c7f82ff6aba38aa56b654fcb685ac839ad008061280e81dfc09e02448258001ca033147d968d1b705b470f59a", 0x2, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r0, 0x810c5701, &(0x7f0000000180)) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getdents64(r1, &(0x7f0000000100)=""/111, 0x18) getdents(r1, &(0x7f0000000380)=""/246, 0xffffffff00000018) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x13f, 0x8}}, 0x20) write$RDMA_USER_CM_CMD_NOTIFY(r0, &(0x7f00000000c0)={0xf, 0x8, 0xfa00, {r2, 0x7}}, 0x10) 10:18:21 executing program 0: r0 = dup(0xffffffffffffffff) mmap$xdp(&(0x7f000009f000/0x1000)=nil, 0x1000, 0x9, 0x100010, r0, 0x180000000) mprotect(&(0x7f00003e6000/0x4000)=nil, 0x4000, 0x6) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) r1 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x7, 0x1) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000040)={0x43b, 0xb3, 0xcc, 0x9, 0xfffffffffffffffe, 0x7, 0x31, 0xfffffffffffffffd, 0x2, 0x8}) 10:18:21 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x60000000, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:21 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x3bdd0000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 698.677231] binder_alloc: binder_alloc_mmap_handler: 23937 20001000-20004000 already mapped failed -16 [ 698.701825] binder: BINDER_SET_CONTEXT_MGR already set [ 698.720636] binder: 23937:23939 ioctl 40046207 0 returned -16 10:18:21 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xa39d, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:21 executing program 0: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) r0 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x4, 0x200) ioctl$UFFDIO_ZEROPAGE(r0, 0xc020aa04, &(0x7f0000000100)={{&(0x7f00006cb000/0x1000)=nil, 0x1000}, 0x1}) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000080)=0x401) write$FUSE_INTERRUPT(r0, &(0x7f0000000040)={0x10, 0x0, 0x4}, 0x10) ioctl$sock_inet_SIOCDELRT(r0, 0x890c, &(0x7f0000000140)={0x7, {0x2, 0x4e22, @remote}, {0x2, 0x4e23}, {0x2, 0x4e21}, 0x100, 0x9, 0x800, 0x8, 0xa46, &(0x7f00000000c0)='bridge0\x00', 0x20, 0x0, 0x7}) 10:18:21 executing program 3: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) syz_mount_image$vfat(&(0x7f0000001800)='vfat\x00', &(0x7f0000001840)='./file0\x00', 0x0, 0xaaaaaaaaaaaab46, &(0x7f0000000440)=[{&(0x7f0000000380), 0xffffffffffffffb6}], 0x0, &(0x7f00000000c0)=ANY=[]) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f0000000100)={0x0, 0x0, 0x0, @thr={&(0x7f0000000180), &(0x7f0000000240)="a09a43"}}, &(0x7f0000000340)) ioctl$IOC_PR_REGISTER(r1, 0x401870c8, &(0x7f0000000380)={0x0, 0x9, 0x1}) lseek(r0, 0x2000000, 0x1000000004) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x0, 0x0) getsockopt$EBT_SO_GET_INIT_INFO(r1, 0x0, 0x82, &(0x7f0000000280)={'filter\x00'}, &(0x7f0000000200)=0x78) 10:18:21 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x6, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:22 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xb0db, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:22 executing program 0: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) mremap(&(0x7f000001f000/0x1000)=nil, 0x1000, 0x3000, 0x2, &(0x7f00004f2000/0x3000)=nil) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) r0 = gettid() r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/sync_retries\x00', 0x2, 0x0) getsockopt$inet_sctp_SCTP_NODELAY(r1, 0x84, 0x3, &(0x7f00000000c0), &(0x7f0000000100)=0x4) timer_create(0x6, &(0x7f0000000000)={0x0, 0x35, 0x0, @tid=r0}, &(0x7f0000000040)) [ 698.879113] binder: 23957:23960 unknown command 0 [ 698.894723] binder: 23957:23960 ioctl c0306201 20000440 returned -22 [ 698.918911] binder_alloc: binder_alloc_mmap_handler: 23957 20001000-20004000 already mapped failed -16 10:18:22 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x4b8c, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 698.982839] binder: 23957:23965 unknown command 0 [ 698.982844] binder: BINDER_SET_CONTEXT_MGR already set [ 698.982865] binder: 23957:23960 ioctl 40046207 0 returned -16 [ 698.997514] binder: 23957:23965 ioctl c0306201 20000440 returned -22 10:18:22 executing program 5: semop(0x0, &(0x7f0000000080), 0x13) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000040)=""/11, 0xffffff3a) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/mixer\x00', 0x400000, 0x0) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e24, @remote}}}, &(0x7f00000000c0)=0x84) setsockopt$inet_sctp_SCTP_DELAYED_SACK(r1, 0x84, 0x10, &(0x7f00000001c0)=@assoc_value={r2, 0x5}, 0x8) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000140), &(0x7f0000000180)=0x8) write$cgroup_type(r1, &(0x7f0000000000)='threaded\x00', 0x9) ioctl$TIOCGETD(r0, 0x545d, &(0x7f0000000300)) 10:18:22 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x8a, 0x20040) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0xc) ioctl$TUNSETGROUP(r0, 0x400454ce, r1) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) 10:18:22 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x900b, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:22 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x4800000000000000, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:22 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getdents64(r0, &(0x7f0000000100)=""/111, 0x18) getdents(r0, &(0x7f0000000380)=""/246, 0xffffffff00000018) ioctl$VT_WAITACTIVE(r0, 0x5607) 10:18:22 executing program 3: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) syz_mount_image$vfat(&(0x7f0000001800)='vfat\x00', &(0x7f0000001840)='./file0\x00', 0x0, 0xaaaaaaaaaaaab46, &(0x7f0000000440)=[{&(0x7f0000000380), 0xffffffffffffffb6}], 0x0, &(0x7f00000000c0)=ANY=[]) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x0, 0x0) r1 = getpgid(0xffffffffffffffff) timer_create(0x0, &(0x7f0000000100)={0x0, 0x0, 0x0, @tid=r1}, &(0x7f0000000340)) ioctl$IOC_PR_REGISTER(r0, 0x401870c8, &(0x7f0000000380)={0x0, 0x9, 0x1}) lseek(r0, 0x0, 0x4) getsockopt$EBT_SO_GET_INIT_INFO(r0, 0x0, 0x82, &(0x7f0000000280)={'filter\x00'}, &(0x7f0000000200)=0x78) 10:18:22 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xd773, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:22 executing program 0: bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffff9c, 0x0, 0x5, &(0x7f0000000080)='eth1\x00'}, 0x30) getpriority(0x0, r0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3) getresgid(&(0x7f0000000100), &(0x7f0000000bc0), &(0x7f00000000c0)) fstat(r1, &(0x7f0000000140)) [ 699.618868] binder_alloc: binder_alloc_mmap_handler: 23996 20001000-20004000 already mapped failed -16 [ 699.636898] binder: BINDER_SET_CONTEXT_MGR already set [ 699.648676] binder: 23996:24003 ioctl 40046207 0 returned -16 10:18:22 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x1200, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:22 executing program 0: mprotect(&(0x7f00006e1000/0x1000)=nil, 0x1000, 0x100000a) r0 = pkey_alloc(0x0, 0x1) pkey_mprotect(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0xfffffffffffffffd, r0) r1 = syz_open_dev$dspn(&(0x7f0000000040)='/dev/dsp#\x00', 0x401, 0x4000) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r1, 0x84, 0x6c, &(0x7f0000000240)={0x0, 0x20, "78a2c551cfdb1eadc285a6f674468c6f79c6a7a487139753064185993d47acc6"}, &(0x7f0000000280)=0x28) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f00000002c0)={r2, 0x80, 0x30}, 0xc) ioctl$DRM_IOCTL_MARK_BUFS(r1, 0x40206417, &(0x7f0000000300)={0x100, 0x800, 0x0, 0x47, 0xf, 0x5}) write$eventfd(r1, &(0x7f0000000080)=0x5, 0x8) ioctl$sock_SIOCGIFBR(r1, 0x8940, &(0x7f0000000200)=@get={0x1, &(0x7f0000000100)=""/250, 0x1}) syz_genetlink_get_family_id$team(&(0x7f00000000c0)='team\x00') getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000000)) ioctl$SCSI_IOCTL_DOORLOCK(r1, 0x5380) 10:18:22 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x2e40, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 699.777124] binder: BINDER_SET_CONTEXT_MGR already set [ 699.796049] binder: 24020:24024 ioctl 40046207 0 returned -16 10:18:23 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x4c00, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) [ 699.967418] binder: BINDER_SET_CONTEXT_MGR already set [ 699.977887] binder: 24035:24036 ioctl 40046207 0 returned -16 10:18:23 executing program 5: semop(0x0, &(0x7f0000000200), 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x2000, 0x0) ioctl(r0, 0x9, &(0x7f0000000080)) read(r0, &(0x7f0000000040)=""/11, 0xffffff3a) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x121000, 0x0) setsockopt$inet_sctp_SCTP_AUTH_CHUNK(r1, 0x84, 0x15, &(0x7f00000000c0)={0x5}, 0x1) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000140), &(0x7f0000000180)=0x8) ioctl$TIOCGETD(r0, 0x545d, &(0x7f0000000000)) ioctl$RTC_RD_TIME(r1, 0x80247009, &(0x7f00000001c0)) 10:18:23 executing program 0: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x410000, 0x0) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xae44, 0x20) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) unshare(0x400) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) 10:18:23 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xabd1, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:23 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x6c00000000000000, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:23 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getdents64(r1, &(0x7f0000000100)=""/111, 0x18) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000040)) getdents(r0, &(0x7f0000000280)=""/246, 0xffffffffffffff48) 10:18:23 executing program 3: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x4b8c, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:23 executing program 0: mprotect(&(0x7f00003b7000/0x11000)=nil, 0x11000, 0x8000000004) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) getresgid(&(0x7f0000000080), &(0x7f00000000c0), &(0x7f0000000100)) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x240400, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x100000001, 0x5a7, 0x6bd5d43b}, 0xc) ioctl$PIO_UNIMAP(r0, 0x4b67, &(0x7f00000001c0)={0x1, &(0x7f0000000180)=[{0x9, 0xb5e1}]}) write$FUSE_BMAP(r0, &(0x7f0000000140)={0x18, 0x200000000000000, 0x7, {0x3f}}, 0xc) 10:18:23 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xb90, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 700.603149] binder: BINDER_SET_CONTEXT_MGR already set 10:18:23 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40046207, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) [ 700.623648] binder: 24063:24067 ioctl 40046207 0 returned -16 10:18:23 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x3, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:23 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xc805000000000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:23 executing program 0: mprotect(&(0x7f000040b000/0x3000)=nil, 0x3000, 0x4) getresgid(&(0x7f0000000340), &(0x7f0000000180)=0x0, &(0x7f0000000380)=0x0) r2 = syz_open_dev$audion(&(0x7f00000000c0)='/dev/audio#\x00', 0x3f, 0x0) getsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f0000000100)={0x0, @broadcast, @multicast1}, &(0x7f00000001c0)=0xc) mount$9p_tcp(&(0x7f0000000000)='127.0.0.1\x00', &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x20, &(0x7f0000000200)=ANY=[@ANYBLOB='trans=tcp,port=0x0000000000004e21,dfltgid=', @ANYRESHEX=r1, @ANYBLOB="2c76657273696f6e3d3970323030302e4cb3b60dbb75b6f1d5761d2c76657273696f6e3d3970323030302c64666c746769643d", @ANYRESHEX=r0, @ANYBLOB=',version=9p2000.u,version=9p2000.L,version=9p2000.L,fscache,afid=0x0000000000000000,func=MODULE_CHECK,func=POLICY_CHECK,fsmagic=0x0000000000000357,\x00']) [ 700.779653] binder: BINDER_SET_CONTEXT_MGR already set [ 700.788406] binder: BINDER_SET_CONTEXT_MGR already set [ 700.793829] binder: 24082:24085 ioctl 40046207 20000440 returned -16 [ 700.800797] binder: 24084:24086 ioctl 40046207 0 returned -16 [ 700.824336] binder: 24084:24086 unknown command 64 [ 700.843183] binder: 24084:24086 ioctl c0306201 20000440 returned -22 [ 700.893407] binder_alloc_mmap_handler: 3 callbacks suppressed [ 700.893424] binder_alloc: binder_alloc_mmap_handler: 24084 20001000-20004000 already mapped failed -16 [ 700.920942] binder: 24084:24095 unknown command 64 [ 700.926093] binder: 24084:24095 ioctl c0306201 20000440 returned -22 10:18:24 executing program 5: semop(0x0, &(0x7f0000000080), 0x13) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000040)=""/11, 0xffffff3a) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ppp\x00', 0x10000, 0x0) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000240)={0x0, 0x8001, 0x58f}, &(0x7f0000000280)=0x8) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f00000002c0)={r2, 0x7, 0x2079}, &(0x7f0000000300)=0x8) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) mknodat(r1, &(0x7f0000000340)='./file0\x00', 0x8000, 0x7223) r3 = memfd_create(&(0x7f00000000c0)='@\x00', 0x3) ioctl$BLKRRPART(r3, 0x125f, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000140), &(0x7f0000000180)=0x8) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) dup2(r4, r0) ioctl$TIOCGETD(r0, 0x545d, &(0x7f0000000000)) ioctl$TIOCMBIC(r0, 0x5417, &(0x7f0000000080)=0x40) 10:18:24 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x2000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:24 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40046207, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:24 executing program 0: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) r0 = dup3(0xffffffffffffff9c, 0xffffffffffffffff, 0x0) ioctl$INOTIFY_IOC_SETNEXTWD(r0, 0x40044900, 0x81) 10:18:24 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x6c, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:24 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x6) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getdents64(r1, &(0x7f0000000100)=""/111, 0x18) fcntl$getown(r0, 0x9) getdents(r1, &(0x7f0000000380)=""/246, 0xffffffff00000018) [ 701.515767] binder_alloc: binder_alloc_mmap_handler: 24109 20001000-20004000 already mapped failed -16 [ 701.520830] binder: BINDER_SET_CONTEXT_MGR already set [ 701.543205] binder: 24113:24119 ioctl 40046207 0 returned -16 [ 701.564890] binder: BINDER_SET_CONTEXT_MGR already set 10:18:24 executing program 0: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) r0 = shmget(0x1, 0x2000, 0x78000000, &(0x7f00007ce000/0x2000)=nil) shmat(r0, &(0x7f000003d000/0x4000)=nil, 0x1000) 10:18:24 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xc3b40000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 701.592267] binder: 24109:24114 ioctl 40046207 0 returned -16 [ 701.595360] binder: BINDER_SET_CONTEXT_MGR already set [ 701.613782] binder: 24113:24119 ioctl 40046207 20000440 returned -16 10:18:24 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x12000000, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:24 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x3, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:24 executing program 0: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0x1, 0x2000) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/hwrng\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000280)={&(0x7f0000000240)=[0x0, 0x0], 0x2}) getresgid(&(0x7f0000000300), &(0x7f0000000180), &(0x7f0000000200)) r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x800) fcntl$setlease(r1, 0x400, 0x0) pselect6(0x40, &(0x7f00000002c0)={0xd53, 0x72, 0x7f, 0x401, 0x0, 0x1, 0x3, 0x7}, &(0x7f0000000340)={0x11, 0xcd, 0x2, 0x1, 0x100000001, 0x21, 0xfffffffffffffffd, 0x8}, &(0x7f0000000380)={0x8a, 0x7ff, 0x7, 0x180000000000, 0x9, 0xfffffffffffff001, 0x5, 0x8}, &(0x7f00000003c0), &(0x7f0000000440)={&(0x7f0000000400)={0xc13a}, 0x8}) r2 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x0, 0x0) r3 = syz_genetlink_get_family_id$nbd(&(0x7f00000004c0)='nbd\x00') sendmsg$NBD_CMD_STATUS(r0, &(0x7f0000000580)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x38, r3, 0x2, 0x70bd28, 0x25dfdbfe, {}, [@NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x8}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x4}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x42}]}, 0x38}, 0x1, 0x0, 0x0, 0x8000}, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f00000000c0)={0x6, 0x9c0e, 0x1, 'queue1\x00', 0x1}) syz_genetlink_get_family_id$nbd(&(0x7f00000005c0)='nbd\x00') ioctl$RTC_RD_TIME(r2, 0x80247009, &(0x7f0000000040)) 10:18:25 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x4123, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 701.811805] binder: 24136:24137 unknown command 64 [ 701.825480] binder: 24136:24137 ioctl c0306201 20000440 returned -22 [ 701.839823] binder: BINDER_SET_CONTEXT_MGR already set [ 701.890951] binder: 24138:24139 ioctl 40046207 0 returned -16 [ 701.942999] binder_alloc: binder_alloc_mmap_handler: 24138 20001000-20004000 already mapped failed -16 10:18:25 executing program 5: semop(0x0, &(0x7f0000000080), 0x13) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000040)=""/11, 0xffffff3a) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) ioctl$TIOCSCTTY(r0, 0x540e, 0xa9f6) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000140), &(0x7f0000000180)=0x8) ioctl$TIOCGETD(r0, 0x545d, &(0x7f0000000000)) 10:18:25 executing program 3 (fault-call:4 fault-nth:0): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:18:25 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x4cb3, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:25 executing program 0: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000080)) 10:18:25 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x5000000, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:25 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/conn_reuse_mode\x00', 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getdents64(r0, &(0x7f0000000100)=""/111, 0x18) getdents(r0, &(0x7f0000000380)=""/246, 0xffffffff00000018) [ 702.456915] binder_alloc: binder_alloc_mmap_handler: 24167 20001000-20004000 already mapped failed -16 [ 702.501804] binder: BINDER_SET_CONTEXT_MGR already set 10:18:25 executing program 0: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) r0 = socket$bt_bnep(0x1f, 0x3, 0x4) setsockopt$bt_BT_POWER(r0, 0x112, 0x9, &(0x7f0000000000)=0x6a, 0x1) 10:18:25 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:18:25 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xd3630000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:25 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x4, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) [ 702.522357] binder: 24167:24176 ioctl 40046207 0 returned -16 10:18:25 executing program 0: mprotect(&(0x7f000025c000/0x4000)=nil, 0x4000, 0x1000000003000002) r0 = getpid() wait4(r0, 0x0, 0x1000008, &(0x7f0000000080)) getresgid(&(0x7f0000000b80)=0x0, &(0x7f0000000040)=0x0, &(0x7f0000000c00)) setregid(r2, r1) 10:18:25 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xd363, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 702.673906] binder: 24193:24195 unknown command 0 [ 702.682405] binder: 24193:24195 ioctl c0306201 20000440 returned -22 [ 702.714190] binder_alloc: binder_alloc_mmap_handler: 24193 20001000-20004000 already mapped failed -16 [ 702.744941] binder: BINDER_SET_CONTEXT_MGR already set [ 702.748938] binder: 24193:24196 unknown command 0 [ 702.755393] binder: 24193:24195 ioctl 40046207 0 returned -16 [ 702.785691] binder: 24193:24196 ioctl c0306201 20000440 returned -22 10:18:26 executing program 0: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) getresgid(&(0x7f0000000b80)=0x0, &(0x7f0000000bc0), &(0x7f0000000c00)=0x0) r2 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x8042, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000500)={0x0, 0x0}, &(0x7f00000000c0)=0xc) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000000100)={{{@in=@multicast1, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in=@local}}, &(0x7f0000000200)=0xe8) getresuid(&(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0)=0x0) lstat(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0}) getresuid(&(0x7f00000003c0)=0x0, &(0x7f0000000400), &(0x7f0000000440)) fsetxattr$system_posix_acl(r2, &(0x7f0000000040)='system.posix_acl_access\x00', &(0x7f0000000480)={{}, {0x1, 0x7}, [{0x2, 0x1, r3}, {0x2, 0x2, r4}, {0x2, 0x2, r5}, {0x2, 0x7, r6}, {0x2, 0x3, r7}], {0x4, 0x7}, [{0x8, 0x2, r0}, {0x8, 0x2, r0}, {0x8, 0x3, r1}, {0x8, 0x4, r0}], {0x10, 0x4}, {0x20, 0x1}}, 0x6c, 0x1) 10:18:26 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0xaea3, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:18:26 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x7af3, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:26 executing program 5: semop(0x0, &(0x7f0000000080), 0x13) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000040)=""/11, 0xffffff3a) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) clone(0x20000, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000140), &(0x7f0000000180)=0x8) ioctl$TIOCGETD(r0, 0x545d, &(0x7f0000000000)) 10:18:26 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x4c, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:26 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000280)={{{@in=@remote, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in6=@loopback}}, &(0x7f00000000c0)=0xe8) ioctl$sock_inet6_SIOCADDRT(r0, 0x890b, &(0x7f0000000480)={@ipv4={[], [], @broadcast}, @empty, @empty, 0x5aa, 0x7ff, 0x200, 0x400, 0x9, 0x20000, r1}) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getdents64(r2, &(0x7f0000000100)=""/111, 0x18) getdents(r2, &(0x7f0000000380)=""/246, 0xffffffff00000018) [ 703.378492] binder_alloc: binder_alloc_mmap_handler: 24218 20001000-20004000 already mapped failed -16 10:18:26 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x3b5b, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 703.437059] binder: BINDER_SET_CONTEXT_MGR already set 10:18:26 executing program 0: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vcs\x00', 0x2000, 0x0) ioctl$ASHMEM_SET_PROT_MASK(r0, 0x40087705, &(0x7f0000000100)={0x7, 0xfffffffffffffff7}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000bc0), &(0x7f0000000c00)) r1 = syz_open_dev$admmidi(&(0x7f0000000040)='/dev/admmidi#\x00', 0xeda, 0x301) mkdirat$cgroup(r1, &(0x7f0000000080)='syz1\x00', 0x1ff) [ 703.461962] binder: 24218:24219 ioctl 40046207 0 returned -16 10:18:26 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0xa000000, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:26 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4068aea3, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:18:26 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x805c, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:26 executing program 0: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x109000, 0x6) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX(r0, 0x84, 0x6e, &(0x7f0000000040)=[@in={0x2, 0x4e20}, @in={0x2, 0x4e21, @multicast1}, @in6={0xa, 0x4e24, 0x9, @mcast1, 0x401}, @in={0x2, 0x4e23, @multicast1}, @in6={0xa, 0x4e21, 0x8000, @ipv4={[], [], @remote}, 0x5}, @in6={0xa, 0x4e24, 0x5, @mcast1}, @in6={0xa, 0x4e22, 0x3, @remote, 0x1}, @in6={0xa, 0x4e21, 0x8, @remote, 0x8b}, @in6={0xa, 0x4e22, 0x40}], 0xd8) mprotect(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000000) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) 10:18:26 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xf2d0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 703.644913] binder_alloc: binder_alloc_mmap_handler: 24246 20001000-20004000 already mapped failed -16 [ 703.668863] binder: BINDER_SET_CONTEXT_MGR already set [ 703.685945] binder: 24246:24250 ioctl 40046207 0 returned -16 10:18:26 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x7400, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:27 executing program 0: r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140)='/dev/audio\x00', 0x10001, 0x0) ioctl$ASHMEM_SET_PROT_MASK(r0, 0x40087705, &(0x7f0000000000)={0x9, 0x8}) ioctl$LOOP_GET_STATUS(r0, 0x4c03, &(0x7f0000000480)) r1 = dup(r0) mprotect(&(0x7f0000507000/0x13000)=nil, 0x13000, 0x2000000) fstat(r0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TUNSETGROUP(r1, 0x400454ce, r2) [ 703.854039] binder_alloc: binder_alloc_mmap_handler: 24264 20001000-20004000 already mapped failed -16 [ 703.889601] binder: BINDER_SET_CONTEXT_MGR already set [ 703.895874] binder: 24264:24265 ioctl 40046207 0 returned -16 10:18:27 executing program 5: semop(0x0, &(0x7f0000000080), 0x13) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000300)='io.stat\x00', 0x0, 0x0) ioctl$EVIOCGMTSLOTS(r1, 0x8040450a, &(0x7f00000004c0)=""/32) read(r0, &(0x7f0000000040)=""/11, 0xffffff3a) fcntl$getflags(r0, 0x40b) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) ioctl$TCSETSF(r0, 0x5404, &(0x7f00000002c0)={0x16, 0x8000, 0x100000001, 0x6, 0x200, 0x5, 0x94f6, 0x13a, 0x80, 0xfffffffffffffffa, 0x1}) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f0000000380)={0xcc, 0x1, 0x5, 0x2f57cabb, 0x0}, &(0x7f00000003c0)=0x10) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000400)={r2, 0x4f, "e5a77db806ea8a8f425a2f46e9363642c73ad57bb153dc95e6703b2eab6225d8a6a34873037b1265fcfeedb88e573b77f0f9adca7305ca2216234c655e9edcf319ddde8193f243091e13207423802c"}, &(0x7f0000000480)=0x57) clone(0x200000, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000140), &(0x7f0000000180)=0x8) fsetxattr$trusted_overlay_nlink(r0, &(0x7f0000000000)='trusted.overlay.nlink\x00', &(0x7f0000000280)={'U+', 0x7ff}, 0x28, 0x1) ioctl$TIOCGETD(r0, 0x545d, &(0x7f0000000240)) r3 = socket$inet_sctp(0x2, 0x5, 0x84) accept$inet(r3, &(0x7f0000000080)={0x2, 0x0, @dev}, &(0x7f00000001c0)=0x10) 10:18:27 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xeb46, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:27 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x8090ae81, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:18:27 executing program 0: mprotect(&(0x7f0000544000/0x2000)=nil, 0x2000, 0x1) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000080)) 10:18:27 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x7a00, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:27 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/secure_tcp\x00', 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getdents64(r1, &(0x7f0000000100)=""/111, 0x18) getdents(r1, &(0x7f0000000380)=""/246, 0xffffffff00000018) read$eventfd(r0, &(0x7f0000000040), 0x8) [ 704.344863] binder_alloc: binder_alloc_mmap_handler: 24282 20001000-20004000 already mapped failed -16 [ 704.374116] binder: BINDER_SET_CONTEXT_MGR already set [ 704.383146] binder: 24282:24285 ioctl 40046207 0 returned -16 10:18:27 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xc8be0000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:27 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x6800, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:27 executing program 0: r0 = creat(&(0x7f0000000000)='./file0\x00', 0x10) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffff9c, 0x84, 0x22, &(0x7f0000000040)={0x7, 0x8000, 0x1, 0xfffffffffffffffd, 0x0}, &(0x7f0000000080)=0x10) setsockopt$inet_sctp6_SCTP_SET_PEER_PRIMARY_ADDR(r0, 0x84, 0x5, &(0x7f00000000c0)={r1, @in6={{0xa, 0x4e24, 0xff, @remote, 0x2}}}, 0x84) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) r2 = getgid() stat(&(0x7f0000000180)='./file0\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getgroups(0x1, &(0x7f00000001c0)=[0xffffffffffffffff]) r5 = syz_genetlink_get_family_id$fou(&(0x7f0000000340)='fou\x00') sendmsg$FOU_CMD_DEL(r0, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="05000100", @ANYRES16=r5, @ANYBLOB="11002cbd7000fbdbdf2502000000080004000300000004000500"], 0x20}, 0x1, 0x0, 0x0, 0x8000}, 0x80) setresgid(r2, r3, r4) getresgid(&(0x7f0000000200)=0x0, &(0x7f0000000bc0)=0x0, &(0x7f0000000240)=0x0) setresgid(r7, r8, r6) 10:18:27 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4004ae8b, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:18:27 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x60000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 704.563878] binder_alloc: binder_alloc_mmap_handler: 24307 20001000-20004000 already mapped failed -16 [ 704.604022] binder: BINDER_SET_CONTEXT_MGR already set 10:18:27 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xdc05, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 704.625444] binder: 24307:24312 ioctl 40046207 0 returned -16 10:18:28 executing program 5: semop(0x0, &(0x7f0000000080), 0x13) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000040)=""/11, 0xffffff3a) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vcs\x00', 0x5c200, 0x0) write$USERIO_CMD_SEND_INTERRUPT(r1, &(0x7f00000000c0)={0x2, 0x3}, 0x2) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000140), &(0x7f0000000180)=0x8) ioctl$TIOCGETD(r0, 0x545d, &(0x7f0000000000)) 10:18:28 executing program 0: r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) ioctl$sock_inet6_udp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000040)) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) getresgid(&(0x7f00000000c0), &(0x7f0000000bc0), &(0x7f0000000100)) 10:18:28 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0xfdfdffff00000000, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:28 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4048ae9b, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:18:28 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x90c4000000000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:28 executing program 4: r0 = accept$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev}, &(0x7f0000000180)=0x1c) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffff9c, 0x8933, &(0x7f0000000280)={'vcan0\x00', 0x0}) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f00000002c0)={@local, r1}, 0x14) r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000080)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f00001f1000/0x1000)=nil, 0x1000, 0x4) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getsockopt$inet6_dccp_int(r2, 0x21, 0x10, &(0x7f0000000200), &(0x7f0000000240)=0x4) getdents64(r3, &(0x7f0000000100)=""/111, 0x18) fcntl$setsig(r0, 0xa, 0x32) getsockopt$IP6T_SO_GET_REVISION_MATCH(r2, 0x29, 0x44, &(0x7f0000000040)={'ah\x00'}, &(0x7f00000001c0)=0x1e) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r2, 0x810c5701, &(0x7f0000000600)) getdents(r3, &(0x7f0000000380)=""/246, 0xffffffff00000018) ioctl$NBD_DISCONNECT(r2, 0xab08) getsockname$inet6(r2, &(0x7f0000000300)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast1}}, &(0x7f0000000340)=0x1c) ioctl$SNDRV_SEQ_IOCTL_DELETE_PORT(r2, 0x40a85321, &(0x7f0000000540)={{0x7fff, 0xffffffffffff6bc5}, 'port1\x00', 0x2, 0x2, 0x2, 0x0, 0x80002, 0x5, 0x3, 0x0, 0x4, 0xc2}) 10:18:28 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xd86d0000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:28 executing program 0: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) r0 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0x4, 0x480200) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000040)={0x0, 0x7}, &(0x7f0000000080)=0x8) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000006000)='/dev/ppp\x00', 0x0, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000001000)=[{&(0x7f0000000080)="ea082bb504cf374d", 0x8}], 0x1, 0x0) socket$inet6(0xa, 0x0, 0x0) ioctl$EVIOCGPROP(r2, 0xc004743e, &(0x7f00000005c0)=""/246) clone(0x2102001ffb, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) ioctl$EVIOCGREP(r2, 0x4010744d, &(0x7f0000001000)=""/174) sendmsg$IPVS_CMD_DEL_DEST(r2, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x50000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x1c, 0x0, 0x410, 0x70bd2a, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x10) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r0, 0x84, 0x66, &(0x7f00000000c0)={r1, 0x1}, &(0x7f0000000100)=0x8) [ 705.303271] binder: BINDER_SET_CONTEXT_MGR already set [ 705.338863] binder: 24347:24352 ioctl 40046207 0 returned -16 10:18:28 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4020940d, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:18:28 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x6000000000000000, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:28 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0xffffff7f, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) [ 705.500364] binder: BINDER_SET_CONTEXT_MGR already set [ 705.507676] binder: 24372:24373 ioctl 40046207 0 returned -16 10:18:28 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xe8d50000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 705.650903] binder: BINDER_SET_CONTEXT_MGR already set [ 705.669713] binder: 24388:24389 ioctl 40046207 0 returned -16 10:18:29 executing program 5: semop(0x0, &(0x7f0000000080), 0x13) r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/snapshot\x00', 0x40, 0x0) getpeername(0xffffffffffffff9c, &(0x7f0000001600)=@can={0x1d, 0x0}, &(0x7f0000001680)=0x80) setsockopt$RDS_GET_MR_FOR_DEST(r0, 0x114, 0x7, &(0x7f0000001780)={@xdp={0x2c, 0x2, r1, 0xf}, {&(0x7f00000016c0)=""/116, 0x74}, &(0x7f0000001740), 0x6}, 0xa0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) read(r2, &(0x7f0000000040)=""/11, 0xffffff3a) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000100)) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) fsetxattr$trusted_overlay_upper(r2, &(0x7f0000000080)='trusted.overlay.upper\x00', &(0x7f00000000c0)={0x0, 0xfb, 0x23, 0x4, 0xfff, "788d0c0eac3b894acb6d637ce88c9f04", "1942e65b5d097fb0aa5ed574a674"}, 0x23, 0x1) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000140), &(0x7f0000000180)=0x8) ioctl$TIOCGETD(r2, 0x545d, &(0x7f0000000000)) 10:18:29 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x5460, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:18:29 executing program 0: io_setup(0xff, &(0x7f0000000000)=0x0) r1 = socket$bt_hidp(0x1f, 0x3, 0x6) r2 = syz_open_dev$mouse(&(0x7f0000000140)='/dev/input/mouse#\x00', 0x5, 0x84000) io_cancel(r0, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2, 0x1000, r1, &(0x7f0000000040)="48ec892b6b052b69f6e1e2636a2f6778d1ba94d44c881dce25355581d9b582edf16f486250d0a3fe8a16707dc9ba46542584d10dba32c1bb76be8ce14b7a5095413dd862b9e53443116df722ab58dc8f2106b6b2ba2902a77911f46dd8a0859ecd7c48e807cfdd6de1599510115ebc8b9fc61d0d7538770192a596a929a211d58fe5af627fc3fab8525364ea88efeb60c25c57cc78137e482cd6671df7cd3586f2ddb0e5d1918687362a32a6163adba2073bb4efe0103c7234be0948c6bf0a4f0f6efae887a703ac0ca9fedb6f7ff44d2c9439af7e5bafc0e3d361bb7478637397aef1", 0xe3, 0x719, 0x0, 0x0, r2}, &(0x7f00000001c0)) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) 10:18:29 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x7000000, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:29 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x9c18, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:29 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getdents64(r1, &(0x7f0000000100)=""/111, 0x18) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000340)=0xc) syz_mount_image$hfsplus(&(0x7f0000000040)='hfsplus\x00', &(0x7f0000000080)='./file0\x00', 0x80000001, 0x9, &(0x7f0000002680)=[{&(0x7f0000002840)="90e1161b989ea4bd42dc0fb49804752ea1e56ab2b7630f30bf4058a4d7dee82683397cd4", 0x24, 0x7ff}, {&(0x7f0000000180)="1b6f3d024fb8d706451c7248ee56adc8136f187f373d594b8c099e8ebcc7e989a424cba0e581b0dba2c6013fa343b94bfd174b7ab15169aaefe77d24cde09711d5b0eba779be081c0d985542a230adfa60a1e10df3f48e81d3d0794e9403c9cd04d96e83356d75bfd8f76eab", 0x6c, 0x7fffffff}, {&(0x7f0000000200)="684d0d56f718781b14a1370a4cbc80a2177ac201b59189704a0f5e414e74b67e28b37b72b733c96c6b5902", 0x2b, 0x9}, {&(0x7f0000000240)="4ec7c3680a5b43ae521ac69ddcc757527fd4aa9ec2c9522a81d9b3eec3d757b641d59f4089afcebae7b7e212f1bb3985e56d7b05fa64da0028ebff39d8d00f1b30f0041c4b771685eb9d135e998fccf3623273ea62e4d2608dd34ce5cd503eaf666b52a638ad2c1c81102cd5b90613bc2b6ea35949da4c01", 0x78, 0xba61}, {&(0x7f0000000480)="abc772ea44e5e2ac85804774e99c527264a11ac43026095216ad4885698f32f522d9b80d46646fbc3a3a5ecf50b5bc3adeb1df1cf6da98e93724b69c5876797dc97d746ff64138f9e50df41cdb6e2a438b45e0a8c27933f58bc792501dfe602f5efb1387077c44f10a789bf8cfda1a2f5aceefbff1317591891f436c382ed1f8f5532e7fdd9c7366cfbfe6e85ee400bedc956c30df06390c8b9b4322ab92c862ae6f8787caeee4e0ac1c328e2ee947066b504992d6b7e3ceacb0bce53ca0a04a53346d3909e6e4408aca15541f2a0c04240681bb61e04973b6db11e5871e34117185934ca8f9a8ec68c30fd5c5cc214d", 0xf0, 0x6}, {&(0x7f0000000580)="7790f083ba59457d7a7df30acf7c16c26cb145a7d117efa5ff95680a4ff9f87de721b4212cdf9c53b68294605b1cd4fee73b3c3081023ee2decd53c8137962d4acbf8af336d596d22f83cc088de40a4ab0696f6110e8e480170b85445df99b65039aca8fa5f77e342c832e8999f3bf917f703d19fcfb0de6de542bdcaa99dc2c30988437a414dd737072fdfe9db951d2569e7d13d1ed0cfe4a468956f84de175e1e9042d5ba736db6f69d9b2c299026ca0d9b70491300189e1dac98329bed43ba1614f34ac502f9ed98fdc9a58f0170658842ad96f61af57d324bf9fc63b8bcbfeeceb808da3e7ed750f80", 0xeb, 0xcd}, {&(0x7f0000000680)="64655bc8d3d43ad7becd82ac97b0401ac5169b6b62d6a96b6dee4ef0fd684c29089fc7c08274e1cd0bf86716fb458255c30108f3c24b0c7f8f3a970cdb80b180158e11103d186766c1e8f021e3b58b7ae0e76d9089167b80e5958a8eaa66c69db061443a2c785d18099481536bc85870351d49d52bdf7d6f8943db47eb84e13e78414af198cd9df3b9c0fd12a72cb8c3828b2d0208b70c39220f0899676bf653875ad11851215219f578513a0a7a55196b47678ac7c7bbf94d3a85db5beede2109cad17967b54981753bccf8f8686c0722909030e8dced508ba603c54619fd4703866b5ff9a77f9b8b8a65a88f77c897129e32a84c27523f7d63aef19bbed3d3de71a3a5c90a7bb0293747883283939fddf62dbd76425bc1a1adb26359b4e2ce49af5ea1d7b31f3b4125d21c9cae243266a93f2114b7e11bd7f2dca7a0c55ad774ed0e0c18c8ccc8e06f840ac3b692970733c22381c3acb30fba91dd89a7c46140ad09bb8a26c98218f280011f9aea80f7f5dfbfb71f832d942056ed05b170298824c2496a94e9cc6982c0c2699fa60d1e159500732d2df8108ebee54de35d39c5c16e0bd05c8020b284e3b558f15e2c291d2d019b1d29dffdffc202a37adc650150c77e964d0b18f2e9a08975257d831987fefdfc953ee37534cd4b69368169022f766e8414b997e967d3345eca50a15ce1f9dcd2f6a51c55dd5dbc470d8a99851f9c7cefd67d4b8d5ed98fdba0ec2f7a154c130fa2bd3e492ca4e761e98724d0de800f9840c6857f76e854c4a8e88f1f794d3730b34d782b592b2aa1c788949316001346d356a85662bedb948b46e77a5cdb831b9812fdd65c166b5a40e9f6fc63fc96f7bb9a6a819167288ec9c18a77db196c913491377066e27d696bc4f320beb6623399ec8f25fc3651328706332b9018849577147807008e9c431b20bb9c2f25d319db94eee100b0a29ad95e3e213352f7214bdd66b53d138d1c1e8f0f8e6e575979f93633737e532ecafcea12824b26f35e14bc945cce318b0d5664f6c5637897ca9a89f7a37347747721f903f530327e26914ddba6f2003a9f551ed8fc2ef94bfd240f9b94a71867369c26f6e1eca96444aacfcb85133a347eb9c1f5f94b8eb4c85824327a16259d50cef1aab4610f68ec8590512b833c2e6dc1f0ec158ad947deb04fd9029102bba1695e9a32c6be4d3a9812d30c05545999675e24591e01a48d97493c341de448efeee0c7ec2a2173d8537d3c1734f4c0dc70980a39d57cf01fb06fd35d42837f2c8e9d2a9c5fe0ca1915b4c38102a3d6178c5e7b21399c304d623ff4e88c0b5253d5b228ee5e53a796c58fa3a972de39495f3a9eeb2beedd1eebcdf559353f3227069e86056d2d0f79fd26ca54c96b58df3a2672364595908847e125161c919a2bb364820b5a64ecc4f893998661589458d55bbfc4633b03dba7b100608aa7582cfe8248f6292f956827040c9b57a9bce113022847a96b40b150c3c2b4259cb059fc3dda7df8498b49063b9a6647618ed3d137f3da2bd0947da51c7ab9feb79af9be634dcd0f66ac3d84cda4b7604d49c82c03e3bacf43ad23b8e3a032e59430f98596d939a63110474ad59369d80546327713b0a66c39b9b39fd8fdb30088b969c400b784870dada46d289b2d886c2446b42231419c73269e6fbd0b2640dd37625e74d9d7fcbdb8c9605f1550fff866923cccaf8cebf54a62312f1035109b6c030ae9b27904977f11af233e5b3cb3a89eebf9be44bbd061a8658c4cc78a1b9ee0e66e51024fca2a089cc0e826a5b8d4b54c6e00b2312d7dc858e7749a3603f36eb6137df2175b5d4fb80d663d7317c377bb0d10b64e83a98f9e5b778bee8673b9cc2585746d9cc9546ee41f90e6b0a906bef2033ef58f1426d2fede0daebcd9afcdd52d230caaf725ca81c36cb93956ef1797607cc75a64d14c1f624bd0c784e6ef22e5d063338758f28468b36d1a13eabb7b8f25c85af9696c7d4fa98e7555142321c811b5d5253e44f10480ef2ff67b5ab015425dceeb5df3472b2c2f440e8ea54e55f800e9aebfb143c9107b99779fc182cdf7d9a14b50129c93323547e7547203b8d9ad5fce9de06e47452ad178dd9b152388f6f4b63080838081debbdf373c16951e2586e9765d290e4e6a61332a3f618f8b9f7f178c4790a87531f70baa68755d5f05d8c44257fc91e778704c52a955fea8e0f479491cad679c7ca63fca1641127ee45dfda6b569af41f74665ade03e5ccb09fe24103594fb3b2180dc5d6b40fe5da2e2530cb96c8440654214ae0b8c9a915f10859ed6cae14d1412655471608d8aab5dc38cd559bbb9f48da998e9186a8e3ba3e5d71bb5398e4f1d740f2796f8876e54a3ffa506e4970b1c49264c17fbf3e24952ca5bbfaa02378928b5dfa77e25a9090b702a97fe8b7a790c3a928908243bad0c66a35176afa5ab93fd359abc7328eae99626a5066c377b7a5e6723a9251367136d76dd2147cee33b3ddd5399ab95a39824591bb009ee0302935a6d5832924b255834684f4e2ca2c3919f18398c48584878eb5de1a76d988a4876170149544f3bf5726832a182e573573c5ccf03406005296c5b09a34f25442bc3d486ce4e4506633302303a5d95274b1b3241ab953306c1d01ebaa1f4f63629cc6bf22f8b20aaacf42e06bb4459b1cbc1887eb1ecbd5f3eac3c085565d88920628216db0d55ec62e84de5a93f674676bd6e8cd72b04f754bc3a461f3ef92332022ad4ee17827a76fe84149253e4cc16fb793b089dd96e1d4b1f2c643b8e79404c3f2445800eda58908ce2cf53ff60fc5d77596c58c205ffeb0c04e3c9b8954e78c5c085cd21545613764f94e18d909d802f355efb39a6585e7a5e1076c45e95eef395f77981018c6b8448e04dfc92a7e2af65581b400bd69cfd78cae7a34184146c0f132e94a85b157f8f17ef55ecfc4b2ff1aea822ed1b63b9ad5c73fac20f6d5fe4c5f7f79085adeddde75e2f5d804259f3ab5538bb638c41519b9b91c066adabbde02badc04d527993ec9800a09f9e29caf708506301a985157f2b90ab5a20c0315fa566077ceb13d885fca4a29f627501fa390bfba1cc978edcf0a51526b51a3996d550142de8b87668a01b568e72008877d06b8f34e382c479d56893d8a2950b9b18237844e82d6c4176a1e3eaa0d9c9cfa2449aafb24b46d65cfd984914c70694103e9a21b4249a53003dc8bce4704d2fda7121f95cf70d5ab12bb3dcb57b2317a84e040217097d959a9e7a3d3d6c193e0185f12b236910c3595a372431ebd4a00528a7ae2712ad1e767ba1761fd1e038fe172acf011bebc79269b3541ff5550416bb9064f885007b40ae37a062070a7a69901be9a15df6cbeb61c2b7ee9a8b86f77a90efccdc8f7d3d5f225f7ee73706387325acaa34210184234817b69f731f474346d66adb2798649fe8e7b7f0c371bfaa9074d7f4b628ab40d06574e94450403f6e2fa4fdd1ec7117f13158f6c5cfcadc11e54ba3596b5ed64522fa653014977b178362e93e08d3863355612046f75878612481f083d21900c2456db7b5d7258fa782fc97f4863ea27356b8a19f31980892575cfb43d94c2470cae7b95e64b254e81f7d7089603f7e41af56f084c0f0166b5021446db92413dfc67d61b29a4cdbde82b8053864c3ba56949c8a572d630b2892ba2cf677d60bc9193cdf56ad59526e3d4550b0cd55220733845454503ebc14efdf569577409e442593f7fe84fb6a1c866ee93e43c87d09a56753f2a7c602502ded45a777217ee337cc8efa659ae1cf3a2b3a4b1156711f9446a84e1b41355ea98f17389a9227ae55479bb5bb68502f3d61b4dc155708c112bf68959988fca3fa70f5986d7d317d9edc16d6f17c8a29645fdf90f26bff75e34cc55c3964fb7dc109786969997ee154159280eb5e60f44c385a767f77bba024bb6eb1eee22130731a8b73e52b54c92870f1377582ad357a0fd263e3f5a3b3e2cb70302fcf4189cba242ea5ec9d256e344618b9de3685b537d8e85e35a07fe7fa0463155dee78b90cdfedc95615b036b5ca21e686cfe2dddb65580f7b59fc8ae8a890e301f7a4bcb3452ab61f808ffbdafa76cfc9e42be2bf85cec3016badc8192ac36ff0aed9540f07ead989effa23a903cf4f8d06eb178409b631df2c2f50308acc6f87dc4b0d0561702dd7b09c63f8a9bad64d7d299572f90927849cac7115d52161f4c843ad09a5880c8761ac0afad4bee8c1319eb70d70073d6cca091fc86131d0f65a236d49880e01515b4162c83bfe4a47caad1e79c3010cd0882669844d9043f96eed4cc41ef8322c04721150effbff22e5050d571ec77e5fc1d85221f36c101519393811e683dc1ba3ac5ae47fc85c8abe7c5ecb5e04abde5fc28b7048b59e415448ddd4401609ee41c4d6c36561d56e485698828c2851b38d5b1bb0cfbd4b770fe5589d8fa2ecd1b2569af67e9eec085079ac93cbeb3eae03ab755ad33685c130a92df7065151144f58159e3444682dbe86f4e4529e37052f4943ec4e86a5804f8016ba536123a28bcdc31e25f5a204bec02f62006e55700833d4a94deeceb21ebc178aec408d3178df05b095bd71189690aa8bad99c484580c028039ff2b58f6446d9b57e779454b0d75d8b8179b8f134dd610fe392368635495dd4d1db26dadb5461ffd4cba3f5b7d7ae34fa946d90c62b36811e04db2a815ae07da39947eed24bc0ca0959f4167abc6139f6273e8b7bf7f260ae5aa9c1301d1273a435e9c329a8cf651e49e43cc6513e4a8477b7440a91c638ba80d75a844109dbe844007715f984149ba7b06f01fe22ad43715665a679645b3bde2370cf0835209719bd020fd33c0b261c7dbd371dfcb739d14bc56f5d106df6486f18437521a01499256967793c4c22be44cb555ff1e1e351d65631d6b8c0252dc7d9f06a66bbf190799b97b73649cc68dd60ff40edf200db8b2ddf17b9d59bf51e8df30f82083f5be1ff1fa9fb2767713a48e8ba5064f898c32440dd8674189b6a574ab3e0095279f77ca204347912c10d404c74d3f98236b3f8733383f1924d146ebdc834014a19e1f1ca97c68e01e67bf6eb30072b6c30ac60da4222c03de02695a876427556058ce1c250907341c3705ed85ca0d25749b194941145ff76ec5266a35f96174ec40da519d6d3b5bbdc411f7b9a4f089ada7350c7ea6a708b81a3cef4241d586e45c2eaf82797cc99fd985d367d4f31a55fc5a5c8fb881c56e4027ae5ef2188101de690534da211ce942d8c66afab77bd6b7eabd3f0a1ffd23df61a7d116cedb69ac1d4acbbaeb2eff249ec42a0d150aab215813560f3f5fdb649171855ed205a5dee95bfbf881eeaac39130e4df2c64fc237ca6e6def240ad8c32edd267f39ce509cbc25ac82bd8752c426347c96406472c5e37f98253a5e6ac1907e9708b1e66d579fb9ece248f96564a15e18d190d85ca34afc73519f2a4a2cfbb61333a71e22bf11a7b3f7a038d235d66c0502c3ef0ef7c1be245f7305774aa5a7353172ad7d238de9f6101acb19e1093e519491acbc54d4d14f57f1ba9707c2795c18f2a1e1c9469c88b574ca80981d8a555d1380add13de2eb88462743bec87b49f0f4668f23ee4d9760a6663a21c9cb2339a6ffc762f02219855d92a5efb1cd6f8a94bcbee293a457043da682adf8189fbeb05e0d00684e1017ea90126318f477c0696967b52554726c1a117a748035140c26f1a6235ef3cf2d7e675ac57c8930ee0760742b9e43abba11e34fa3198ece08628aa4", 0x1000, 0x100}, {&(0x7f00000002c0)="b4909b3887d0de0e5c9ab6e1f1a33ccbc0d06b8a088c719b37b772c27e3e18f358b1e02011ecba5bc2f4f7", 0x2b, 0x101}, {&(0x7f0000001680)="2b3fe24600ef2e280f3ca22a7f8a4d0f543de78b99c5f29d723412b897197b2fb4a8617597c16de8a267df879ed27353deab8dad1f6b98de59d8368df3f2818784224e42a388be49f254f0154094cccbb3190c8e938d725ec90997a297251c1b473e1824b7ff9397d692b9a1c428623b886a0d6d7cc7f5cf413ad3c46a4b1c78246f300eaa7d0ec890be4950a11d35f82df520f7f890e6ddb0e829709a9644a966c82e0c7d20dc8fc3ff14f4596f579c1c44d83776ab95e1fb1394e62c2c35a7ac72de1fff8fe4aa8c4fda69212afbbbbffd4c79548941905c9b343b6e5562ebe239e65f44bd8eabdfa8ec54e315be8be4667b065af63f91ac2a772c01a5a3a770d32384ca2fe31ca691d493703b3540467cdc9e6cac71ebb06200c85efc208d73c702ca0a32eb2dfcdcf6a3362e222d152100002f84a3b6e108cb81e5b7a4032c3b4ed8aa93bc3709a4043243072628a6a7e260e957805f81c589c782459790bac210cd4db8ede66441533d49cd578ec9c561a50dae10ad62f074c3df16bdf3e744bfe13fcc1fe78ad842953ec6630f1a063876ab32328392115667dbf77a4978dbc75ed9e3192c05f4a7f1ece387390ff5eb1d5a158183f5fd20ddc07da9fd9ce4a7c9599030f273a10246b39bb7c9646a5472c4579322510ffcd381c1e9ab1accfdb5c764a02c206ffe4d30e516cb5549ee0bb4b629a8bd591c6c89f822e57d8b89d9fa2a23bdf807f0f4b53293aa07e4ffc2c876eaf5fff535ed223f4397cbeb24aa3149191ad6fe8db559fa34a75d52d55f65c014ddd038a7b773a1b82bb986bc37b7a24621f4fafb2332c6d8b5f0e69611cca12e76486d3718e84a7f526788eee24f177f8f9c23ef0951cf55ebcda14daa9340555f1a76f9ea56c5fc0b372a3bf8667b96b2154278139552699b9f75f2de4cd7aa78bfc0653588bf4ee8326848dcfe697b25d7832696fca7c32e6285695beb4c42e2359d963e1708fecf772719a31cedac5816ae9fe50622b83167a95224904f60722c46656d92d014dc399479fff0d21f23e09a609ef0b7b916a13bc3f645ad4251144ae098e3758e7c9483566c2c9145eca7d14d76dce0953e2956c200858f0b1fd18dee1c21ead93f1ce604fe51ac217645d95f56171efb02951865783373d975b50b3afb0bbbe516e144b1191cf46bf385bd8c8bcd312d9d91358d172ef733f34c6c26fdc9d66d4888146b6140b0bdd5071d01a7541e8bc6cf43275a8fc1032ff19dec4e05725cc9b2d06c57dd7f6d513c111a2f1979f2122c382b6a7c0a3278bae0c35dca3a5695d7ed4e9c72090fb31cc4f2a83cafe7f58f14c932337ec9fceb614ba9dc93387df07353b613d932a62489dae00b6e97c794d9cd27512c9b0f488a727ffbc316a076268b91f0af36ea4a6fdca334f6df2ee2720a24312356b23437023b966b0031f168999dda5fda4746bb3bcc7b6aae9e7280a0b181ad143beac8ae0ef385de3122d11f1c90b6827fc0d4d3a2b8d8b43eaa7159c856e5ce728642ace11800ca15ce93cd2cddd49ffae5b3586be122873a60d04f65d0469c284ca1291583ef16ab291a0f874251b52cfa3d61dc2f5d80752d87d733d72ba5bdcb3d0a24e697b656b1f4ee59a3a8dbda2e7f5346483919ba1b882fd218f15c3e8ae4c88ed1d2a4ac98e96fe30dc22b2772b504f623a3ef477c6efe1b3ea17f582154dcdbf3bc024f7e7ef71849b30e6520db6b9d78327f051f3e1ee6f669384d1d1e7431a5087acff2cfd234a3e8dfb051c19e07d1645fb5166905d7699a28f5aaafa4656283de11972b4e098dac492d365bcdffe3599963b65bc385ea1c4210e4dcf953d57a3926c68c23bd9f2e062aea8aadb430acb745db75f5b06bf028afc626416572ccb4edd22370499b7509af0de6e09d98d1176b50928913da2025b344c54c3ce0709e1bbeb73d7bf6163344f99a1805f6182d4001eb1a94174d7186b9e95982c6089d9d5c318628e0f8a2eb972a942242e19a4b6e176d21cc7d1e90e5697b5e022e50fbfecda14cc683e4e2fb166f95bffe7035e126019dda41b5789499b3cdcc91eb785be7cf3fcbfc76867523fc30f97e82d193a5d886da4de300020d29700fd5fb32d68b95fb6664bb755e374e8daa971aa7071d3a4f3fd5609a91151f694228f936a3640678e1794e45b99d58e1154a786e26605d818757a9348f8104aa931bd78ad70a12d75e1cc36699bfbd05c26c42ceff94b375ea3a3e4fb55c09a878474c2d6c6707e560a1da721ea2c9765c52fb965fdc47a26cf1283de60f217708990309d4e9306472b4676b6f8092c7a78f0e119b5e68be290b511e0ca8a80b8ad44a50122107ab4a99cc315a8d8b125a7a47470fb5fadc0eaf6b282d430bac230cf769de3c434af66b7803443ed45c808968b0cc4e33729362ab3184242cf384d6a99950f1ad43ef8f6db0b5f575e22b4d061800321ba76b71ba41c48047e2c8afd534c581fe7b2fb527127f565472aa289017ba065eadecc2a2455926c51f604e44b290770147116afcd250960c430c317076a4a180441960d1709996784b9d1799f6ed1e79a73496bdca0ffb1e7ddc1221f6c8f6f109409769e0840df0620d3c3b349ed2c8565dc9eb90105464db0cd7fc6297713f708088978522c3082cf93b6393c2ade5d54fb51f5e99b40f05d0a1fdba65986f1a81b4c44c4869d36742e1b6d59dbf1c08ed2f363ca8b95dd9b7421a26c507d2729c724993579cf3fedf0e68196a80fe9652175e780e0ee0a47d3b7847fc684f1e6b1b1fbcc9907ab5cd1fa5276709c92a88c6a7a5cb9c2a230bb217ab856b85c490601627990f783bebc8eb624a865bfba00d5c516b58a38ac463fb444b33a3cbf94d460d7bfbb456a0fa248fe45c522431d1a59d5cc9bb851ed08425d99114db89c7e3906b0363d9d4f7aacb5d74e14b418fe7479395c772ca20e82c9cc5a453f41796c0d8396b2d53d845f7825ef2576dfb0cc818d39b9afa27e34252d921082cbe637da62fbda603060e9fc79de920e9cfce51227aa41d7771aa8af31f2f6d2cf9eaafe09d5ea220a72cd5c4776fcd37441a5e0c056e96d384afb669503506432b7fec99b162d5200370868dcded321476e5673521124f50dba5c8f6b1226b887b5544883085e83d81444c312cccc1d3d3878e3d5b582145dc304085d0c7f335d9e4b34e73a7b5f8560229cc8c17d05e5d9271b42521d2b6320ffa17456369aa0b3589947704c697bcccd9808f7e993671518a4b505735e009abf0dd17cee587dd0229c288bc405cc769d51686d4046bf6789886e0e58f26da10aafe781b4cbcfbd1abc8db7890219f54aeae9b41d3081c2916162cab1656e3effffde00cdf1a0f4166eedef2fbe93eda74b9532133722890b313b272c9d8747cb24147e20381bb3f68e89bc64234116897a86dc66303e9c3f9aafe1b3bb5419ef5cbb580af64a1259f6cfc687cd20eb84d8832a793cf2ebc8f40fd8c6fad1c6607f8cc3d6dbbabfc072a3e4e0b8ab36e6775dc867121a8d9eef89735558a3b3baae4a0474d76981fcff711c29a02fbb1cd00a1d9b5236c168c6dab4d5ef7127cc8319fffb343a7f0ea0da82301e11f4b7a7a16dcb68008834397751b82020f04c842cfaee9b5552e1a1bc6062454853013f9a74156ac2e83cec5edabc8f27473ee419c4b6565811e12a7fe1cd057113d5b315974bc59194c3d036b663df31ce3a0e151663a214f2aa511cb824c117b72d35b50053db0bfad9d2faa6410cb6e64b306ce2faafa56b9fcb7778b46c1823fda26239324936802d2feaf0d90621d3e055c4cc0bb7b9aa99c32162c6e14fa392053bd0cedab70693e72079763a4b6510b26a93ad35133ac62bffda49076bbbc2ea5e2ec273d89fc1e81cf5cc67d353e6187a54ab36a0b57b98c573a55fdb710ff21546e7e9290f62cd566a7951eb2b11a1e36a71ce1a258af3dd0816d62679909951ed1142a280f260c1ff873dc87e7422c9d826431d54d0b731d5e5903475c36f50e9181bc3ce46b7573e84b0185c6b6e4c19a773090e2d1426ca2a41ef59e407b586daac3f8f2d337c9d0d302670c55a194c31ec78ea2e1b40732fdfabff6642f5fea9dac72d976f669006256bc6b50eb2a368c1bb3e87025ecebc0d835447b3adbd39aa073ee3fdd9c06b221d22d3d534270501f6414caae77402e30b7cceca09d20c9d8a4b0bfc8de2c835203fa3601609c27fdecd7581c650381a17e2a0b5e47dcadfbe2e6bf1531c77c04f36efe7587e56de27cf1e4b9481190d7e6cce6ce4d084d9c2e0502b8a793f0979bacdcb5a103d220b73063283de27aa4d7ff394dc5c9774b9d3298acca3f2f89c96e91d6d38c8cbf263039655b2b82274aee5d1fb30ea40c0ac446a3a872e9943ef141d73c5c071adc0cdc7d370eea47b253c658bd76bde3461d507d8fcb9ab69bbecfdf7b0bb051b4e2007b5acab2f24ee1876c7d4b44274bd23a57d08a340dfe883933dd489ff3da8cf43dfc8e55e886d065f72d80e2bb9e81ae5dd1b5de344b2485188640381cbe85963df96c5dc45f2d5e97c7fec9696ca1183614b5334b1457ad3d07d841180249c28a4a2b3efec5d75687069e4de6ab8906038075cff0063231da8ef2d703b5de9d36a17888ff44cd952109ab79d6e44ff094c7d874ae15eb28338f0983e846ca3818e516a7ead0bc009ac28fae4389f5a36bc0a08630f6e226e288991aaaf700f196515ab5ea46f81474c2fac916bc44b209c121a8b865ac7502696679b064c4509dddfe70a0a53e129545bbee981108e14224cd2d9df8cd71fc00d958603bf55b20fefc2e014fa554eeb08f35d960daee2073cda739d9900e24efe17c1a75574657b5298d7b6a347d48c45f05dcd746026825488fdbae3db42691a5b1739e6fc31b0075d3d3d28b9fdd853004300f92bd5f0ecc6fc5d1b4cef35ae6c6580b4d561f6811aff34278860d28a484b3f279402b8bad81fb6a15c380bd92b900cf1caff3ee414e0534826c0cae28924af2f4bb3a3d539a5a2c8121d79259cbddeaaffd67d5f5092b7a018cc65458e12898069216456869abe506bd6037e98d9b1ae211086e4242055a02416ebe3595fd91b715235dce5fa859456d9c5a30dc4608a1fefa1b51f88e844c7bc30ab703a8b5667df731cd950c4d81f3b49918dba5c874311e259e72049d321a37c67724f692d4a2255f2d86f870e17b287b3d4f5b0a9a3f494bf6f5f12836afc13393ed87debbfaefca9fbdcc6cab0bb9a4cc79e1e8b4c43a76108f412e7595719d4f88f890eeed52e79a2c6f92a26a1be93681b8130f0d172ac0bfbda758214b3e9e0e112b46a526a99d1fae7c7bac6456c8985f40e7b63cb9e09507cbcf0df001a04e58827d7980a8cc769929ba9af24de64551d08831b5a69b18f9888a18e9d65bc2377f02e5111c09411d82283f939e9571e4725a90dd4183662f823b8ec3ff84d0382421e5927e3e3249388cddcf6095394adb2fedb79be5cda376ee667747d307c195f836c5d38fff0e7aad7f0acd8e9f4972ed7e620ed8b865c84d1bb643485b659b6cdff1bfaccf68e7c315a2d1e1221cf6846af4801518cdf085553e2245540ca0bca3016bf4ae5a9d9e391927ac43524c2e58d8ed3a40620a7f41517593648ae9c9f7e907a3ad880ea072954bf5afc4edeb0feb4f169c7b14e7911bab1e10e293022f81e5d1fa984eb57c102dbab88368719d5b4f371989e2f9c370c45ba46fa6424fdb8448bb444580f59e95b313ecc845997af67ca04825c997", 0x1000}], 0x2100000, &(0x7f0000002780)={[], [{@context={'context', 0x3d, 'system_u'}}, {@obj_role={'obj_role', 0x3d, "2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00"}}, {@dont_measure='dont_measure'}, {@dont_measure='dont_measure'}]}) getdents(r1, &(0x7f0000000380)=""/246, 0xffffffff00000018) [ 706.209758] binder_alloc_mmap_handler: 3 callbacks suppressed [ 706.209776] binder_alloc: binder_alloc_mmap_handler: 24408 20001000-20004000 already mapped failed -16 10:18:29 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xa073, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 706.273268] binder: BINDER_SET_CONTEXT_MGR already set 10:18:29 executing program 0: mprotect(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0) getresgid(&(0x7f0000000b80), &(0x7f0000000080), &(0x7f00000000c0)) socketpair(0x1b, 0x80003, 0x9, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$UI_BEGIN_FF_ERASE(r0, 0xc00c55ca, &(0x7f0000000040)={0x9, 0xff, 0x80000001}) 10:18:29 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x2, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 706.313578] binder: 24408:24414 ioctl 40046207 0 returned -16 10:18:29 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x189c, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:29 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x180000000000, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:29 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x8b010000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 706.493764] binder_alloc: binder_alloc_mmap_handler: 24440 20001000-20004000 already mapped failed -16 [ 706.547777] binder: BINDER_SET_CONTEXT_MGR already set [ 706.585605] binder: 24440:24445 ioctl 40046207 0 returned -16 10:18:30 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x81a0ae8c, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:18:30 executing program 0: mprotect(&(0x7f0000127000/0x2000)=nil, 0x2000, 0x0) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) 10:18:30 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x80bb, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:30 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x1200000000000000, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:30 executing program 5: semop(0x0, &(0x7f0000000080), 0x13) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000040)=""/11, 0xffffff3a) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) openat$rtc(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/rtc0\x00', 0x10000, 0x0) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000140)={0x0}, &(0x7f0000000180)=0x8) ioctl$TIOCGETD(r0, 0x545d, &(0x7f0000000240)) r2 = syz_open_dev$sndpcmp(&(0x7f0000000940)='/dev/snd/pcmC#D#p\x00', 0x6, 0x28002) getsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r2, 0x84, 0x8, &(0x7f0000000080), &(0x7f00000000c0)=0x4) getsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x11, &(0x7f0000000980)={r1, 0x8000}, &(0x7f00000009c0)=0x8) 10:18:30 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x90401, 0x0) mprotect(&(0x7f00008a7000/0x200000)=nil, 0x200000, 0x4) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x200, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getdents64(r0, &(0x7f0000000100)=""/111, 0x18) getdents(r0, &(0x7f0000000380)=""/246, 0xffffffff00000018) 10:18:30 executing program 0: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x400000, 0x0) getsockopt$IP_VS_SO_GET_INFO(r0, 0x0, 0x481, &(0x7f0000000040), &(0x7f0000000080)=0xc) mlock2(&(0x7f00001c6000/0x4000)=nil, 0x4000, 0x1) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000180), &(0x7f00000001c0)=0xfffffffffffffccd) getsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r0, 0x84, 0xc, &(0x7f0000000200), &(0x7f0000000240)=0x4) getresgid(&(0x7f0000000100), &(0x7f00000000c0), &(0x7f0000000140)) [ 707.188594] binder_alloc: binder_alloc_mmap_handler: 24474 20001000-20004000 already mapped failed -16 10:18:30 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x300000000000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:30 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x8138ae83, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:18:30 executing program 0: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x0, 0x0) fstat(0xffffffffffffff9c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) r2 = getgid() fchownat(r0, &(0x7f0000000080)='./file0\x00', r1, r2, 0x800) getresgid(&(0x7f0000000000), &(0x7f0000000bc0), &(0x7f0000000c00)) [ 707.291227] binder: BINDER_SET_CONTEXT_MGR already set [ 707.318123] binder: 24474:24484 ioctl 40046207 0 returned -16 10:18:30 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x7a00000000000000, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:30 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xe8d5000000000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:30 executing program 0: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) r0 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x8001, 0x4000) setsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r0, 0x84, 0x12, &(0x7f0000000040)=0x4, 0x4) 10:18:30 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0xc080aebe, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 707.501349] binder_alloc: binder_alloc_mmap_handler: 24512 20001000-20004000 already mapped failed -16 10:18:30 executing program 0: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x2, 0x0) ioctl$PPPOEIOCSFWD(r0, 0x4008b100, &(0x7f00000001c0)={0x18, 0x0, {0x2, @empty, 'bond_slave_0\x00'}}) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) r1 = open(&(0x7f0000000000)='./file0\x00', 0x10100, 0x43) ioctl$DRM_IOCTL_GET_UNIQUE(r1, 0xc0106401, &(0x7f0000000140)={0xd5, &(0x7f0000000040)=""/213}) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r1, 0x2) 10:18:30 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x5c80, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 707.568369] binder: BINDER_SET_CONTEXT_MGR already set [ 707.598371] binder: 24512:24514 ioctl 40046207 0 returned -16 10:18:31 executing program 0: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) getresgid(&(0x7f0000000b80), &(0x7f0000000100), &(0x7f0000000c00)) r0 = add_key(&(0x7f0000000180)='syzkaller\x00', &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000200)="ba688ee34a8513ce28b1424eb8a5de40c933778a9727c2cc1d1df66dea20ea8b4326d6fb0bf74570ac6d63dba5704e5d500e15b9b6630d5efd1ad1e64cff2eb8d1b241d56f31330862257d72ca3d44f96bcf556aa1fc6e9b343eb436e1cdd4e9743bbdc6de15aaf69cfdf695b74c51178cd1cb037a583d3cd6666b17af79318fc5e4a98e5598b40dbe38705e640358ccee1509989c5099d4ea1d329e1e6c0223c4ba0ba90b7baf708f062f27de93a7345718acd33c12b0639c83bf65fd81", 0xbe, 0xffffffffffffffff) r1 = add_key$keyring(&(0x7f00000002c0)='keyring\x00', &(0x7f0000000300)={'syz', 0x1}, 0x0, 0x0, r0) keyctl$restrict_keyring(0x1d, r1, &(0x7f0000000080)='dns_resolver\x00', &(0x7f00000000c0)='em0|\x00') 10:18:31 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x500, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:31 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x8188aea6, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:18:31 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x5bf4, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:31 executing program 5: semop(0x0, &(0x7f0000000080), 0x13) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000080)=""/11, 0xb) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000140), &(0x7f0000000180)=0x8) ioctl$TIOCGETD(r0, 0x545d, &(0x7f0000000000)) 10:18:31 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x25) getdents64(r0, &(0x7f0000000100)=""/111, 0x18) getdents(r0, &(0x7f0000000380)=""/246, 0xffffffff00000018) 10:18:31 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xdbb0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 708.181677] binder_alloc: binder_alloc_mmap_handler: 24548 20001000-20004000 already mapped failed -16 [ 708.217474] binder: BINDER_SET_CONTEXT_MGR already set 10:18:31 executing program 0: getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)=0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.stat\x00', 0x0, 0x0) r2 = openat(r1, &(0x7f00000001c0)='./file0\x00', 0x20000, 0x5e) ioctl$SG_SET_COMMAND_Q(r1, 0x2271, &(0x7f0000000000)) setgroups(0x1, &(0x7f00000000c0)=[r0]) ioctl$SG_SET_COMMAND_Q(r2, 0x2271, &(0x7f0000000040)=0x1) setsockopt$inet6_tcp_TLS_TX(r2, 0x6, 0x1, &(0x7f0000000080), 0x4) 10:18:31 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x8400ae8e, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 708.227733] binder: 24548:24558 ioctl 40046207 0 returned -16 10:18:31 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x32a000000000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:31 executing program 0: mprotect(&(0x7f000070a000/0x2000)=nil, 0x2000, 0xa) r0 = getpgid(0x0) move_pages(r0, 0x6, &(0x7f0000000000)=[&(0x7f00001e1000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f000027c000/0x4000)=nil, &(0x7f00003aa000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000394000/0x1000)=nil], 0x0, &(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x6) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) pipe2(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) write$FUSE_BMAP(r1, &(0x7f00000000c0)={0x18, 0x0, 0x2, {0x2723800}}, 0x18) write$FUSE_STATFS(r1, &(0x7f0000000180)={0x60, 0x0, 0x2, {{0x100000000, 0x7f, 0xff, 0x7, 0x2, 0x1ff, 0x7, 0x40}}}, 0x60) 10:18:31 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x2, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:31 executing program 0: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) r0 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x143, 0x200) setsockopt$bt_BT_SNDMTU(r0, 0x112, 0xc, &(0x7f0000000140)=0x7, 0x2) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0)='IPVS\x00') ioctl$PIO_SCRNMAP(r0, 0x4b41, &(0x7f00000000c0)="ff3695903c1f3d5cc1c6f626c841e37a3279891ec1a7c42e0f659dda2362b264b364c18c9eb5ca08eb3d6556b9e6fa6f7441d49bb2cd483a94295ddf3e5695a6cb714f1cbf96") sendmsg$IPVS_CMD_SET_DEST(r0, &(0x7f0000000280)={&(0x7f0000000180), 0xc, &(0x7f0000000240)={&(0x7f0000000200)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="000027bd7000fddbdf650600000008000500b6000000140002000800090001000000080003000400000008000500030000000800050001000000"], 0x40}, 0x1, 0x0, 0x0, 0x10}, 0x40000) getpeername(r0, &(0x7f00000003c0)=@alg, &(0x7f0000000300)=0x2fe) r2 = socket$inet_dccp(0x2, 0x6, 0x0) sendmsg$IPVS_CMD_NEW_DAEMON(r0, &(0x7f0000000580)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x80020}, 0xc, &(0x7f0000000540)={&(0x7f0000000480)={0x84, r1, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xfffffffffffffffb}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x10}}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x5f}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x1f}, @IPVS_CMD_ATTR_SERVICE={0x38, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x10}}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e20}, @IPVS_SVC_ATTR_FWMARK={0x8}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x4c}]}]}, 0x84}, 0x1, 0x0, 0x0, 0x40}, 0x0) r3 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000040), 0x4) ioctl$sock_kcm_SIOCKCMATTACH(r0, 0x89e0, &(0x7f0000000080)={r2, r3}) getresgid(&(0x7f00000002c0), &(0x7f0000000340), &(0x7f0000000380)) 10:18:31 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xf884000000000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:31 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0xae9a, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 708.512937] binder: 24586:24587 unknown command 16448 [ 708.524349] binder: 24586:24587 ioctl c0306201 20000440 returned -22 [ 708.564327] binder_alloc: binder_alloc_mmap_handler: 24586 20001000-20004000 already mapped failed -16 [ 708.582750] binder: BINDER_SET_CONTEXT_MGR already set [ 708.596457] binder: 24586:24587 ioctl 40046207 0 returned -16 [ 708.606525] binder: 24586:24593 unknown command 16448 10:18:31 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x731e, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 708.613125] binder: 24586:24593 ioctl c0306201 20000440 returned -22 10:18:32 executing program 5: semop(0x0, &(0x7f0000000080), 0x13) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) r1 = syz_open_dev$amidi(&(0x7f0000000080)='/dev/amidi#\x00', 0x80000001, 0x60041) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x2, 0x1b0010, 0xffffffffffffff9c, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffff9c, 0xc018620b, &(0x7f0000000240)={0x0}) r4 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000300)={0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000500)={0xfc, 0x0, &(0x7f0000000340)=[@request_death={0x400c630e, 0x4, 0x4}, @transaction_sg={0x40486311, {{0x3, 0x0, 0x3, 0x0, 0x1, 0x0, 0x0, 0x20, 0x8, &(0x7f00000000c0)=[@fda={0x66646185, 0x6, 0x3, 0x23}], &(0x7f00000001c0)=[0x20]}, 0x8}}, @enter_looper, @decrefs={0x40046307, 0x4}, @acquire_done={0x40106309, r2, 0x3}, @transaction_sg={0x40486311, {{0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x18, 0x38, &(0x7f0000000280)=[@flat={0x73682a85, 0x0, r3, 0x4}], &(0x7f00000002c0)=[0x78, 0x38, 0x0, 0x18, 0x78, 0x40, 0x38]}, 0x41d}}, @decrefs={0x40046307, 0x2}, @acquire_done={0x40106309, r4, 0x3}, @acquire_done={0x40106309, r5, 0x4}, @exit_looper], 0x90, 0x0, &(0x7f0000000440)="4457a9369261aee862d4cd79f6ced975d021907989e61c84fd9f23a6ba40226584122fe41c35a8e3aef9f6a1f54ffee3e62b145907d45f98a8b045edd6205a1b5d9ba5ff4cfadd4bd05b4194003698088d528f5fb53789bd7885549c6a8013d1440d7b81744731abf3fd6d4335ea71f8b69c4111ac479eccbf48eda05a23567ed0f2f09dc907db95f7360265b87a8388"}) read(r0, &(0x7f0000000040)=""/11, 0xffffff3a) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000540)) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r6 = geteuid() fstat(r1, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) write$FUSE_ATTR(r1, &(0x7f0000000600)={0x78, 0x0, 0x2, {0x6, 0x1f, 0x0, {0x2, 0xfd, 0x6, 0x0, 0x7, 0x6, 0x9, 0x49da, 0x6, 0x3de, 0xffff, r6, r7, 0x2, 0x4}}}, 0x78) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000140), &(0x7f0000000180)=0x8) ioctl$TIOCGETD(r0, 0x545d, &(0x7f0000000000)) 10:18:32 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x4c00000000000000, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:32 executing program 0: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) sigaltstack(&(0x7f0000ffd000/0x2000)=nil, &(0x7f0000000000)) 10:18:32 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getdents64(r1, &(0x7f0000000100)=""/111, 0x18) getdents(r1, &(0x7f0000000380)=""/246, 0xffffffff00000018) setsockopt$inet6_udp_encap(r0, 0x11, 0x64, &(0x7f0000000040)=0x7, 0x4) 10:18:32 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x5000aea5, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:18:32 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xfd00000000000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 709.116087] binder_alloc: binder_alloc_mmap_handler: 24620 20001000-20004000 already mapped failed -16 10:18:32 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x70ad000000000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:32 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) [ 709.158216] binder: BINDER_SET_CONTEXT_MGR already set [ 709.177406] binder: 24620:24625 ioctl 40046207 0 returned -16 10:18:32 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x3000000, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:32 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x8004ae98, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 709.243437] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. 10:18:32 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x3e3, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 709.368945] binder_alloc: binder_alloc_mmap_handler: 24648 20001000-20004000 already mapped failed -16 [ 709.415857] binder: BINDER_SET_CONTEXT_MGR already set 10:18:32 executing program 0: mprotect(&(0x7f0000311000/0x3000)=nil, 0x3000, 0x4) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) [ 709.436886] binder: 24648:24653 ioctl 40046207 0 returned -16 10:18:33 executing program 5: semop(0x0, &(0x7f0000000080), 0x13) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000080)=""/11, 0x1000000bb) socketpair$inet_smc(0x2b, 0x1, 0x0, &(0x7f00000002c0)) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000040)={0x0, 0x100000001, 0x6, 0x1, 0x1, 0x3}) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000280)='/dev/hwrng\x00', 0x4000, 0x0) getsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f00000000c0)={0x0, 0x1, 0x5, 0x7e58}, &(0x7f00000001c0)=0x10) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f0000000240)={r2, 0x8, 0xffff}, 0x8) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000140), &(0x7f0000000180)=0x8) ioctl$TIOCGETD(r0, 0x545d, &(0x7f0000000000)) 10:18:33 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0xaeb7, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:18:33 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x6c00, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:33 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x3f00000000000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:33 executing program 0: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) getresgid(&(0x7f0000000b80)=0x0, &(0x7f0000000bc0), &(0x7f0000000c00)) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/rt_cache\x00') ioctl$UFFDIO_ZEROPAGE(r1, 0xc020aa04, &(0x7f0000000040)={{&(0x7f0000342000/0x4000)=nil, 0x4000}}) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000000c0)={0xffffffffffffffff, r1, 0x0, 0xd, &(0x7f0000000080)='net/rt_cache\x00', 0xffffffffffffffff}, 0x30) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000000300)={{{@in=@broadcast, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in6=@remote}}, &(0x7f0000000100)=0xe8) setsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000140)={r2, r3, r0}, 0xc) write$UHID_SET_REPORT_REPLY(r1, &(0x7f00000001c0)=ANY=[@ANYBLOB="0e000000070000002c0569003d45606ac268b35c95bf770938346f2c65126e42097b8546e1d00c05ee4bfaf05ddc9a8d186517b5fb680feddad0a531136efa844b658e76c6d01aa508b024ba6c2d3e7431d3371597025083e8c1e47db3d5a93311ba7eaa0779188d0fd505b6e1d59f2e28b59a082b91d19e23a11251729bba5800314c138bb0a2da1441297a28f3b3603b78a81c1ac9131e2a30b762f09aeafd8ade4894801103cb4d9bca78662e46bea7c95d445a9ab2c2aa24ed0f8c75f54a078d65c9be16655b1720367783e83b67da5c324b6f7c6435c0d087903039e1273018713d491f3a98ab8c4b402a4489abdcaf5a017b9e1c404e23ec00660f3f81360871f3e7388afbf6dbfb2a73ada618b34fa67179ac7544c717dfb67d9ea5e2262027a2abb9bc49"], 0x75) 10:18:33 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f000007e000/0x3000)=nil, 0x3000, 0x1000000) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getdents64(r0, &(0x7f0000000100)=""/111, 0x18) getdents(r0, &(0x7f0000000380)=""/246, 0xffffffff00000018) get_mempolicy(&(0x7f0000000040), &(0x7f0000000080), 0x8094, &(0x7f00005fc000/0x2000)=nil, 0x0) 10:18:33 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x4358, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:33 executing program 0: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) r0 = creat(&(0x7f0000000500)='./file0\x00', 0x2) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f00000006c0)={0x0, 0x2c, &(0x7f0000000680)=[@in6={0xa, 0x4e20, 0xffffffff, @local, 0x80}, @in={0x2, 0x4e24, @remote}]}, &(0x7f0000000700)=0x10) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f0000000740)={r1, @in={{0x2, 0x4e21, @broadcast}}, 0x9, 0x80000000}, &(0x7f0000000800)=0x90) syz_mount_image$hfsplus(&(0x7f0000000080)='hfsplus\x00', &(0x7f0000000140)='./file0\x00', 0x6, 0x7, &(0x7f0000000540)=[{&(0x7f0000000c40)="0b852f035e046cfe22c17918c4ee3f3d955fd49a24c98b01d064365649abce2a6c4f1ec4c01294984cf3e47a5610d610053e45e555392178048511d37fdcc3525b2ba5e396c94c4a5c8c99aaa5d31264ff5ca0b6bc4ce074c0bcb73be8177967b7306adbafc06346c25bd8b4aa0030ce3e7ed17ef900e05fa6fb2df10571cc7622d5fa6cebc0528ca311110d54e3433209d95597cf463fccaffaa2394b9ac57a27822347a5aed40c750febf6eb873bec5426c2fb76681efe1798355cbc906b2ef872b7bb5ee881cf884f939822f2c81ffde4114698fc93a9fff4b41dd65faba2de66f6d144f368c845122ef23a8a6db5668adc2e15f0cbc6343891d1a9cf6d5ce5e4729ffdb1a91fd4abbc2d568f3d0f7438c3a435313b81952511fc0085d3bcf06a0908abdf483609497dc4661eb08555e6c528d358f2656bb6fbc64ff63efec59f46707726d7441a17d7846f3935c384a83e319439a3618c8506c29d59344ddca778bb7fd06b0ba5771fa8d5d214034600c4eaecb38cb1e18dd33ee2f0bed8979bc22b19acc28b84930bb967fbbbd404889eb883511b6aadd98994f6904b1e8f3b25c513337bff9d368bd3732dc1f59399c06c66e0467f98c050163b7532189cae283e9992a96d2204999c6cfb11a13769659ff4e8e477aa837a0746c90b7b6ea3558af20e405bc1dfab32bb7b41d2c20508a18b003d74e5b83b007840c67776f65e8d1db2c328c2911a3ee0f3b89e901c1c20b690f49848aa65fc98e0cdaa17829d500b791ec2f3a980ec61c1932dadd46302801647c0d78a38c5da1e15ff4e81e350dde390c2e74f85fb8e7ac8b576e051928c2034b3e6a265b69cc4414048b4ab9c350037c622069dcbb1dd96c9adb1429d840bd13b6fdbce6853a4fd805364c584fd804cd8a4c6072a4fb901c416dd8118643a24c71195678a962a4e1700a96c3582d09c77f746842e6708f54b7a30f1e112f4a73cbc547273eaec957926fd746f2dca2609da7075fb166b4371976d2d213e7af14f694ff59f0d3972347632d6515f47758789bb91cfea8afc1455c43a24d032dbef556419f7cc80f66955e64cae4f5f0cb284d1af2787b42d1b9d39f1d4f63cb0dbc1f8eed6ce4b22b01048d87a08385f7ce8db4388ee6100ca8f29c9354c9f231eb7a8c7564b0d647194a3a6a7f6e8de8cd3067d735048d37c8a2bb0f941a9a9c5fb78202fcafbd6ae9ae87f4f433640095ea3cfbb46d9d4b6790c58e0ce7182cdeb34029e51849a8734b6baed7dcd42db85ec9f358704295267188d98ddf0e6b78fa08c57208eb8c6635c4ef83f3c7f3fdee819d6c4cbedd2bf3eda006f263129fcfe0921879b55d1f3f3eb71b27dff4db4dbfc4746fff0db7aebe86123b97b0796adaf58ecd544da0c599846cd000575e374095d9bc90e76bd15eb5aa37bb22260124f885f36a88c507a8a4e584c327826e1378c248d7689031552b38f96dea573d5e8ea9cbaccc9cac5778b67a0a9d3df5b945ad2e0ed591a76e7cc63edaf090062e28952fadc6f6de5b4bb448cfae4fe62da82d28ddf27769d4531a8335dc4450e06f6b316bf4a72e8b8ceab04d16c5615b70122839967cab60936df38ce88b3c49f689b1384ec39165c635aed3375776b206460e4b2485b97b83a03c48d1a66beb27a539d0378d44a686a7b6eb3cd07149b1ad1e8432fa7b5efda1973ef66e1439fb69a060b36866bdb1000a6ec542f9ac9baff1e6503833591707d83b96f2882444fec4380433f3f70e5e26f9220cd9ed8fe11ed995ab78d72fd81f2c7160b4aff9f87e9e00e20294b6d2a40f2aa69e441b790548123bc425c9c420088eecc98542179b9079d877785807db5a0b916e9d0fe56df2b6337f7e7b60558ef1322d5fba2944415638cf0c84714d87439c59232cd144e0f3133a70a85ee207c50481759a603c8f6350dc24b9591b4e6e195f5368daae1315d8363bdae0a5ce0936545ec864d4534a9afa230126e3fb5b764f74d8ec99cdd1315024ca8037d0cea1d3ec26c72c45546ec023faf22e2516120e33102c326198da38443a9132533ae4628446615a896dd17260533105a7d4e0ab0ffe5906ebc8442df4caa818274d88932381a3f99a599b93e220e3dbf5f3e5cc8b7cc531595e75bcdd74dd6c82721c15af5f88dcab3fdb70586b13a0131a6ff2520c46a75bca04dfb29ba945b69efa87206c952e6267417a8b40e19424d3ccac9e09b216995818870d9a839f9bd3667c541bcd49bba38bdd03eb5b60aced3872b32966ba2bbd279774a6cc2c7fbd54b151a9203bdda5facbdf562d12098a23180a47e347a52fa4a6075db2b705a5ab67de0d24877abfb23fbee254eb42fbfeef99fbf663a9f4e20976f94ff1e49b51a47809f89a50b4bf8c9be9135fd610a4cf8c194f952ebcbe33133e7e37fa7976f26d9e51982718b765c52efaee4918ac4fd2967eaae0f6193205de56bdfe33012aa199bf8155af69b9f43a697b4f8ec43a99698fff1e20131727826d2cbd9c5fd0e420b69578e6932c43752bb89952e365d74c7e1d0f95ab3a6e0a0252a6712ea9edbbbca75ab420b290b2a6180af988a722d05e7b8e9aaaaa8193192d2b176bf0f18ccdfa1acd5c0f855bb18cc1a8bd53fc453a96ef572c62fcdbfa77e21d91e87cbba804cb0dbfbc4e574acb57165b98dccaae785e197a2085a38625a0e653a86a21d383c18d971d0e0f391cb297043877c37b273dbe2f30ab2f47d3ec85195e99b33037c9d2b3fe8de846d74570e474c1495ee98d73ef2024eacb1b14eaa22a69ec55def87f98e2fc6c59cc9613c8da6b484c64be0f5ef340a5d4b8e78f6cfb18377ac1f58bf03c433cc24209648275f38e237d62870f8e7474623a49f162a0615095d5437ce0370219b09242cfaa92e11053183e432ee766d4a77ee38dc577ac3896f78ad1181b9daf0fba27871c3e9846c2987faee2157d38cadd55838cac28c6c9f8d51a3e9cdb657f1f1110e3e77db6ce2748808a297462c833feedbe5cb38511d5d6bad784ce108c0d82520fe3f4b352f3cecfed7257e79d015a519d8c0561f910efaf83f5616737baf96d92f1b21c386cdbea0494b791aec4e029036854351d26dab99b231bf68fe4c124f7dc78007d6bf4e17a38954a04b6849a32461de1852c8f883fce86520cc4a53802ac625d340afead259030af235f62317ba6d79fcfc724703f0dd5959127a4e66f06f70eab14b6e7956725932ea6dd6b08fa8ffc28842212139b6787d4484aeeb0eec9a0f5b49201bff3757041bb0bc9c2083142b88a30e5a8e41651c2f0979fcd981e2ae387fd94132de9e45d0ded38b1cdc847c81847d958d64fd6b41a5c19ce2615b8b5e818e831561f38922cbb70e1c818245c370debbccd9ea01b5196e24385a921a2217b81f5358ed063228eb0fbfdafa16abdb7ef827e34fe0f97fae2f8c05c63ed87bb8a4a15887a9462d2656e848e7006433a27e999f0691e606dad7d0fbd9edbfc8df71c980f167e71f2530d748810053879b49db88fd0156bdcd0330f00cc59d33609a8b5621c77adbb08e06cce35d0f58885ba239f69bbe5e67679e37a52b70d7543a0ea2d1d798dacce3508ca374664f76ad6135f7c6a6427c1dfca33eed5b5f8114248863292e922fd092adb1f7ffe242ae4ac6fcf4ce7ced4942d507db766998fd8f999eb1aba70048ad5df88ecd913edd0665abc3666626faeb55bebc53a9f4757cd5ab210fe0bceca3f86ab9e0965091f336fdfdae4fc5603d2e87b4c8a8a2cd31392461f0edf5c59ffce40292d0283ad82e49e8a8aa9aaef94346249da5c9a050fb70fcb552b879f2187265cb291ea17157b0789a583b64cdc4b4ca75ed3b4416dfcb8ad0d4e2c0a3084df64b2b7558beaa89b2400c40246f237eb03c3f85726f5a01cd17fbd7a6c387109ed3982c9ff1a2ca9c7711b4dfa9288f692acdf8d2a71b54e3eac0ef9eece28877991b70076cce0bd023aa2a49aad1937933b4661a36b6d6422ef0e5a07fdabc90b653e37efc89a92f7482135996b781f1a6e9b49bb255b931ebf294a8b6bcd1034dbd6d89dbe8f2b02bf90ef0b81d48a9d93b0a95505f9795303c17b6a3ea1747fe74cb2e2cf552efa5becccad83d07c50200b14fc84b3b18ae6aece5e351591057d703310e9756546b69eacf4681aa1c816c125a19777319c77b36b68b7ebfc7a81a3b56054d67b1a277ef9bda4da4d0e759ad330365e1d243516658e65009783b54a8071d00e181a33ff91a1a35226f0e044ac9b0acb0bbda2b1cfffe6a39298bbb37ad55be3afb4dc52a63ab89c5e8198b3ccdf8784b11c99d679c279129f49ccc4c9271adad3ae9c498bf99c5d0483f788d3a885d36f3f048db01922cd2e601cefe41a234b72cfffcf315918ca05ac416ee6fd51d51230a24101a267a1591492f4557d5a9f1778f525933e05be741dba2f87b2cadbf8b8af7dd5f7d5b92aef850e96cca47263ed7ad5a145ae1d772a78089efb78f1f8082d48e5f788a3506a844aefc16c43f0a959bb32fbbeb2dd079f0d592caac4801fc6bb2972d3e1078aec04a18bfc43ada80ee76210b4a3a13719d90b72bb06e77925e6492934506856637eba16a0163902208b2a4866d05d221de21d9414262d16f99049817fe38b540363e23f7fa94596675da1542448ed7ce555c87a8c5bbf04e063e1c7c1eef9112382dae25a8f1e66905023560dc5c9fe1d71063723d387e0fcb853bc7e7bc1b73b4d04be4110f76ff306c4b2510dd0e2686416e9ca302ce27d6a2b69da22a73f2f0b6df129fbac835bf03ba42b6e33f5e4202ec73298cdb387ef0461569d3815d4caa654a377de236b541883010d5c5635f6a2023a08a542ebc4edaef16728dc68afe857960bf9303952e2517f97cdcef5ce06151cff52afc29446aeb8cef7a8de679b07abd5d73fb0a5c6bb575e8e9b4b9569a78575a6b1697a41a0b239138883ccbbdad7e9f14355e293dd09b0b09861887b3eca61911fa0fee95f6e07e5daa240f30709796ce3b59684b1ac21bba215290589b6b135cd59c2c6693020c37f209ab61d50f775e673ea1196a21eed6eabf6b3113077b3538d05de8866a5597f489df2e6453bfdbbd08e69f71e957ca1fbe7e81f795cdeaa11b2f6bb55f3969ca5e33972cd69f509452394e3f628a44ff2ebdae585db083669d5b2b4c6caa800babd5749a206475a0d13d8a0ce6b112f9ea8632c2802a6e2b11b7d3b402f7d69462a00d55dbcd8a5121d2df678f7036a4b4f9d3a3ca83cab714af549f2c8ac50c34b4b50a4246857d565c24c6d3cecb1d8662a55e3a48e86bd86ad9c64724e13a9e2521e29e95311871acfefce39539b8112c824cccfe21e9c4bda2c705a2b34d34149e782cb1aeadae3ea98123b0f74d7fb7d9ddb9989239eef1958a2a3ac97b6c6b4f1dd545934b4bbe38b0cd157ed482c1d711448609bcccd1355e71a6550ed560d63277979e3eea74e3568b3d767516632070c7242e74c2a1fd9da99f97005ee2757b8cee33607c3171b0433608be26e6dc5de8c6ee57d36eb56c2ff39d7c2ddde25749441a8868d2bc08a90b8c581c0f47b1d29e7341250d0572c80125c7ca366a44d2f62a9e985cdce391111d5dd6d03cb158aaf460f4d77081910262265a930b725d92b889bbcff20b836be9080e2027df961e7f046e9d728e99542c17c7ebaddcdc1c7e9dac619aea9c0d8740a5be49c26cf3c4ee664b9b156e715cc3b797a5e20b5f02b617ead49c43e291102e96666d6e57aed8f2182a36719d3edec63031", 0x1000, 0x8}, {&(0x7f0000000180)="a60b7214ef83d107e4a777415c2bf065ca5b42069dbb9f3f6f55b159bc68e609a1d1697a2c6d96894d7d4c8891ad2c806bc3d5e8e79b8546d3b707956087dd0ebcbfb964c1e991b77de08fe9c3d08ce2c473bc7b28126a87bb", 0x59, 0x20}, {&(0x7f0000000200)="5b05de5de85ef0e9d37e7ceae55159265d400015374b739a70ad5c7c28c57eefc99321e4454c2d0012bd9846cd03123c1dfadc7b906efd1350a93e469a4217d20cd60191e409eb6923e1f956e5e71c5eb6047795dd82ba47430cbf5042f9a95840ac4e169dfaae2e074a47905480159de172a2eae1b313248ff645e5c146b22b85a51510bd8a3a7066d61716666c8a002609eec6c4e4a0a8b4f3d5043417dffd053cbbc4416b8e6cdf23986c076f20ee2f534f8da9f2e9833ca959ced8ee62adf17bbfaee7228c3b54d242802588d0a7731cc8618234", 0xd6, 0x3}, {&(0x7f0000000300)="d6028e73cd3566525e238d5099cf4f787398e7fa82df2d54e1d4522623340f8fc49292893a4fabd442990073de03fafd2e4a4b7db014b4bebf91688171bc675fc9a8e563d4b6167858bc3abf9f221f1e2562288e619480c6bbc8baef461d14773fb3567225b902626dcbe5d93f0011b550ae46c6a9532e6ec76035ae3e696129a1efc56a425d94a425348de6b74ee55d476b725a6574194c083f812432e8dfed3163a7afffcf78ba1e646cce845739bd31c8442de8cc70a4c9fd97031f5fd3e558780d6c1012fce7ebc336c734f843a2a7a57851315382b0ee486a885ec045cda15abcfcb693f54bf2b556", 0xeb, 0xffffffff}, {&(0x7f0000000400)="4d3e76458d05989b57895a6bfa24148a052df7f7e8a270d2dcd32859150d", 0x1e, 0x6}, {&(0x7f0000000440)="f55dbae43665a91f7e0bfbea06b03439884b93834e2475591fd59826f5efeb43974a592f46e9049f00b4c5a91eab3e0b3cdef0131ee9e8ca8d7dcd4b6f3b5c4c0fc3d01f26002ddbe51b8c4f4a2537449c57a3b216a9f73bb370d19b37238a1d59a02c086bf9fd8f270a4ca5063b8d5fb134b32b284fb382c84c066a5795df18bfa53b", 0x83, 0x2}, {&(0x7f0000000500)}], 0x80000, &(0x7f0000000840)=ANY=[@ANYBLOB="6e6f626172726965722c63726561746f723da28b7b602c48726561746f723d0dcbf27c2c63726561746f723d79b079902c6e6f626172726965722c6f626a5f747970653d6368ebd16472656e002c736d61636b66737472616e736d7574653d6368696c6472656e002c004b77afa31ebcc5f4ed512713d706115058d5dd12777eec1d9cb06c72d54773d18e0ba1df40866ad926530ac0ea58014a03b2c19a7fd95f5da06e9e73c6c2e09e6c7c9f070c97c27ad8c2a56e89cd3cab21460b65231ecd7f2f02692848daa4bb6159c4fa1fc732a5709287195b672c20bc80d0ed9b537e445d61529c0d05c59699fc10752d35f7975bd2eff69656e0a65c8dddcdb29d0af4161e81432b1bcb7e6e5de778dac5e15fe25e9ee6a9c6e181"]) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x800, 0x0) ioctl$UI_GET_SYSNAME(r2, 0x8040552c, &(0x7f0000000040)) r3 = syz_open_dev$mice(&(0x7f00000000c0)='/dev/input/mice\x00', 0x0, 0x0) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='children\x00') dup2(r3, r4) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) [ 710.128916] binder_alloc: binder_alloc_mmap_handler: 24677 20001000-20004000 already mapped failed -16 [ 710.166215] binder: BINDER_SET_CONTEXT_MGR already set [ 710.172839] binder: 24677:24687 ioctl 40046207 0 returned -16 10:18:33 executing program 0: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xfffffffffffffffd) r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x20000, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, &(0x7f0000000040)=0x2, 0x2) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) ioctl$BLKSECDISCARD(r0, 0x127d, &(0x7f0000000080)=0x6) 10:18:33 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x300, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:33 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x8040ae9f, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:18:33 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x93ee0000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 710.390577] binder_alloc: binder_alloc_mmap_handler: 24707 20001000-20004000 already mapped failed -16 [ 710.428929] binder: BINDER_SET_CONTEXT_MGR already set [ 710.468586] binder: 24707:24711 ioctl 40046207 0 returned -16 10:18:34 executing program 5: semop(0x0, &(0x7f0000000080), 0x13) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f00000000c0)=""/11, 0xfffffffffffffeef) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000140), &(0x7f0000000180)=0x8) ioctl$TIOCGETD(r0, 0x545d, &(0x7f0000000000)) 10:18:34 executing program 0: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/expire_quiescent_template\x00', 0x2, 0x0) r1 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x80000000, 0x4000) ioctl$IOC_PR_RELEASE(r1, 0x401070ca, &(0x7f0000000100)={0x74, 0x7, 0x1}) getsockopt$inet_buf(r0, 0x0, 0x0, &(0x7f0000000040)=""/30, &(0x7f0000000080)=0x1e) 10:18:34 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xe740, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:34 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x5421, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:18:34 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x500000000000000, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:34 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000040)=0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r0, 0xc1105511, &(0x7f0000000480)={{0x3, 0x5, 0x1, 0x1, 'syz0\x00', 0x3}, 0x6, 0x40, 0x100000000, r2, 0xa, 0x70bc, 'syz1\x00', &(0x7f0000000180)=["2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", '[*vmnet1+/trusted&\x00', "24292976626f786e65743176626f786e657431a7657468312476626f786e6574313a6d696d655f747970652173656375726974796d643573756d00", 'self/\x00', '[vboxnet0:\x00', '/dev/ptmx\x00', '/dev/ptmx\x00', '/dev/ptmx\x00', '/dev/ptmx\x00', "2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00"], 0xd9, [], [0xee, 0xfff, 0xfffffffffffffe01, 0x401]}) getdents64(r1, &(0x7f0000000100)=""/111, 0x18) getdents(r1, &(0x7f0000000380)=""/246, 0xffffffff00000018) [ 711.013478] binder: BINDER_SET_CONTEXT_MGR already set 10:18:34 executing program 0: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpu.stat\x00', 0x0, 0x0) ioctl$TUNSETVNETLE(r0, 0x400454dc, &(0x7f0000000040)=0x1) 10:18:34 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xed08, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 711.037840] binder: 24735:24737 ioctl 40046207 0 returned -16 10:18:34 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x4c000000, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:34 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0xaead, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:18:34 executing program 5: semop(0x0, &(0x7f0000000080), 0x13) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000040)=""/11, 0xffffff3a) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f00000000c0)={0x0, 0x19ae, 0x1, [0xfff]}, &(0x7f00000001c0)=0xa) r2 = open(&(0x7f0000000300)='./file0\x00', 0x200000, 0x20) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000080)={r1}, &(0x7f0000000180)=0x308) ioctl$TIOCGETD(r0, 0x545d, &(0x7f0000000000)) [ 711.247018] binder_alloc_mmap_handler: 1 callbacks suppressed [ 711.247036] binder_alloc: binder_alloc_mmap_handler: 24757 20001000-20004000 already mapped failed -16 10:18:34 executing program 0: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xfffffffdfffffffb) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000080)) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) 10:18:34 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xf37a000000000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:34 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x68000000, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:34 executing program 0: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x800, 0x0) getsockopt$inet_sctp_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000040), &(0x7f0000000080)=0x4) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) 10:18:34 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0xae80, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:18:34 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x1ce8, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 711.489805] binder_alloc: binder_alloc_mmap_handler: 24786 20001000-20004000 already mapped failed -16 10:18:34 executing program 0: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) r0 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)="aaae05c92aa907277bde7f18fb2753c9135f0f1c106a35687085a9eb46290e790d87321121aef6cc8dc9055763d4596a5bf10716beb8dec3d794531e0f020d1efefa5493dcb5aa2e79b65efd13c4c2e1f2949771798fa42cfbebf21e92f91e90fc00124054006e154b0220f5550fa411e0109729cfb0c9d5058df4e685f8ff444921575e021e6bb5a80568e923b79dc1eface5b53739a11d5abc8bcf9b68837eccb196be1062e3074a44ef619a1ada150128b48de433e20d6c29e3676e35645ee695d1dbe1cc9f30094253c0cf94554c1896f0100f059faf", 0xd8, 0xfffffffffffffffe) removexattr(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)=@known='security.apparmor\x00') keyctl$get_security(0x11, r0, &(0x7f0000000180)=""/139, 0x8b) [ 711.585798] binder: BINDER_SET_CONTEXT_MGR already set [ 711.602940] binder: 24786:24789 ioctl 40046207 0 returned -16 10:18:34 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) writev(r1, &(0x7f0000002480)=[{&(0x7f0000000480)="20d4b770263660c008179e5ce66d8ec5973b4da33a700e06764028fba1c827561b53846a999c998a2b703d899de39990eaa0e896b29dff197cac8f9f67869d2d94728be4fbd922bdbedfcf76c9621651b2854c0406cc5c72c2b232e8d64028cc9af07388b86510ca96f0cb710091d94db7494a3941928c35b886ba378991293e9bb1cf27260ddd1f03b050380960d00618a5c84811818f47d8b8d335b338f2db18fc6e09c703ec4c9646a0665c0f5fdbad0013c0d0cd168f4ed3f2874a3cef524decce79ee8aa7cb2672a57c346831b4b5ef1f6509cd820453fa86de89a7c4ccebfbf7ade6fc549589525449063cfd810e2d41a97b814dba41a3a50ff8e360ef6dcc477142a3b45db3633c31dd0ab4b98ddf261bf459dd79224de7c9b0df2557eb21e0d0eac8540d3950a97934cec7423e37dbfe13e457c362647dad75df7c2aa159babda5bffb8f2988058a19810270790fea66a71da921336e82eab860a179b11a805a078c014b262aef70256364934960dc8813a21eeabc29deea1ca46c8ee5375e6c25747d1d1a39dd5f41b4f61ae4aeb210fb2e4fadc1bfc22ee6e975fb03e5910bc28a80d1b564e9a4b73c8307ca58f98fd411a33e8254334577632d2d2f6aa15c283dee7c2634452fccfbf0609f5eb2f2a9b60fe54bc3c638c7655e885932041d5f476fd29f65635b72b339a5b031432954ecd54fdf3729c3530ed42ac102b9a7f4653795b4d40db6c0b3c721b2b079d7f476042d331ce6b3f2fe60981d162d798df139049d5020573d78c65c8320843eb9f9a354c2b1736f300867a64fe60133e1a4f2278f0c7ead3957a580ae33ddec60a452ae5d5adab391345822443080119d08ddb239d1ca6957462538b5ffbdbaca1692778c4e2591394dba7fe7cdcb7624ac2d4a5bf9b27ccdb634572fcece100a248efac9aad944e5dee18a8d7092adea1deb0d8c90358b90fd3a278050e997d71efd4384e84cc0e4e0091df83ee1b1f4e4dc392f4ec633d751b1e47779a4e2efb472a702e16bcfc1f53a8b116e85d9ff87d513969bfcd099986c762d217a159eef8f478b729a1693648e52a11e3a0a2c40386c967f9d86d2b2e9822bd4c38a740af48669a65c58f3b005140d812a68619b412b9fd9991b1c24b316883d7c374610f68dfe242fa9fe0245b1587acd6b3b0d8f2da716fa79ab2d8a76d3908f7cb42f5e33cb341b77919a47134cf5a41f9015020611998cb8be46ede5016b4b746a7a8200ff219a7b497d9e105a95d0a8831e23ccc735c85a5f008ff9b7c3ccde5a7c6f90aed9a7275b49e0d5b0ea8b73d005b4b783cf34f3c6e84f5b9978d739ca943f1e7c0f7beeeb3177ec4200aaf124d86a236e745872234974527ed5c6f45413cf98630d38e3d744e0961bd5e5c9566cd28de1e040ad83b7101f39c47f80074f3497d258c9e3b90e936f5bbf2d3ca01ec144ac75165253176c59ab9bae0f1ccf7ebbc0c9c515eaffe018edcc30ebc763871bbaaed52853e310a472c073d31f71818cee661161807aac0c488c5adc7fb6e295f3627fa15c38a8f5e29ba32157105d6e64d0d94e8780584b788d3883e2ecc51308d9ebdc2a58bbf9c4c6cd989594433523f84c7eb71fdf0bfc2fe5d966a47e1f511f78d8f30fda2131dfd489a12672e57e3ba5f862c7a7dfdfb9f6ae824da3ff9c2d86e17f01c98f088ed6ec1723b311115e83c6271e0b938b1a897442a84678f04678d234116a2cec00bb7407b74ff672940591bfdec95b20494beba0825d2a92158a05990b9b0f65e9e6f0eee4679b37ba24268b65419e8fcc71699ef35dc02708e45ae0f43613c04557055b9d61452df935fb335d3464978c4da3f3f809ad0987fc9c669be4579291af1fa03a0a8afc267d971e8d6e2213f899735bf4841727eb37aaf9ecf0da2ec3a2f8cb0efe6e078e791305eb8b49141da6cf62907cf3ed0257ac00710284203c17ac8ed6722eb96431de8c2f6dc97bee2e2e34d6c0e30fbc1368a26a35674978672ce95c327c4480c977db38c1329cff4a0f97315319fb79b55126ed3d7a706e35aadde1816f34b8a4187bc6141685adad66021a29c5ab9e16420c15040dffd78ef3eec4a946998bc2c250d222c5c1bca83e932a83172c3aee65924fd7811eed28a66710120c03393de64f79e14bfaf15db7f5a29bea6b6cadeb0edbc0db1667053cfddd12d9d0a3f6d08c57e078146a367bddc6c1cfba866b5944a7b0b3395d80a1b7c2916cbb426ad4e04732ff2d775a068c72c7eb6a3dd3014f2fada8e69278a1c28f8b5770f1cef0b98c5c4c9a5c0042178d53aae31ee0cd2a724436e5c22cc29fe04b3dbdb21741ace089ef505027de0f16f12cdc8f8d84c19cd4e089efc24da0b563af4a201d94e34f767ef3a455e6e2ccf225dfc32126af832da4ce3f21a220f49fb8ead5c73cd17f39b607a8f21797a2f48a482094cf7136c0d9dc524543fb45504cbdf81ccd61eb21003de4b0f4986de4fa651263b5d22af453a496454a65060f0253d233512d392fb63a159babf40b0faf398a1abde71909eadad0dd75daa9b4ad48ef32d50a1a6e4cf59fdb48e54456021f49752be1f783cd79d0df3d332dbd3363c0182b370e03d1fd8549202414ed2382454803e07b5797e9136749ebf40effa58f645f6790cd3c7458fc17941f50b35f544baee5efa01c91f1615ce078d280a31919132a5fd6dcc2326620bba88e55c4ba4f7edc90381b810070c7181aa0ee525a26ac1230bfe7d823631d4225cd8a9a81cb1681d32aa542959d21f4e13afab358d727123acd42c1740f83329de88cba4282c7aed40359f31f5581ee09d1adee79fe20ffdf003cc80a817a1abc285f09d161bf3797536a79a4109a51caea287a2f893fee935c9053efa6dc7bb9200b7b08235a3e6bb49f256fc0788c757a4468dea39684fc2f8e978837df8f036e5f4b5f313fea0e276d238493ca0d8e8aef8de10bc6fe03bc4589210e7267b745e96e5125aa7b0e8f21be252cb0303621f05dbf2c977dc2c7518846ca5dec87df796b537a733a276ce4a37a94faf5a6f820565624d806c668b487c76d3f22a2488d060f725ebbdb13103a42d31de34c1449972f8e2fc50f906593dc07fd3ae0050b2c265b75dbbfd8a67a51c425adce7c3d7b687284a3de1fc40142d8b4ae478b1e18942602995770b205ee37af647edba53fd2832fa837c354aa1afd6597e036ad3d7cfec0bdd3bf8a2b8a5821307d6b727f2766440eae15470fce8af36643f0c9ec9b5638c21c372bd07491c7d11a710be14245f4d97721bb471887571b81ffc264fcae14cc45d50ce1ddcb3325df502c57682c922b0b0f6452d4782c37f188f002f197ddf0f35761dccf6c747877b998bba1a352e4aac5c9365ad020bc40e65b7b787d13b186aca12166bba406a03428689e28858da97462847fc2793e4ba91869cc8205cf8993e1846604a06ce0d5ac4d1e3ba96dbeac10968363f832d070978fdf326fab1ca67a78fb25f2f248dfab9a9085c206a9fc4dfe76685945fd82dc92c717577443fab1b5629fb92d80c82f3832a85061703333e46b0ef357f2d4a05f8e5060c0e05344541be2167f38ce8808632811f07cbb98ad8ea89a47fd0806f44b3ee717385357dcacef7ed4a13da422c3c268738f5ef9a0e0f8c464b9a72c4d6309f3c8dcd114db9c997560ec2fee3c621dadf3cd819d176258e6ef4e3e5afeb82764297e768908626ec9f72219021f8b3086714d84aa5182ace72e998334a0defce1bd9949ea39f7d35d9536854e3a1e0e0110e115442959464ba875ff80879add1393b41698e6174acf08c93b37fa749381088ccf1c0393d96c57b2c943fe72c9b6b8fce06a35c233932f54c1ce57bb77b031736e2ec043581179d1c14aff1503bfea738ea0c792715d003e1dd833b6a01d1ddcf8827823a1c25b760ece3faa91632b74816d75b889f13f6c3c6bcfeebe166f5146e7205c191cf78543fbae63d904d1c92236e972b45569c43b846e66d0e1c537fc559ab5619dc660c0553948c65cbfe44263e8d78f5c43405ee7fed193b22b8c317b2fd8023156969a6c6a3b23da81b357ad286f8488645bc1be8164fc36123fc585589355d50ce7eb069e76c3f3a2a978541fe24a7d029fa46476e5d3d559df559102c14eeede95f9e94be833db46e5edf622f58c6b2af9a157e9b42c091ea319686c5f4381c190b93d289252837460eeabec6f0851e4114a85e5a1c5ae607dc617c506e3f0d415af3c46d4cf2937de1590947ce85fb2aef92ae9279a91685ed6121f8a0cb0a9a95786a5b6bc70a7b1bd7de87dc40ea231225bed7a54fe22d88517f0d8b0bcc2b003cc4b025d693316cbbee2464e0b64d630de8c3426e0adcd1621ad52ccf953eba0ce4b86bd4424c0e9b2b7396f8e1e8e90f888e19927ccf21726cff7cae74f17e0be764e3253927ed1869612ef8169251fa2d0934c13573d4b043bd10acb866c61b509bf4b146f6697a23147112a764a8c0dca61de378301a3183518a7af36aaccf1c880d99cb22af4302e9c37aedb0e84364c699627a8c78304597adc7cb969539f0f10185688942c22cbda293ba4db93d9c85918c4d1f90a3f2e985736eb6745eb64e2838347aa67000e986479265964e95b55d5df0a4d223ee9dac890d4b22f81c4c73b2e467ff6bc2a695a1479e4e052fb3837c5fc76cec110c1e91cc06c7520ceb6300cfb0243bbda246cdf10837e5a88c3b28fdda1448c023b58c7dc26212ff38ff310533b6ddeb31eb0cc3870c4d485eba3db211d4261d659fcca042d5dcfa31945c59c4d5f8cdf58e90a538b83b0ac3465a1a4d966f2e2af2ee606ad20ce05a9971ddc7a733477f027738fc2f0d01bdaa0114c6bbb315892e5d88a379fc55690bd9d1bc5648bf0c575eaef9591cac35b320429e4a6230830cd8d45757aef716f4417da0075ac74dd0340d77a27d4030c472b954e1a84b521af36228fe1314f8c4cbb6e4a4e2a22781559d68fccbcd138b7dc629c3b6ac15c86420e2043b0d28f311cc5f74345347646f28976091835f1d059d15fe8631c6eeb1ba5332209e44ebcac25eb21ba301913cd2d0bf25ac193659189c11908c1bd1440f5bfc0c42f57ecea6df231d908ea9b0a76d6510a578e215c6f294d8d68c0ce59758ff76a8a415c4a8ddf9a2bde9a689efb27884b4af718679d226550659015abba5757cfb20a9e98b76f97483830ba93bd378bac022b8a44eaf39b208743ea7a5f30903c56d91ec5d1351e736bc72104671a2f27a6efb88a9032ec3483bbacc402d0540819f5afc583fa6a3c35f8b136b264174b82bd839b552505b07d7ea989ad393031944f20b6912cf14bccc74b2680ae9dab922ec3cfbc11638342c9274c04a281943daad46a0757cc6906f80a625192578f1968b6dae449fc9cc011f2005cdd1518294d4758eefe81b33e45a98ff6380deb63fd138da6302b5052874ffe3573f7563d4417ac3bf1c227a025363b9a5aa91b1a0437f7378f311bb4d17a6fbca55716d193bc67db66e677f7c2d5483e56e2f3a2c20758c05ba0abecc8b6290a704756027a031369e0dd4074d170252e38b2df9365997b3afcfc9a8491f897b9de677f3cf63cdd8058d14f3f370f22ea23041528fab43fe21497f4cc67922631c5ead241ebb454d7f0bfcb8d6cc5004f8580013d7e97549fe9ed4cec64dfb8e4d2321df519da5f15c85a7ca0a5f2394b9e094b0c35616d224c5e49deb29fd65d2074f33b4fcbdf95219d5348b7b417e2966c44f070aefe4ead7ad5", 0xff3b}, {&(0x7f0000000040)="4fd7cc81c8ff5d7f90da59f5707ac351ca7b84b119247178dda7098337d4ee7bcb1fd8695d77afb981d8f45a4dc868e1258e012fc88ff4217948765b83842768455bdd0a7baa4b21fcef7ad56591fac304e5c5be8d08a2ed8ec6c4c902e5e2de7a7b6060c6415f6f2c44e215d0c40096e334fccb09ea670c8cd583e89efd891265e4eefde137", 0x86}, {&(0x7f0000001480)="6e6bd605841f9b6e6e0be9be0d5d52ab07cee5390f0e9085b2e18d8f578445411e7d3f768f34068d4dba1034ca595352763d40245ca2178058a755330bdb174ec43732257da7f79cef707f34497f5ec552b1e9e1c08a1f5269dcda60242afa33a341c0ca1100b707f18d471ae3f3d95c118156200ef47bb6e7369e863aa03631f8b9eab0cd4b0b38b4ef17048682f9d5b6df0973ef234cff04abb6466945270a0a985550fe2014fb7abc83fc8b3b7f75923b779d16f0b4e5c80f966d72645f29d014e0627c8f89b9d8b26d24e360250545eb17957784fb20e1fbdee7da50fbdb8d487707478e72d5b2884cc3c454ed155d6f32685713ffcc572b53084e0113477d97ab88c434c4adc08e0a18e66e7786969f868ad6ff8f5814c621bb52cac42e11ee46dcfce456cfdc94d530515fdd069cbe282c3f455d10fe951112afcd6cbc32547db5f6ccc745b90a87e898a557514bc0d1b6b6753fb17b56efbc2a865cdf1e24002818cfad09756ef2035bd96add473b368c32a326e9ccdb6089069848b14cd14de38cd4f5cb3c6837db04d1f4d51ae506d615ad03ef0be60d0c1e60e20f9d105caa18e25d989d0ef6c27bcab3495768e233039ef6721beeb0bf4b571b1597308ec055cb07977b345487dd2162aed74bea7a3603df60865a7b6d8163f1ff5e3b5c9258c84f76a493150358532da2e510804cf5c35a91ad1ce5c4737dd6c509b8bdfbd039398dcd86f4e2fd707b5bbed91b2faf2c7a208bca09b463076b66016b0518859904751dd253295d3f598bf2dbf02cbfda5ed2303c5b168fc08b22e9b28fec2dd529920dca9ffb79bb5a42401bf27b3e0932ac34b7ecbe68e7acc5bd21c555d652e4adbc6515fd197d3264ad035d1036a9555feb03fd4a88a11a895a87b1c5c1383174a3dc0f2ae259eabfef8df6a986a3554d73919b43b71b20b80c4c0b837d0c49f25f8b1b578b7d2635c087f21c353734c675786f1bed76fe568b1733f334baa5e700630993b325b32d96ed509db4d181efce1aba8f2713525a67c1fcb7c5413c93509d5e01f07a38a7df68ae4bb6a5c853215ad97e49805d373a3a617e6c0abed54d311871fff3f368008156d4eb851e019d64f366465d994c709f3b98be38e652d3f9eeec15890db05219017c9c80b9e571fcba2d79581ae6d46ae238ba31b0115b7cff206b7dd6e9911b1be7002ca180be60d2eefd8d03d8d9eba4b6b002b6f23a3ecfd32de06d436444ac9b5566aaf873dd2067c8deac4452f3e059f48d7831f4c0344ea965a7b74883b4f00b1f492f0ab4efbef74f161d136d42ec754ee90e57fb7a33e90f6d6c78dd03c2f9bcbdc5494f4746dde85c4459c1b00bece241a934677ccaf457534591c1a365965aa472c260ec102cfcd700fee3d1dd72aa9dbd5806f5bf601ce96d406d971264c930487a5daa7c62d38ad6b83b13c62e133e6661181c5549fccab5a01c6d641d627ddac3fef164c81b088a998f41ab9ff31d9a36f2ecd187a90c70975a19729b9d996cad4e66705007896bebafab5945ebf65e7986ff1381a7fafff754b6d8fb15c25d2d4140739d4142dfa14e17eb203aba6f07b243d05e78e9c2b2f51a53e32b2342bc44f333db98466faf695c313559dbc8cbc6077da6216a9f1f4220a034535fa96e4fd7c30f3587906ad76fe1c634b156f9a9b0687a5291563806e880f6a8fa1dc644bae21b95d42a8d3d33da15dd6a7a2a5e4c61c40f4c0a48b7d1e6b441422dad32b1046b0fe0aecd4386659ec8cf474ed28acf6a16bbc68df48d5781c7f7104ff449addb81d4f5ba4cf1151eaebc8fd395b535fa88094a5dab5748fe62d9b3dfd13309cb475355ccd310a11ec24a7d3dcd92a4897b489e78e92cf67c20e3ebb4f18114e5da0474329412dfb3d731ea0a0b5056eb88af68d49afb61ff0d3f18b853054993dfde353a58d322e3baea108f46b2406691aa4261f72202713e3c58d4fb198a2ef8c55961ed8dd98cc97df63bab3008bce8499988b0e5f9b2ef3f4dc485f481d6c1073e09027bdad1e465ba256e6f4341e61e19ac85be700d68b570b7cc98aef57d2a6b42dcbd9983ac9a355c9517e7c389d8396e3ad98840bfd6dd574ac6154070539efe2911c5742d7336ede1805a6a13c7283181349184e7f7dafc3d91821f8133cf33cfe103a56ad64f0cc92833bc49ed4dd3bd0eead2dc7305de1bdb931e56cd620b0db6432b3f0c0e1b5b9b28611e8de5166f39a7fcc2350cdd2addbea1617b468249c79fa019de3cf1aab1e230ce4844e2caa677a8e320ab48b488b229755f67a3e76129743d73a131d5a84f455e947f52a7bcf0856094ae0f80aa7a5b6e1c43d1a2a3c1f68ed8724ac1cca1333a695cb47a5f297726362a45a11c810f4554344833092be5a94db8d4c4987528d0c1fe92c0da77f0944292fb66e10d8483c6c068c371deaac8d7bc22fb9df627de3fdc615d30a0c4a6ee57794fc8f2800af887a3cb6b0fe21c88a1a45fc86c36aa1073e11ec94619d3d6e186c5a59090f2a33100a162fac6363ef183ada60bd5b1d86cd51c4fd7ab9f889c93c6ac43c991737a8b069724c73c579e642b7c9fa26a61151adcf46a856e6db940cd60073742cd5b299cd5d76fcc0a83df68fa48d45c27093b10a04867972a2d303a578c6305c30291d3dfc5256573f340fdea823b32c0bc12fb30608b4ef0527264de739799b360536249dbb3cfddd17ca12534f6a30d942dfe981fe2da798c64ccd5b17c37ae9bf1c75a1301a810403695f8080abead28cf4395083824c1060bd90d2c550706fb5665e2be31dba5d1d9ada6479f2fc627b88bc6e21de620acb83c85cbeeec38a0caee36bd6a419c2a03aa5885dbc9a3803889c41efe21694d2698e09e2e3ee819755df99a2a7e8dfb4ff608e676ae0b50b7be1170637ba6f6be1b5b9c89ff1d1a4992b5d38445d5e432abad6fcca1cbe2b4648fd8e39d1aafe92a40bc10f609603f2ba26897f9a55b9bc128ca1aff6bffdc5d2e59bf67a607c170ea19c9082c5bd81c1345b23de636f7586e14d6505296c0a0bdb1a2996a520e1c9008d90895cbcac93f5b9f975d0cae0e8d3f92247fc9d08c09469ee8dcbbfc5a5fc69572ea90def49e3839c1166a3615ae0680c47c9065983e03f7215358f4be47227d6926510f306c0946acc6f2dbb329538ae98658a31355671ec589b452832802b6bb7398c95b4cbd71f5596b6d85ddb9055848ed1b2a18ade4a06ce1cb1f2b67ca2ffeecb441b4aac74cda3d11bf0e086fef3c7bd950d4ea2f6d11886231048d6a3c6e7313289dbc393b38c9f15b12827ac8dc7e7779337979739c4e33fb9e2d79c5296fae207371f46c3fbe0eb19777662069eb7e0871bc3b6eda2b204152b8bcbe306ba03f58f48ffe582ab4677bbfcba175027828f3bee53ada79fca39c37a549cbdd9d58c485eef938cf7e8bbc33733b1eb0a8be33c5ca0d519dd90e15c5825f80a866a5647912a86cbb23f6a23423bd7b25a07e3c05d064ee47a58ea2110b43c60d63455d64686a159356df4183553e25394c4090f85837ff3857ba27c0ed3e4ad9bbedee0937fc97065577b71ea5c44fa097617b2f97ea82be37433759f0b4f33ab4753d1955f5e1a377c42735267858cd2f494aedce8952e5171fec640f75eb93e1bc0e06c5d43eea360879a3bd306327feda0bbaa359e7f0057627016eb369a76dad379dbb169d9ff98b8079f61d4561f8723f72935eb96556ee50c5b54f3adf4878a39c3ac96a2a222927c966c70ee72ab2b0bb6f36f41746100305bfe8bbbe952dfb7804bb1f0d25aa1368d9712c80422c30a82308a821fabf47cc2a7c9b5ddb4b27cbbe6f68ed5f01d830c4ed5e5d0694ff24e0b9b02d2b0e0f6b3d4f185441b4c4ef43b69be69f13a278625eda86ad21f700fed3bd23b0e6e71b8ceb0aef028c9b3090b543ad47e5fab9e56c071b66c5338cf113b79360b53e4d918f552d95359ab4f0ae55b9d3e549b71e6d4459d2f278343ba84ed562bee6a59f4dc968fe9c539099957c2d994073774d96ce8ea637242dcc4f89916e5e0a2f5e30c82d824b977cb0fdc45575e3302d59b7a085d2855b1b3e28f868bf25f34ba9f509faa3ad1c06be6d9ccb2565f7bfb5f2ca142f1d62d20a4b52cc5b26b79105d53b2210c76feaf6a7ffe57258927ecd9c673338c8a775eba00a5208c3d88c2d03e0daa0b69e251462c6b6d29136aeed94681a664d07623a999b882eb1b994eef558ff9c5e888e2239e36495a7cedb0db252907c3573aa2a1d30988a3c4b48c22d3c78df71a7e5f936a23caf6c195a56ab9bb2ae3651653de1531cbc5caa7c1965146ec1ca3e46355dcedb8a03ea610a0db5f6acd13a6b19dff5fb4876f755fbe47aa79e3057e19f503ca4b4a3423be3c48716a88f94acc798ced3e8c00160b5986f897b95405b296355de08267db0f4aed15f8ffd7b2e6733bbfc98ac3d20e14df154fb109fb0111fcb6f2de75a1ac301c23943ee9aeb901152b3eb11c90735a085abd03e2327a7483688d4d4c974c269fc3afc1b811343de98055c9a5a01313744d4e17066638c884003de893dcfa97365d84de0283183cec81da52357ecfe2873b19209ea422ca4c3bdb2557b205cfddd82b14d1af8c416502a7499ac8ec3c971e7be78ae7765492a56429da524b9efad7ea40f1acaeda1579cfbf73943d7f10977fed5020fd5a6cfb31e958d6f6978c21b02c0ee1e00e68bfae99a6f27b12361f7aa71c07d22b4c5950feaef59b4d56b28c9953055b45d73ec8b9cbfce26edb48aa344c025610a4615b9e27ae6ccbdb3d54faf22316ee0f7b69446730f4049db669429b26bdcbded8fe1e2635b8d25a6c4477444da595ff52e2e138cfa688d69c1d5977e34810c3fecf45e88179d032f2ce3f46bf07730d9a4e7df0428a48a977f859398321008330de88cc7b3b8d2bd16593c8ca48b84f1ff28d1d4e6c4b36d08866ae6e79f1f99ee829de20ddec83ca3cff4dcf48e7e701fe469e781f6981fed492037109fc4fcc38207187a2b2afca9b065ed99186f9c33191b2ad22799ca4e3543342e2db4582a2e32a527d8400b6fc506383ca8702efd65d72a7b64c1775f798b4e1158e34a20a2b8757cda03b4dd2d1d1bea9b534c50d15a32b186f04e4a9a707a298c57992359a5f71579c2a063c0f4a9fe07b5270371635e934ce12b75a08df5588f3dbc81b97ea87d1cf53f8837cf95cb4bd2b83505d9375e4008cd44f49e55e42a9604aad2704f70bfefa411506a4346cc4fdf27acf6be3eb00d8dabc1234f9453cc0fe2ca6590f8d675ea267d01c20065cb04cbba26ada900aa26b826f8ed9dc357f41ee683ec98e787ecb1f7205676f8f1d384004ca518ae63740de1f31c833dc40745f4aeddaaeaf2d21c09cb337bee37c9595ddd0849b26fffdd1a16c8792258737abc56ead3468c71182e5d75b8fcf6d1fe4d861ea34f4bf19e78af4864e06c2de153e0f78679424429ad94831328a80ebfba4f4639464ceb7256db948134c5a98fed767eeba1346ff25ab43b68cbe3f4941a92e9ce0782399f38c3047fa4d6684598ffd3c70b0ffc2e358facf63e1a37a61c28a659a17eede9f9f84cb7801167c720f432eb34ab3097d924f409419e828f46913f765e73794755108fa5511364990926dd8afb64e3dc5ae455be754b83a3293e74d042b2db7f502f6d9fbd525be6ad1e813bcea76e6e2c6bd246fcb9852232737d54265148c2497554d78237dec8e28963431cde9057014ce394b31769ee24f9d68235827258", 0x1000}, {&(0x7f0000000180)="44842245b2e52590c01c6f865819a6bb54fe13589b4c903daf87b495f883154514d896e4539c3093fc6c8beec19354a4d6e3518b114a3b61ed1f99308d4ae4a423d8256b91c7d2ca716342f69cd84374acf1d0f9c2aa1749a6846b82a4368fe2681c240e22c7bfbac10e13f2fea57100acefd3d3cd1dc27a3889836e76ba84a004da883bda5e91a5815d555b1a0715e3e70acc61392252a6b9dc82f6cb07544e8061dbc1dc343da6b938ffd73a3cff0f975a7916d6fc67ba296b26d9836a503ce4fb31cd3c22d1bb90c6813b134fe5fbb871758860c0e57dc1439ceb630d8250fddc0163579381e43c43ca62982c8cbc2126625e8bbea0c71350a98952", 0xfd}, {&(0x7f0000000280)="3760c2fa3353b5f1acf81fa8ef5972a2631089edffd893ce916b4328ad5106437fabf3323f1e3829243673668c18da8b3d06ab1ae4a041484260e199d0b4b0d8e29bea9680bf28e54ce0f1b53a597e60935ba17ec96ecf1b7de1622010b3a1bd9605644ab51995eb9033f684b002ab47df5eed225ba9e563090c00b16baeeed6e1191cb426ad1549f47acdac1b0a3d98c9ade848f52aa5caebcd49c8b2f59c9617adb35b4eafa13e47ed4b75517f42bc1a645570db6f1d0cae3c719e10fe407eb36dc2beaed5d02ec63868550e1216467afe33d8e965c82b5d0eb36b340c9b9c7b", 0x67}], 0x5) getdents64(r1, &(0x7f0000000100)=""/111, 0x18) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000002840)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000002800)={0xffffffffffffffff}, 0x2, 0x3}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(r0, &(0x7f0000002880)={0x8, 0x120, 0xfa00, {0x3, {0x9, 0x5, "688dab5af700af6170ee18790fc7f4162e2ec3e5a0f56a4888e7a6760666f947c3b36feface062aad93e7277379b29df1bc12e6f4481feed6d864090dc714f08b84aa7de0f92b31b20033a0d367b0b4988b26ace724aef83a7482b115ffafbacad34643f3a1ad682ed6d5c3bc5e78f8d304287f84eb8b8538c874c61f8cf6cc597e950b7f03472b40a88502188f52d594cb59ae7eede1b7f82d53dcc30819b1b1239253dbfd869212a419c89a9e697d9d119d817623bbf8fd871d36f329e3517d40ea943b4ecfecea54ff3382d706b43a23a7643a3d87fbad26ea3a02cf7bd91fb7b15140d41f9eea1afdc9c1ecf6e7b7ae6aa5607e15185c6cb9028e100d47e", 0xa7, 0x0, 0x3, 0x0, 0x8, 0x100, 0xa43}, r2}}, 0x128) getdents(r1, &(0x7f0000000380)=""/246, 0xffffffff00000018) ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r0, 0x40505330, &(0x7f0000002a00)={{0x830}, {0x3ff, 0x7ff}, 0x5, 0x0, 0xe4c6}) socket$l2tp(0x18, 0x1, 0x1) setsockopt$inet6_IPV6_ADDRFORM(r0, 0x29, 0x1, &(0x7f00000029c0), 0x4) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xae44, 0x20) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f00000025c0)={{{@in6=@mcast1, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in6}}, &(0x7f00000026c0)=0xe8) mount$9p_virtio(&(0x7f0000002500)="268a00", &(0x7f0000002540)='./file0\x00', &(0x7f0000002580)='9p\x00', 0x40000, &(0x7f0000002a80)=ANY=[@ANYBLOB='trans=virtio,loose,access=client,access=any,cache=fscache,hash,fowner=', @ANYRESDEC=r3, @ANYBLOB="2c6f626a5f747970653d2f70726f072f6578708272654d00000000636f6e6e002c686173682c7375626a5f726f6c653d5c7b776c616e302a776c616e3025656d30282c730761636b66736465663d272c61756469742c0021cff38a7a97495b13e52123524d89876deac5c164fbbd89d145717dded9898e2c91c01f6dcdc4636c3b21cec9"]) r4 = getpgid(0xffffffffffffffff) getpgrp(r4) 10:18:34 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x41a0ae8d, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:18:34 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xe000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:34 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x6000, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) [ 711.784400] binder_alloc: binder_alloc_mmap_handler: 24811 20001000-20004000 already mapped failed -16 [ 711.794644] binder: BINDER_SET_CONTEXT_MGR already set [ 711.800654] binder: 24811:24816 ioctl 40046207 0 returned -16 10:18:35 executing program 5: semop(0x0, &(0x7f0000000080)=[{0x0, 0x7fff, 0x800}, {0x0, 0x7fffffff, 0x1000}, {0x4, 0xffffffffffffffe0, 0x1800}, {0x2, 0x0, 0x1800}, {0x4, 0x1, 0x1002}], 0x5) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) ioctl$EXT4_IOC_MIGRATE(r0, 0x6609) read(r0, &(0x7f0000000040)=""/11, 0xffffff3a) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000140), &(0x7f0000000180)=0x8) r1 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x513000, 0x0) ioctl$EVIOCGBITSND(r1, 0x80404532, &(0x7f0000000240)=""/233) ioctl$TIOCGETD(r0, 0x545d, &(0x7f0000000000)) 10:18:35 executing program 0: shmget(0x1, 0x1000, 0x7c000102, &(0x7f000000d000/0x1000)=nil) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) r0 = accept$inet(0xffffffffffffff9c, &(0x7f0000000000)={0x2, 0x0, @multicast1}, &(0x7f0000000040)=0x10) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffff9c, 0x84, 0xa, &(0x7f0000000080)={0x2cad3c1f, 0x401, 0x8001, 0x67ad, 0x0, 0xbb, 0x8, 0x1000, 0x0}, &(0x7f00000000c0)=0x20) setsockopt$inet_sctp_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000000100)={r1, 0x84e, 0x2, 0x4, 0x400, 0x400}, 0x14) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(r0, 0x84, 0x6c, &(0x7f0000000140)={r1, 0x62, "a24cf219d28c0c146fbe23eea2653981e2fafe9f888e0da7b3bf60fbf5ef9d6666e55070854906135fffbe51cdb3680e4c5204dffe14ca3f37bff8ccff68736672ecac657195992710d550be17feae96a07fb4b00b67d604234906f51943c71bd9c7"}, &(0x7f00000001c0)=0x6a) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) 10:18:35 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x8ed, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:35 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0xa, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:35 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x5451, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:18:35 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getdents64(r1, &(0x7f0000000100)=""/111, 0x18) setsockopt$inet_buf(r0, 0x0, 0x26, &(0x7f0000000040)="e584399e33ebc9e90c39242e657e849e84d1612837a3a9c20b3746f95d65d2d1e66f1b5e5f4c888a063870acabecc9a2e7e0c4cd44a93fe6391748b74c07205a5dffcfc7e7ddb75970f81112abb939c94cf422d12edfeec498ae9a6ce1825bf62cf27325dbb71b122f5769eed8d2abe0ba48fcf709e857962128b02f5aba14d3d4c10efef8112619f57ca4f302df216c86d1b67da5de", 0x96) getdents(r1, &(0x7f0000000380)=""/246, 0xffffffff00000018) [ 712.207210] binder: 24833:24839 unknown command -28376503 [ 712.225977] binder: 24833:24839 ioctl c0306201 20000440 returned -22 [ 712.242882] binder_alloc: binder_alloc_mmap_handler: 24833 20001000-20004000 already mapped failed -16 10:18:35 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xd039, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:35 executing program 0: r0 = shmget$private(0x0, 0x4000, 0x4, &(0x7f0000528000/0x4000)=nil) shmctl$IPC_INFO(r0, 0x3, &(0x7f0000000180)=""/93) mprotect(&(0x7f0000526000/0x11000)=nil, 0x11000, 0x400001) 10:18:35 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x8080aea1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 712.328007] binder: 24833:24846 unknown command -28376503 [ 712.349299] binder: BINDER_SET_CONTEXT_MGR already set 10:18:35 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x402e000000000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 712.381160] binder: 24833:24846 ioctl c0306201 20000440 returned -22 10:18:35 executing program 0: r0 = socket$key(0xf, 0x3, 0x2) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000440), &(0x7f0000000480)=0xc) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) getresgid(&(0x7f0000000380), &(0x7f0000000bc0), &(0x7f0000000400)) r1 = syz_open_dev$amidi(&(0x7f0000000140)='/dev/amidi#\x00', 0x741, 0x88000) mmap$xdp(&(0x7f00006bd000/0x2000)=nil, 0x2000, 0x8, 0x100010, r1, 0x100000000) r2 = request_key(&(0x7f0000000300)='rxrpc\x00', &(0x7f0000000340)={'syz', 0x0}, &(0x7f00000003c0)='/dev/adsp#\x00', 0xfffffffffffffffe) keyctl$get_security(0x11, r2, &(0x7f00000004c0)=""/82, 0x52) ioctl$TIOCSCTTY(r1, 0x540e, 0x1) r3 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x6, 0x80000) vmsplice(r3, &(0x7f00000002c0)=[{&(0x7f0000000180)="b71743f7b8f8deb6cf771d7e098b3229adb705b7c8bf7d39c5c9d485b9ca5cef52bd38b4dfc8cbdafc06cd6b59bd16f61f499fb11238ba2923ccd09b83fca1e1cb8799713621a606946457b670c0dc12eeade62fb1b9beb358a0611d81d27c9e07cc35a79fcc9df921fb32bab745c239727ddea43a465f800c9869f77bf81648ad4d0f9efe12f9a06088145324d7e44ae5b0d1cf12a6f3ed0ddae4a3d419ee5aa849d673f8df3f921154c2c794f3e94f28f0bcbb8815f0d84982f772be427e0e675ca0b840974c86744f25adb84e8c2a77eb54fd0965", 0xd6}, {&(0x7f0000000280)="e983468df13f6c258e6ec9a011", 0xd}], 0x2, 0xe) getsockopt$inet6_dccp_buf(r3, 0x21, 0x0, &(0x7f0000000040)=""/191, &(0x7f0000000100)=0xbf) [ 712.429994] binder: 24833:24839 ioctl 40046207 0 returned -16 10:18:35 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x68, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) [ 712.631270] binder_alloc: binder_alloc_mmap_handler: 24874 20001000-20004000 already mapped failed -16 [ 712.642398] binder: BINDER_SET_CONTEXT_MGR already set [ 712.648954] binder: 24874:24876 ioctl 40046207 0 returned -16 10:18:36 executing program 5: semop(0x0, &(0x7f0000000080), 0x13) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000040)=""/11, 0xffffff3a) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BLKBSZGET(r1, 0x80081270, &(0x7f00000001c0)) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000140), &(0x7f0000000180)=0x8) ioctl$TIOCGETD(r0, 0x545d, &(0x7f0000000000)) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000080)=0x0) r3 = fcntl$getown(r0, 0x9) kcmp(r2, r3, 0x3, r0, r0) 10:18:36 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x58110000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:36 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0xc0045878, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:18:36 executing program 0: mprotect(&(0x7f0000052000/0x1000)=nil, 0x1000, 0x3) getresgid(&(0x7f0000000b80), &(0x7f0000000000), &(0x7f0000000c00)) r0 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffff9c) accept4$bt_l2cap(r0, &(0x7f0000000100), &(0x7f0000000140)=0xe, 0x80800) 10:18:36 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x600000000000000, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:36 executing program 4: r0 = openat$cgroup_type(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.type\x00', 0x2, 0x0) r1 = syz_open_dev$vcsn(&(0x7f00000000c0)='/dev/vcs#\x00', 0x10001, 0x40000) getdents(r1, &(0x7f0000000180)=""/135, 0x87) ioctl$EXT4_IOC_RESIZE_FS(r0, 0x40086610, &(0x7f0000000080)=0x32) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getdents64(r2, &(0x7f0000000100)=""/111, 0x18) getdents(r2, &(0x7f0000000380)=""/246, 0xffffffff00000018) 10:18:36 executing program 0: r0 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x200000000000000, 0x10b000) ioctl$EVIOCGNAME(r0, 0x80404506, &(0x7f0000000080)=""/148) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, &(0x7f0000000000)=0x1000000, 0x4) [ 713.149971] binder_alloc: binder_alloc_mmap_handler: 24893 20001000-20004000 already mapped failed -16 10:18:36 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x284b0000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 713.219760] binder: BINDER_SET_CONTEXT_MGR already set 10:18:36 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4004ae99, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 713.261467] binder: 24893:24899 ioctl 40046207 0 returned -16 10:18:36 executing program 0: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) getresgid(&(0x7f0000000b80)=0x0, &(0x7f0000000bc0), &(0x7f0000000c00)) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vga_arbiter\x00', 0x901, 0x0) r2 = geteuid() mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xaa0009, &(0x7f00000000c0)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x7000}, 0x2c, {'user_id', 0x3d, r2}, 0x2c, {'group_id', 0x3d, r0}, 0x2c, {[], [{@fsname={'fsname', 0x3d, 'ppp1ppp1ppp1'}}]}}) 10:18:36 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x2000000, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:36 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xa7a8, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 713.477129] binder_alloc: binder_alloc_mmap_handler: 24926 20001000-20004000 already mapped failed -16 [ 713.534662] binder: BINDER_SET_CONTEXT_MGR already set [ 713.549053] binder: 24926:24928 ioctl 40046207 0 returned -16 10:18:37 executing program 5: semop(0x0, &(0x7f0000000080), 0x13) r0 = syz_open_dev$admmidi(&(0x7f0000000080)='/dev/admmidi#\x00', 0x3, 0x24001) ioctl$TIOCLINUX7(r0, 0x541c, &(0x7f00000000c0)={0x7, 0xc3ba}) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) ioctl$KDGKBSENT(r0, 0x4b48, &(0x7f00000001c0)={0xffff, 0x200, 0x3ff}) read(r1, &(0x7f0000000040)=""/11, 0xffffff3a) ioctl$SNDRV_CTL_IOCTL_HWDEP_NEXT_DEVICE(r0, 0xc0045520, &(0x7f0000000340)=0x3) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000100)) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000140)={0x0}, &(0x7f0000000180)=0x8) ioctl$TIOCGETD(r1, 0x545d, &(0x7f0000000000)) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000240)={r2, @in6={{0xa, 0x4e22, 0x7, @local, 0x100000001}}}, &(0x7f0000000300)=0x84) 10:18:37 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0xc0189436, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:18:37 executing program 0: r0 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0x4) ioctl$FS_IOC_SETFSLABEL(r0, 0x41009432, &(0x7f0000000140)="697b62d478998ca9591514d7767fd2cf5ac11caa24800e296f211ec526414b7a1ee8c92c7c533c6b52960089a40a79685a9d3ae2da3d220fd29b28586ad2603081413593cc7a5f23837a87ff4f970bf3a7bc71e04cbcd92d6afae71d0753ae0b0e17ce64a44d7090874fcf0acfcc3f0728dd45136963106048738824bae93fef133fdb3595854e05b98253cf7237b904a8f4007cc8f3118a8d44bf05be47296584d162bd337ade399ed51c47f16d236604d44fb4792b44e7428a79b18b84c7b818eb3d7368c1f3878e3f9c41d5b803b882d98ce6636949638dc935e67e485c26db8d5cb9adccc809aaae776fd48d728dcf873100") mprotect(&(0x7f000021a000/0x2000)=nil, 0x2000, 0x44) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) 10:18:37 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xe8d5, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:37 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x4800, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:37 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getdents64(r1, &(0x7f0000000100)=""/111, 0x18) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x40082406, &(0x7f0000000080)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00") ioctl$sock_inet_tcp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000040)) getdents(r1, &(0x7f0000000380)=""/246, 0xffffffff00000018) openat$mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/mixer\x00', 0x8000, 0x0) 10:18:37 executing program 0: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) getresgid(&(0x7f0000000b80)=0x0, &(0x7f0000000bc0), &(0x7f0000000c00)=0x0) r2 = semget$private(0x0, 0x3, 0x1a0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000000)={0x0, 0x0}, &(0x7f0000000040)=0xc) getresuid(&(0x7f0000000080), &(0x7f00000000c0)=0x0, &(0x7f0000000100)) semctl$IPC_SET(r2, 0x0, 0x1, &(0x7f0000000140)={{0x5, r3, r0, r4, r1, 0x100, 0x4}, 0x100000000, 0x0, 0x1}) [ 714.120352] binder_alloc: binder_alloc_mmap_handler: 24944 20001000-20004000 already mapped failed -16 [ 714.136408] binder: BINDER_SET_CONTEXT_MGR already set [ 714.146510] binder: 24944:24956 ioctl 40046207 0 returned -16 10:18:37 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x100000000000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:37 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:37 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x5450, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 714.306854] binder: 24970:24975 unknown command 0 10:18:37 executing program 0: mprotect(&(0x7f000028c000/0x1000)=nil, 0x1000, 0x8) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) 10:18:37 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xe3120000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 714.328232] binder: 24970:24975 ioctl c0306201 20000440 returned -22 [ 714.373699] binder_alloc: binder_alloc_mmap_handler: 24970 20001000-20004000 already mapped failed -16 [ 714.410177] binder: BINDER_SET_CONTEXT_MGR already set [ 714.445496] binder: 24970:24985 unknown command 0 [ 714.453975] binder: 24970:24980 ioctl 40046207 0 returned -16 [ 714.482855] binder: 24970:24985 ioctl c0306201 20000440 returned -22 10:18:38 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4008ae90, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:18:38 executing program 0: mprotect(&(0x7f0000314000/0x1000)=nil, 0x1000, 0x9) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000040)) 10:18:38 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x58ca, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:38 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x1000000, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:38 executing program 5: semop(0x0, &(0x7f0000000080)=[{0x7, 0x3, 0x802}, {0x7, 0x0, 0x1000}, {0x0, 0x100, 0x1800}], 0x3) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000040)=""/11, 0xffffff3a) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = add_key$keyring(&(0x7f00000002c0)='keyring\x00', &(0x7f0000000300)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffc) add_key(&(0x7f00000000c0)='encrypted\x00', &(0x7f00000001c0)={'syz', 0x3}, &(0x7f0000000240)="70e9601f52cbddbb19501612e1572e167c176843b8b980baf1369a796c69297a447dcf731de84bab1a570e9029049a1d67762f7b560b27d4a34ba9c4c16d9f9bee267793b73c7b6866", 0x49, r1) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000140), &(0x7f0000000180)=0x8) ioctl$TIOCGETD(r0, 0x545d, &(0x7f0000000000)) 10:18:38 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x8) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getdents64(r0, &(0x7f0000000040)=""/111, 0x6f) getdents(r1, &(0x7f0000000380)=""/246, 0xffffffff00000018) 10:18:38 executing program 0: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x40001, 0x0) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(0xffffffffffffff9c, 0x84, 0x6d, &(0x7f0000000040)={0x0, 0xcf, "989eedb8d5a445d385466262ad9fb06f61c89990daeb9af1fc0dfa3d710e3e7903ad5a829d37f01cb78aa7343699dbb1a1f38ebe9ba58d7ea6e41fb4cee7e2c5411fbad33da486e633fd8edea369a169f73098ef474dea1dfc43f9607f490995efb95caa5740e250902770e9219170b2db76f5ac5bd345b7886bb0f5eb24c2fb9ffa3d59ee2d414307971ca1d315de8c0c3a3dd4a752ed71d2148508a95bc416e44e88850d5578212ff0f609be7b96e489030e8107938acf51589906b8123ed7a9d7eaa2d3b8575ebc1ec799fb307c"}, &(0x7f0000000140)=0xd7) setsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f0000000180)={r1, 0x5}, 0x8) 10:18:38 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x3000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 715.044649] binder_alloc: binder_alloc_mmap_handler: 25001 20001000-20004000 already mapped failed -16 10:18:38 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4008ae8a, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 715.142172] binder: BINDER_SET_CONTEXT_MGR already set [ 715.156066] binder: 25001:25005 ioctl 40046207 0 returned -16 10:18:38 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x48000000, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) [ 715.189516] encrypted_key: insufficient parameters specified 10:18:38 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x1bc60000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:38 executing program 0: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/audio\x00', 0x400000, 0x0) bpf$OBJ_PIN_MAP(0x6, &(0x7f0000000080)={&(0x7f0000000000)='./file0\x00', r0}, 0x10) mq_notify(r0, &(0x7f00000001c0)={0x0, 0x39, 0x1, @thr={&(0x7f00000000c0)="bea8307e0656aa687ca3f410a09bd7a615951bb7af3796a7abd536c46a59a0b8acd0b62130764b13b3c0c5deb0b1bcb203779db3b810c9143579f59f9af9ca59128ffe62c1f8841ebd8aeb2ed4326485bea88c59ff1177e4d0691d73ca1738eb0a7cc8edcba83959abeb0311c1addbf6d013183369dfd0c4b1bfd9952935b503db10c41da94551a196743381", &(0x7f0000000180)="56f606bbf54beeb60f8b7661886c5c946ca49ee969972faa5db634b6ed9dd32aebf08138caeb5865a95e1fc770"}}) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) [ 715.320976] binder: BINDER_SET_CONTEXT_MGR already set 10:18:38 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4138ae84, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 715.346399] binder: 25031:25037 ioctl 40046207 0 returned -16 10:18:38 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x7828000000000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:38 executing program 0: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) getresgid(&(0x7f0000000b80), &(0x7f0000000080), &(0x7f0000000c00)) 10:18:38 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x600, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) [ 715.563343] binder: BINDER_SET_CONTEXT_MGR already set [ 715.584709] binder: 25054:25055 ioctl 40046207 0 returned -16 10:18:39 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:18:39 executing program 0: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) syz_mount_image$hfsplus(&(0x7f0000000000)='hfsplus\x00', &(0x7f0000000040)='./file0\x00', 0xfffffffffffffffc, 0x0, &(0x7f0000000080), 0x0, &(0x7f00000000c0)={[{@creator={'creator', 0x3d, "5cfcf7a6"}}, {@nodecompose='nodecompose'}, {@nobarrier='nobarrier'}, {@nls={'nls', 0x3d, 'cp949'}}, {@type={'type', 0x3d, "c43e19b6"}}, {@nodecompose='nodecompose'}, {@type={'type', 0x3d, "a814fffc"}}, {@part={'part', 0x3d, 0x100000000}}], [{@defcontext={'defcontext', 0x3d, 'user_u'}}]}) 10:18:39 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0xfdfdffff, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:39 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getdents64(r1, &(0x7f0000000100)=""/111, 0x18) r2 = getgid() ioctl$TUNSETGROUP(r0, 0x400454ce, r2) getdents(r1, &(0x7f0000000380)=""/246, 0xffffffff00000018) 10:18:39 executing program 5: semop(0x0, &(0x7f0000000080), 0x13) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000040)=""/11, 0xffffff3a) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000140), &(0x7f0000000180)=0x8) pipe(&(0x7f0000000080)={0xffffffffffffffff}) write$P9_RREMOVE(r1, &(0x7f00000000c0)={0x7, 0x7b, 0x1}, 0x7) r2 = semget(0x0, 0x3, 0x2) semctl$GETPID(r2, 0x0, 0xb, &(0x7f0000000240)=""/78) ioctl$TIOCGETD(r0, 0x545d, &(0x7f0000000000)) 10:18:39 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x834000000000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:39 executing program 0: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x8, 0x50b002) ioctl$RNDADDTOENTCNT(r0, 0x40045201, &(0x7f0000000040)=0x9) [ 716.004725] binder: BINDER_SET_CONTEXT_MGR already set [ 716.024035] binder: 25074:25077 ioctl 40046207 0 returned -16 10:18:39 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x700000000000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:39 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x6c000000, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:39 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4080aea2, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 716.170803] binder: BINDER_SET_CONTEXT_MGR already set 10:18:39 executing program 0: getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000080)) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xfffffffffffffff9) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffff9c, 0x84, 0xf, &(0x7f0000000140)={0x0, @in6={{0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, [], 0xf}, 0x6fc0}}, 0x100, 0x1, 0x1, 0x9, 0xfff}, &(0x7f0000000200)=0x98) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r0, 0x84, 0x1b, &(0x7f0000000240)=ANY=[@ANYRES32=r1, @ANYBLOB="dd000000ff3d4bdd572fd5423164895b12c84fcaf08f7a4c562571ea919b9f72928f990456a33e4bfeb1f907e8b8c84812a9f615b34dbcdeebcfad5a15afb9bbefbca048b8c00e8a549689c429950f41eae144fc40d4fd40f4f2331d1a425ef96c990385891e0555d889b43c3440e9557e2a360cc8ec2e0d9a3a3397fabda2c50bbc32917ccf8b33abfbc9ea7b444151ecc6f226e334bc4375ddbacaf0b849ac458f73cbb500d0beefa84804ecabf85d48006a7c37d5fc55011935b2771a9e9774ed1fb0c83484e6754b5d997d17483035ec55379099da2fd0220bd530bbbb45b4"], &(0x7f0000000340)=0xe5) [ 716.191389] binder: 25089:25093 ioctl 40046207 0 returned -16 10:18:39 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x48, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:39 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xe803, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 716.323540] binder_alloc_mmap_handler: 4 callbacks suppressed [ 716.323558] binder_alloc: binder_alloc_mmap_handler: 25106 20001000-20004000 already mapped failed -16 10:18:39 executing program 0: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) lstat(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) 10:18:39 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040ae9e, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 716.364065] binder: BINDER_SET_CONTEXT_MGR already set [ 716.375658] binder: 25106:25110 ioctl 40046207 0 returned -16 10:18:39 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x14) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getdents64(r0, &(0x7f0000000100)=""/111, 0x18) getdents(r0, &(0x7f0000000380)=""/246, 0xffffffff00000018) 10:18:40 executing program 5: semop(0x0, &(0x7f0000000080), 0x13) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000040)=""/11, 0xffffff3a) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00') clone(0xa0002101, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000140), &(0x7f0000000180)=0x8) ioctl$TIOCGETD(r0, 0x545d, &(0x7f0000000280)) pwritev(r0, &(0x7f00000000c0)=[{&(0x7f00000002c0)="186165272bd004cccaec8f67fceede915c71e20535a646aca7aee2d04267f4bdd385565b21c8fa8644662d5c5ee1dbaa6b261462bb67faec12096137e78b36b6d9a661f66f3de1e88f8819ebca649dfd02948cc53621f36ebfcf6e5c655df24b8c77abaefc680f87aeedb7033ab7a080e9a9cbce781d528163efbb1a17e32364b0616fbee648cb9d", 0x88}, {&(0x7f0000000380)="cd2e5822c936ba1414aa90964999e94a11c97f23a9cb651dfac58592fd13c84ba373282e69684fc4fb5285029a9424a77814ffbdaca9bb216ab482d5df2b52b2cf741a4a744217ba8cf245f9f92330b9daf81df6aa0380aacc7c8455761725cc9b63e10937da618b4f72bfba81776ae1e069e8408b097a12721285907ab26866d92a9eac0153ca38ce38ed0df595589665dfab94ec51", 0x96}, {&(0x7f0000000440)="9fe7b16982136ff40af3a77883a092e3a731cd39b98ed617bd7e33a78826406578cd48521a2985799f2b43f03794979890e9a94b1209cd97bb3d818649adaee4d3c64af808dc37e48be0b3fd73611bf757c02a7d2649dcdd7ace6eddfc5110034d579d81995ce4270421216f80bd786baac61fa14a905a7e7adfd3314e564cd87e5ac7903d6b4519e7bed678367b5bc9ae4c012f38d72c64056ebfe229d4749567c0d447d37e7b3ac13eb695e97afe719c3fde9090b437f9e5c235f17bbe917b9a3e845f205f2770e7843d7637b06ee630d6e77c", 0xd4}], 0x3, 0x0) ioctl$TIOCGLCKTRMIOS(r0, 0x5456, &(0x7f0000000000)={0x100000001, 0x0, 0x8, 0x7, 0x7, 0x1, 0x5, 0x101, 0x100, 0x800, 0x10001, 0x1}) r1 = dup2(r0, r0) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r1, 0x84, 0x15, &(0x7f00000001c0)={0x10001}, 0x1) setsockopt$inet_buf(r1, 0x0, 0x2b, &(0x7f0000000540)="0eafd8ff2ab35c519dbbc26895b67437a271ca859acedef82cb3e48a1a73f2a7ebad794c7f9e8782c9bd3dbf52476fe353a63bbf5578da0311b4cb6a4843b08afa93cbb33ad8fa16e2b4e8a88bafaf2a647c24e218dcd5c5da1c83f971c88660abc7ab76d90962efe2295832bed3af1df0db671ba6eea98cf4", 0x79) 10:18:40 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xb856, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:40 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x60, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:40 executing program 0: r0 = syz_open_dev$sndtimer(&(0x7f0000000380)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$EXT4_IOC_RESIZE_FS(r0, 0x40086610, &(0x7f00000003c0)=0xff) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) accept4(0xffffffffffffff9c, &(0x7f0000000000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback}}}, &(0x7f0000000080)=0x80, 0x800) r2 = open(&(0x7f0000000400)='./file0\x00', 0x0, 0x0) ioctl$DRM_IOCTL_SET_MASTER(r2, 0x641e) sendmsg$alg(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f00000000c0)="00e85b64cd682bd77a0ea485b9b001590181afaf44e4c334250d38d78c157855a700c3de04b6ff21356c763cb9187357734c437e46e8654d72d4fea55ee1b440870afdf38067a7944064c4b1b4", 0x47}, {&(0x7f0000000140)="b0880503693d9e85cbe4c7352279f5f1452ac175bb77aac0c8a53c9b9dc0e64dfcf5dfe498d85caa192e8822d5993862cee6d88d3e2d8c2a8b313f9926a0f68b64725998cd49a9120653fa62016fd05823328f850b5bfb5898d99332ed351087ccae61486acce3baebb0ab14bc9f371a4a0c3c446eb2a3b023ca4d483da811b63bf890", 0x83}, {&(0x7f0000000200)="52017a481e205b510f5d3203f6a481f72a20efe6ec15739d4c44eab29881d2d3287bbfbd185e3e7592814ff51735c92d5217ff8e1f5e246e0117e108ec9050c2ef30d1c5a92fbcd67475f9821ff272d249caa4a364319995a679e9428d65074d3294d42a8442bc560df70b66d44ae52211702a72114a83b5118a82b86f864f932ff75f30f33ffd0a53756e4223a476fccc388a22880680212beff82de389becd21a0d57bf2f87a898f94a711a4989f8894fdf2d1ef97ad2a2fc127f87ce7ce290fd126cb063dda1a92", 0xc9}], 0x100000000000004f, 0x0, 0x0, 0x20040000}, 0x8040) 10:18:40 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0xc008ae88, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:18:40 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f00002aa000/0x3000)=nil, 0x3000, 0x8) r1 = syz_genetlink_get_family_id$team(&(0x7f0000000080)='team\x00') accept4$packet(r0, &(0x7f0000001500)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000001540)=0x14, 0x80000) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000001580)={'vcan0\x00', 0x0}) getsockopt$inet_mreqn(r0, 0x0, 0x24, &(0x7f00000015c0)={@remote, @multicast2, 0x0}, &(0x7f0000001600)=0xc) sendmsg$TEAM_CMD_PORT_LIST_GET(r0, &(0x7f0000001800)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000017c0)={&(0x7f0000001640)={0x158, r1, 0x800, 0x70bd27, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x44, 0x2, [{0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8}}, {0x8, 0x6, r3}}}]}}, {{0x8, 0x1, r4}, {0xf0, 0x2, [{0x74, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x44, 0x4, [{0x6, 0x9, 0x3, 0xf9}, {0x1f, 0x2, 0x1, 0x7}, {0xe92, 0x10000, 0x0, 0x1}, {0x80, 0x5, 0x42f0, 0x10000}, {0xffffffffd634e111, 0x1b, 0x2, 0x3f}, {0x5, 0x2, 0x6, 0xffff}, {0x4, 0x38000000000, 0x7, 0x6}, {0x80, 0x7f, 0x2, 0xfa47}]}}}, {0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x10, 0x4, 'broadcast\x00'}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x7}}}]}}]}, 0x158}, 0x1, 0x0, 0x0, 0x4}, 0x4000) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getdents64(r5, &(0x7f0000000100)=""/111, 0x18) getdents(r5, &(0x7f0000000380)=""/246, 0xffffffff00000018) [ 716.948506] binder_alloc: binder_alloc_mmap_handler: 25143 20001000-20004000 already mapped failed -16 [ 716.991794] binder: BINDER_SET_CONTEXT_MGR already set 10:18:40 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x2, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:40 executing program 0: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) socket$inet6(0xa, 0x800, 0x4) [ 717.018371] binder: 25143:25144 ioctl 40046207 0 returned -16 10:18:40 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4090ae82, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:18:40 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x400000000000000, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:40 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x20170000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 717.197305] binder_alloc: binder_alloc_mmap_handler: 25173 20001000-20004000 already mapped failed -16 [ 717.228867] binder: BINDER_SET_CONTEXT_MGR already set 10:18:40 executing program 0: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000000)) [ 717.269296] binder: 25173:25176 ioctl 40046207 0 returned -16 10:18:40 executing program 5: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x200000, 0x0) ioctl$DRM_IOCTL_IRQ_BUSID(r0, 0xc0106403, &(0x7f00000000c0)={0x2, 0xcd2, 0x2, 0x1f}) semop(0x0, &(0x7f0000000080), 0x13) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCLINUX6(r1, 0x541c, &(0x7f00000001c0)={0x6, 0x8001}) read(r1, &(0x7f0000000040)=""/11, 0xffffff3a) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000100)) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000140), &(0x7f0000000180)=0x8) socket$inet_udp(0x2, 0x2, 0x0) ioctl$TIOCGETD(r1, 0x545d, &(0x7f0000000000)) 10:18:40 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xe312, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:40 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x180000, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:40 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0xc008ae91, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:18:40 executing program 0: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) socketpair(0x0, 0x80001, 0x6, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f0000000040)) setsockopt$inet_sctp_SCTP_INITMSG(r0, 0x84, 0x2, &(0x7f0000000080)={0x81, 0x0, 0x2, 0x12}, 0x8) 10:18:40 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getdents64(r0, &(0x7f0000000100)=""/111, 0x2ce) getdents(r0, &(0x7f0000000380)=""/246, 0xffffffff00000018) 10:18:41 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xb9, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:41 executing program 0: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x20000, 0x0) setsockopt$inet_sctp6_SCTP_RECVNXTINFO(r0, 0x84, 0x21, &(0x7f0000000280)=0x1, 0x4) r1 = dup(0xffffffffffffff9c) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000000)={{{@in=@broadcast, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in=@multicast2}}, &(0x7f0000000100)=0xe8) setsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000140)={{{@in=@multicast1, @in6=@remote, 0x4e23, 0x9, 0x4e24, 0x0, 0x2, 0x80, 0x80, 0xc, 0x0, r2}, {0x4, 0x7, 0xc6ba, 0x7, 0x100, 0x0, 0x5, 0x1}, {0x8, 0x4, 0x7, 0x1}, 0x8, 0x9, 0x0, 0x0, 0x0, 0x3}, {{@in=@local, 0x4d3, 0x6c}, 0xa, @in6=@local, 0x34ff, 0x3, 0x3, 0x0, 0x3, 0x6, 0x4}}, 0xe8) [ 717.882059] binder_alloc: binder_alloc_mmap_handler: 25206 20001000-20004000 already mapped failed -16 10:18:41 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4008ae93, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 717.931523] binder: BINDER_SET_CONTEXT_MGR already set [ 717.950765] binder: 25206:25207 ioctl 40046207 0 returned -16 10:18:41 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x6248, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:41 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x300000000000000, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:41 executing program 0: r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhci\x00', 0x1, 0x0) ioctl$BLKIOMIN(r0, 0x1278, &(0x7f0000000300)) bind$nfc_llcp(r0, &(0x7f0000000080)={0x27, 0x0, 0x2, 0x5, 0x1e, 0x9, "ffdeab3c6faf32728363745dd71711633bd204d594abf393abc17160157d2113357251c382928e74021ee5ec6ab436750d9175ff7ae33bfb038aecec6f3bac", 0x2e}, 0x60) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000000)=0x0) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000140)='IPVS\x00') sendmsg$IPVS_CMD_GET_DEST(r0, &(0x7f0000000240)={&(0x7f0000000100), 0xc, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB='h\x00\x00\t', @ANYRES16=r2, @ANYBLOB="090229bd7000fbdbdf250800000008000600010400004c00030008000500ac1414bb08000800f900000008000300010000000800040000000000080007004e20000008000400ff000000080007004e220000080007004e2200000800010003000000"], 0x68}, 0x1, 0x0, 0x0, 0x20000000}, 0x4040091) ioctl$TUNSETGROUP(r0, 0x400454ce, r1) ioctl$EVIOCGUNIQ(r0, 0x80404508, &(0x7f0000000280)=""/111) [ 718.130335] binder_alloc: binder_alloc_mmap_handler: 25234 20001000-20004000 already mapped failed -16 [ 718.161385] binder: BINDER_SET_CONTEXT_MGR already set [ 718.175491] binder: 25234:25238 ioctl 40046207 0 returned -16 10:18:41 executing program 5: semop(0x0, &(0x7f0000000080)=[{0x3, 0x8001, 0x1800}, {0x5, 0x1, 0x1000}, {0x4, 0x5, 0x800}], 0x3) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000040)=""/11, 0xffffff3a) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000140), &(0x7f0000000180)=0x8) ioctl$TIOCGETD(r0, 0x545d, &(0x7f0000000000)) 10:18:41 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xffffffff00000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:41 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4008ae9c, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:18:41 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x6800000000000000, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:41 executing program 0: mprotect(&(0x7f00002e7000/0x2000)=nil, 0x2000, 0x0) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) socket$pptp(0x18, 0x1, 0x2) 10:18:41 executing program 4: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getdents64(r0, &(0x7f0000000100)=""/111, 0x18) getdents(r0, &(0x7f0000000380)=""/246, 0xffffffff00000018) ioctl$TIOCSSOFTCAR(r0, 0x541a, &(0x7f0000000040)) 10:18:42 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xb022, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:42 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x7a000000, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) [ 718.790302] binder_alloc: binder_alloc_mmap_handler: 25257 20001000-20004000 already mapped failed -16 [ 718.805141] binder: BINDER_SET_CONTEXT_MGR already set [ 718.812344] binder: 25257:25258 ioctl 40046207 0 returned -16 10:18:42 executing program 0: socketpair(0xba441997d1db1a4a, 0x1, 0xb503, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) connect$inet(r0, &(0x7f0000000040)={0x2, 0x4e21, @multicast1}, 0x10) ioctl$VT_ACTIVATE(r1, 0x5606, 0x4) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) [ 718.932884] binder_alloc: binder_alloc_mmap_handler: 25276 20001000-20004000 already mapped failed -16 [ 718.970895] binder: BINDER_SET_CONTEXT_MGR already set 10:18:42 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x6f63, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:42 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0xc0045878, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 718.986510] binder: 25276:25277 ioctl 40046207 0 returned -16 10:18:42 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x6000000, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) [ 719.160982] binder_alloc: binder_alloc_mmap_handler: 25291 20001000-20004000 already mapped failed -16 [ 719.208379] binder: BINDER_SET_CONTEXT_MGR already set [ 719.224453] binder: 25291:25293 ioctl 40046207 0 returned -16 10:18:42 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xe8030000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:42 executing program 0: r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x10100, 0x0) ioctl$KVM_GET_NR_MMU_PAGES(r0, 0xae45, 0x2) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xfffffffffffffffc) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) 10:18:42 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4188aea7, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:18:42 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x7a, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:42 executing program 4: syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x8000) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getdents64(r0, &(0x7f0000000100)=""/111, 0x18) getdents(r0, &(0x7f0000000380)=""/246, 0xffffffff00000018) 10:18:42 executing program 5: semop(0x0, &(0x7f0000000080), 0x13) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000040)=""/11, 0xffffff3a) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) getresuid(&(0x7f0000000080), &(0x7f00000000c0), &(0x7f00000001c0)) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000140), &(0x7f0000000180)=0x8) ioctl$TIOCGETD(r0, 0x545d, &(0x7f0000000000)) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000280)='/dev/ppp\x00', 0x500, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000300)={0xffffffffffffffff}, 0x2, 0x100f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r1, &(0x7f0000000380)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f00000002c0), r2, 0x0, 0x2, 0x4}}, 0x20) rt_sigpending(&(0x7f0000000240), 0x8) 10:18:42 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x73d7, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 719.697803] binder_alloc: binder_alloc_mmap_handler: 25316 20001000-20004000 already mapped failed -16 10:18:42 executing program 0: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80000, 0x0) ioctl$KVM_GET_SUPPORTED_CPUID(r0, 0xc008ae05, &(0x7f0000000040)=""/15) [ 719.777106] binder: BINDER_SET_CONTEXT_MGR already set 10:18:43 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0xaea2, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 719.812059] binder: 25316:25317 ioctl 40046207 0 returned -16 10:18:43 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xa36b, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:43 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0xfffffdfd, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:43 executing program 0: mprotect(&(0x7f0000394000/0x1000)=nil, 0x1000, 0x41000005) getresgid(&(0x7f0000000b80), &(0x7f0000000000), &(0x7f0000000040)) [ 719.972083] IPVS: ftp: loaded support on port[0] = 21 [ 719.991517] binder_alloc: binder_alloc_mmap_handler: 25342 20001000-20004000 already mapped failed -16 [ 720.011269] binder: BINDER_SET_CONTEXT_MGR already set 10:18:43 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x40049409, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 720.020436] binder: 25342:25343 ioctl 40046207 0 returned -16 10:18:43 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x95af, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:43 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x3f00000000000000, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) [ 720.096865] device bridge_slave_1 left promiscuous mode [ 720.102579] bridge0: port 2(bridge_slave_1) entered disabled state 10:18:43 executing program 0: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) getresgid(&(0x7f00000000c0), &(0x7f0000000080), &(0x7f0000000c00)) [ 720.177430] device bridge_slave_0 left promiscuous mode [ 720.186588] bridge0: port 1(bridge_slave_0) entered disabled state [ 720.313326] team0 (unregistering): Port device team_slave_1 removed [ 720.328252] team0 (unregistering): Port device team_slave_0 removed [ 720.342291] bond0 (unregistering): Releasing backup interface bond_slave_1 10:18:43 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) setsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r0, 0x84, 0x12, &(0x7f0000000040)=0x8000, 0x4) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getdents64(r1, &(0x7f0000000100)=""/111, 0x18) getdents(r1, &(0x7f0000000380)=""/246, 0xffffffff00000018) [ 720.382524] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 720.471436] bond0 (unregistering): Released all slaves [ 720.550452] binder: BINDER_SET_CONTEXT_MGR already set [ 720.566543] binder: 25359:25360 ioctl 40046207 0 returned -16 [ 721.392708] bridge0: port 1(bridge_slave_0) entered blocking state [ 721.399284] bridge0: port 1(bridge_slave_0) entered disabled state [ 721.406864] device bridge_slave_0 entered promiscuous mode [ 721.452146] bridge0: port 2(bridge_slave_1) entered blocking state [ 721.458727] bridge0: port 2(bridge_slave_1) entered disabled state [ 721.466574] device bridge_slave_1 entered promiscuous mode [ 721.511101] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 721.557728] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 721.691498] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 721.738635] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 721.919837] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 721.928059] team0: Port device team_slave_0 added [ 721.972190] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 721.979884] team0: Port device team_slave_1 added [ 722.025840] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 722.053866] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 722.081368] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 722.088540] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 722.096970] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 722.125104] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 722.132723] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 722.142837] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 722.417238] bridge0: port 2(bridge_slave_1) entered blocking state [ 722.423606] bridge0: port 2(bridge_slave_1) entered forwarding state [ 722.430299] bridge0: port 1(bridge_slave_0) entered blocking state [ 722.436696] bridge0: port 1(bridge_slave_0) entered forwarding state [ 722.444329] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 722.576101] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 723.356120] 8021q: adding VLAN 0 to HW filter on device bond0 [ 723.444330] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 723.539089] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 723.545230] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 723.552505] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 723.644250] 8021q: adding VLAN 0 to HW filter on device team0 10:18:48 executing program 5: semop(0x0, &(0x7f0000000080), 0x13) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000040)=""/11, 0xffffff3a) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000001c0)) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/mixer\x00', 0x2000, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r1, 0xc0a85320, &(0x7f0000000240)={{0x1, 0x4}, 'port1\x00', 0x60, 0x100000, 0x1, 0x5, 0x80000001, 0x7, 0x1, 0x0, 0x2, 0x4}) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000140), &(0x7f0000000180)=0x8) ioctl$TIOCGETD(r0, 0x545d, &(0x7f0000000000)) 10:18:48 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x63d3, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:48 executing program 0: mprotect(&(0x7f00003a5000/0xa000)=nil, 0xa000, 0xfffffffefffffffc) r0 = socket$nl_crypto(0x10, 0x3, 0x15) setsockopt$netlink_NETLINK_PKTINFO(r0, 0x10e, 0x3, &(0x7f0000000000), 0x4) 10:18:48 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4004ae86, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:18:48 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x2000000000000000, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:48 executing program 4: pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$VT_OPENQRY(r0, 0x5600, &(0x7f0000000080)) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getdents64(r1, &(0x7f0000000100)=""/111, 0x18) getdents(r1, &(0x7f0000000380)=""/246, 0xffffffff00000018) 10:18:48 executing program 0: r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x505400, 0x0) ioctl$TUNGETFEATURES(r0, 0x800454cf, &(0x7f0000000200)) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) getresgid(&(0x7f0000000b80)=0x0, &(0x7f0000000bc0), &(0x7f0000000c00)) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x4000, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0}, &(0x7f0000000100)=0xc) write$FUSE_ENTRY(r2, &(0x7f0000000140)={0x90, 0x0, 0x1, {0x2, 0x2, 0x7fff, 0x80000001, 0xd7, 0x10000, {0x3, 0x5, 0xffffffffffff5570, 0x8000, 0x1, 0x1, 0x7, 0x7ff, 0x8, 0x80, 0x7, r3, r1, 0x6d, 0x5}}}, 0x90) ioctl$UI_SET_PHYS(0xffffffffffffffff, 0x4008556c, &(0x7f0000000040)='syz1\x00') [ 725.099114] binder_alloc_mmap_handler: 1 callbacks suppressed [ 725.099140] binder_alloc: binder_alloc_mmap_handler: 25642 20001000-20004000 already mapped failed -16 10:18:48 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x70ad0000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:48 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4080aebf, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 725.174983] binder: BINDER_SET_CONTEXT_MGR already set [ 725.195616] binder: 25642:25651 ioctl 40046207 0 returned -16 10:18:48 executing program 0: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) r0 = socket(0x2, 0x1, 0x7a2) mmap$xdp(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x20012, r0, 0x0) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) 10:18:48 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x4000000, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:48 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x4b8c0000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 725.375495] binder_alloc: binder_alloc_mmap_handler: 25677 20001000-20004000 already mapped failed -16 [ 725.386262] binder: BINDER_SET_CONTEXT_MGR already set [ 725.403298] binder: 25677:25678 ioctl 40046207 0 returned -16 10:18:49 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4008ae89, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:18:49 executing program 0: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) getresgid(&(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000c00)) 10:18:49 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xd0f2, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:49 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x74000000, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:49 executing program 5: semop(0x0, &(0x7f0000000080), 0x13) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000040)=""/11, 0xffffff3a) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000140), &(0x7f0000000180)=0x8) setxattr$trusted_overlay_nlink(&(0x7f0000000380)='./file0\x00', &(0x7f00000003c0)='trusted.overlay.nlink\x00', &(0x7f0000000400)={'U-', 0x6a6}, 0x28, 0x2) ioctl$FICLONERANGE(r0, 0x4020940d, &(0x7f0000000080)={r0, 0x0, 0x81000000, 0xfba, 0x100000001}) r1 = openat$full(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/full\x00', 0x200000, 0x0) fsetxattr$trusted_overlay_upper(r0, &(0x7f0000000000)='trusted.overlay.upper\x00', &(0x7f0000000440)={0x0, 0xfb, 0x56, 0x1, 0x0, "c6e786daf25ab1ae0102a327239c2192", "f373316ad34ba1f19089e806bd0c146c88e7735eaa537bae4a71e2db88c70e642ac281d2314297523658480abd3611bc1011dcd22bb15a46814799d35fcb1f4d9f"}, 0x56, 0x3) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in6=@ipv4={[], [], @local}, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}, &(0x7f0000000340)=0xe8) r3 = getegid() fchownat(r1, &(0x7f00000001c0)='./file0\x00', r2, r3, 0x1900) 10:18:49 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) getdents(r0, &(0x7f0000000180)=""/200, 0xc8) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getdents64(r1, &(0x7f0000000100)=""/111, 0x18) lookup_dcookie(0x4100000000, &(0x7f0000005480)=""/4096, 0xffffffffffffff10) ioctl$DRM_IOCTL_MODE_SETCRTC(r0, 0xc06864a2, &(0x7f0000000080)={&(0x7f0000000040)=[0x0], 0x1, 0x4, 0xfff, 0x8001, 0x76be, 0x9, {0x0, 0x5, 0x8000, 0x0, 0x4, 0x5, 0x6, 0x5, 0xf6e, 0x101, 0x0, 0x5, 0x7, 0x80, "caffafc3ea0e76833bc38bf55bdf5579f4a60d6f89673f1765a62072c5a47523"}}) getdents(r1, &(0x7f0000000380)=""/246, 0xffffffff00000018) 10:18:49 executing program 0: [ 726.023306] binder_alloc: binder_alloc_mmap_handler: 25697 20001000-20004000 already mapped failed -16 [ 726.083449] binder: BINDER_SET_CONTEXT_MGR already set 10:18:49 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x8c4b, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 726.106411] binder: 25697:25705 ioctl 40046207 0 returned -16 10:18:49 executing program 0: openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) perf_event_open(&(0x7f0000c86f88)={0x2, 0x70, 0x910, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000001c0)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) semctl$SEM_STAT(0x0, 0x0, 0x12, &(0x7f0000000000)=""/57) 10:18:49 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x2000, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:49 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0xc018ae85, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:18:49 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x8386000000000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 726.227172] binder_alloc: binder_alloc_mmap_handler: 25723 20001000-20004000 already mapped failed -16 [ 726.242245] binder: BINDER_SET_CONTEXT_MGR already set [ 726.258943] binder: 25723:25725 ioctl 40046207 0 returned -16 10:18:49 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x700, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:49 executing program 0: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0x8, &(0x7f0000000000)=0xeb0, 0x4) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000040)=0x3d, 0x4) sendto$inet6(r0, &(0x7f00000002c0)="020300000700000000000000fff55b4202938207d9fb3780", 0x18, 0xfffffffffffffffe, &(0x7f0000000080)={0xa, 0x0, 0x20000000005, @remote}, 0x1c) r1 = socket$inet6(0xa, 0x803, 0x3) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0a5c2d023c126285718070") readv(r0, &(0x7f0000000840)=[{&(0x7f0000000340)=""/112, 0x70}], 0x1) 10:18:49 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0xc020660b, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 726.385591] kworker/dying (23) used greatest stack depth: 12920 bytes left 10:18:49 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x8890000000000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 726.459650] binder_alloc: binder_alloc_mmap_handler: 25740 20001000-20004000 already mapped failed -16 [ 726.513525] binder: BINDER_SET_CONTEXT_MGR already set [ 726.541299] binder: 25740:25744 ioctl 40046207 0 returned -16 10:18:50 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xee93, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:50 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x5452, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:18:50 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0xa00, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:50 executing program 5: semop(0x0, &(0x7f0000000080), 0x13) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000040)=""/11, 0xffffff3a) socketpair(0x11, 0x80f, 0x6, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$RTC_SET_TIME(r1, 0x4024700a, &(0x7f00000000c0)={0x3b, 0xc, 0xd, 0xc, 0x8, 0x3, 0x4, 0xcf}) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000140), &(0x7f0000000180)=0x8) ioctl$TIOCGETD(r0, 0x545d, &(0x7f0000000000)) 10:18:50 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getdents64(r0, &(0x7f0000000100)=""/111, 0x18) ioctl$TIOCPKT(r0, 0x5420, &(0x7f0000000040)) getdents(r0, &(0x7f0000000380)=""/246, 0xffffffff00000018) [ 726.988938] binder_alloc: binder_alloc_mmap_handler: 25768 20001000-20004000 already mapped failed -16 [ 727.027279] binder: BINDER_SET_CONTEXT_MGR already set 10:18:50 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x23fa000000000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 727.045154] binder: 25768:25769 ioctl 40046207 0 returned -16 10:18:50 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0xc028ae92, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:18:50 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x74, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:50 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x5b3b0000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 727.211808] binder_alloc: binder_alloc_mmap_handler: 25791 20001000-20004000 already mapped failed -16 10:18:50 executing program 0: r0 = syz_open_dev$dspn(&(0x7f0000000140)='/dev/dsp#\x00', 0x1, 0x2) write$FUSE_POLL(r0, &(0x7f0000000040)={0x18}, 0x18) ioctl$int_in(r0, 0x820000c0045006, &(0x7f0000000100)=0x2) 10:18:50 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x9000aea4, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:18:50 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x60fe, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 727.326053] binder: BINDER_SET_CONTEXT_MGR already set [ 727.335854] binder: 25791:25792 ioctl 40046207 0 returned -16 10:18:50 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x7, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:50 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x2, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffff9c, 0x0, 0x28, &(0x7f0000000180)="656d315d5b3afe7070703124966e6f6465762f706f7369785f61636c5f6163636573732b5e262f00", 0xffffffffffffffff}, 0x30) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) write$binfmt_elf32(r0, &(0x7f0000000000)=ANY=[], 0xfffffe0e) r1 = syz_open_pts(r0, 0x0) ioctl$VHOST_GET_VRING_ENDIAN(0xffffffffffffffff, 0x4008af14, &(0x7f0000000240)) ioctl$TCSETSF(r1, 0x5412, &(0x7f0000000040)={0x17}) sched_getparam(0x0, &(0x7f00000000c0)) 10:18:50 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x6dd8, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 727.530161] binder: 25819:25820 unknown command 1224736768 [ 727.565577] binder: 25819:25820 ioctl c0306201 20000440 returned -22 [ 727.591149] binder_alloc: binder_alloc_mmap_handler: 25819 20001000-20004000 already mapped failed -16 [ 727.628982] binder: BINDER_SET_CONTEXT_MGR already set [ 727.647613] binder: 25819:25829 unknown command 1224736768 [ 727.681982] binder: 25819:25825 ioctl 40046207 0 returned -16 [ 727.720852] binder: 25819:25829 ioctl c0306201 20000440 returned -22 10:18:51 executing program 5: semop(0x0, &(0x7f0000000080), 0x13) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000040)=""/11, 0xffffff3a) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000140)={0x0}, &(0x7f0000000180)=0x8) r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/mixer\x00', 0x800, 0x0) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r2, 0x84, 0x77, &(0x7f00000000c0)={r1, 0xe68, 0x1, [0x0]}, 0xa) ioctl$TIOCGETD(r0, 0x545d, &(0x7f0000000000)) 10:18:51 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x3f00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:18:51 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xa8a7000000000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:51 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000040)={0x1000, 0x9, 0xffffffff80000001, 0x8, 0xcdb2, 0x4, 0x7, 0xfffffffffffffc00, 0x3, 0x6}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp_SCTP_ADAPTATION_LAYER(r0, 0x84, 0x7, &(0x7f0000000180)={0x80000000}, 0x4) getdents64(r1, &(0x7f0000000100)=""/111, 0x18) ioctl$RNDGETENTCNT(r0, 0x80045200, &(0x7f0000000080)) getdents(r1, &(0x7f0000000380)=""/246, 0xffffffff00000018) ioctl$SIOCSIFHWADDR(r0, 0x8924, &(0x7f00000000c0)={'veth1_to_bridge\x00', @link_local}) 10:18:51 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0xffffff7f00000000, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) [ 727.957339] binder_alloc: binder_alloc_mmap_handler: 25842 20001000-20004000 already mapped failed -16 10:18:51 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x98f8000000000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:51 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x80ffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 728.050991] binder: BINDER_SET_CONTEXT_MGR already set [ 728.069377] binder: 25842:25845 ioctl 40046207 0 returned -16 10:18:51 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x20000000, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:51 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x700, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:51 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x3f000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 728.271936] binder_alloc: binder_alloc_mmap_handler: 25869 20001000-20004000 already mapped failed -16 [ 728.308127] binder: BINDER_SET_CONTEXT_MGR already set [ 728.325711] binder: 25869:25870 ioctl 40046207 0 returned -16 10:18:51 executing program 0: r0 = socket$key(0xf, 0x3, 0x2) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0xfa) sendmsg$key(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)={0x2, 0xa, 0x0, 0x0, 0x2}, 0x10}}, 0x0) 10:18:51 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xc053, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:52 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x3f00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:18:52 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0xa00000000000000, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:52 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xdb97000000000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:52 executing program 0: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x4b8c0000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:52 executing program 5: semop(0x0, &(0x7f0000000080), 0x13) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000040)=""/11, 0xffffff3a) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = creat(&(0x7f0000000080)='./file0\x00', 0x31) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r1, 0xc4c85513, &(0x7f0000000240)={{0x8, 0x0, 0x400, 0x401, 'syz1\x00', 0x3}, 0x1, [0x80000000000000, 0xffff, 0x8, 0x9, 0x6ad, 0x4, 0x8, 0x2b, 0x1, 0x8, 0x6, 0x0, 0x1, 0x81f5, 0x9, 0x93a, 0x6, 0x5, 0x7, 0x28, 0xffff, 0x7, 0x32b, 0x7, 0xfff, 0xffff, 0xaa, 0x5, 0x3, 0x6, 0x0, 0x2, 0x9, 0x7fffffff, 0x3, 0x22b, 0x5, 0x10e2a0000000, 0x6, 0x9, 0x9, 0x7fffffff, 0x4, 0x7, 0x6, 0x92a, 0x0, 0x7f, 0x7f, 0x2, 0x2, 0xffff, 0x101, 0x200, 0x100000000, 0x101, 0x8af7, 0x5bba, 0x4, 0x5, 0x80000001, 0x2, 0x7, 0x7ff, 0x0, 0xffff, 0xffffffff80000000, 0x2, 0x10000, 0x8, 0x80, 0x7, 0x8, 0x3, 0x3, 0x114000000000000, 0x4, 0x1ff, 0x23e, 0x8, 0xa5, 0x9, 0x7, 0x3ff, 0x87, 0x5, 0x1, 0x80000000, 0x5, 0x3f, 0x2, 0x8001, 0x2, 0x3, 0x66a, 0x8, 0x672c, 0x0, 0xfffffffffffffe01, 0x4, 0x100000000, 0x2, 0x5, 0x9, 0x1, 0x0, 0x5f, 0x4, 0x9f, 0x5, 0x0, 0x7, 0xfffffffffffffffd, 0x1ff, 0x2, 0x1f, 0x6, 0x4, 0x0, 0x2, 0x80000000, 0x5, 0x94, 0xcc, 0xfffffffffffff8d3, 0x20, 0x20, 0x40]}) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000140), &(0x7f0000000180)=0x8) ioctl$TIOCGETD(r0, 0x545d, &(0x7f0000000000)) 10:18:52 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getdents64(r1, &(0x7f0000000100)=""/111, 0x18) getdents(r1, &(0x7f0000000380)=""/246, 0xffffffff00000018) ioctl$SCSI_IOCTL_STOP_UNIT(r0, 0x6) [ 728.935102] binder: BINDER_SET_CONTEXT_MGR already set 10:18:52 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) 10:18:52 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xab180000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 728.978338] binder: 25903:25910 ioctl 40046207 0 returned -16 10:18:52 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:18:52 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x200000000000000, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) [ 729.110413] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 729.199925] binder: BINDER_SET_CONTEXT_MGR already set 10:18:52 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xba8b, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:52 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) 10:18:52 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 729.223152] binder: 25932:25934 ioctl 40046207 0 returned -16 10:18:52 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x100000000000000, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) [ 729.307349] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. 10:18:52 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x731e000000000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:52 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) getresgid(&(0x7f0000000b80), &(0x7f0000000bc0), &(0x7f0000000c00)) [ 729.458045] binder: BINDER_SET_CONTEXT_MGR already set [ 729.472761] binder: 25948:25955 ioctl 40046207 0 returned -16 [ 729.607443] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. 10:18:53 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x3f00, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:53 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0xffff8000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:18:53 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f00000000c0)=0xc0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getdents64(r1, &(0x7f0000000040)=""/111, 0xfffffffffffffe09) getdents(r0, &(0x7f0000000480)=""/4096, 0x1000) getdents(r1, &(0x7f0000000380)=""/246, 0xffffffff00000018) 10:18:53 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x2b75, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:53 executing program 5: semop(0x0, &(0x7f0000000080), 0x13) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000040)=""/11, 0xffffff3a) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x100000000, 0x400000) ioctl$KVM_GET_CPUID2(r1, 0xc008ae91, &(0x7f0000000080)=ANY=[@ANYBLOB="0000000000879200"]) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000140), &(0x7f0000000180)=0x8) ioctl$TIOCGETD(r0, 0x545d, &(0x7f00000000c0)) 10:18:53 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) [ 729.898451] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 729.922987] binder: BINDER_SET_CONTEXT_MGR already set 10:18:53 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x6045000000000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 729.948316] binder: 25973:25978 ioctl 40046207 0 returned -16 10:18:53 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0363084000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:53 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) 10:18:53 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0xfffffdfd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:18:53 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xeb460000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 730.121941] binder: 25999:26001 BC_FREE_BUFFER u0249000000000000 no match [ 730.149581] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 730.170469] binder: 25999:26001 unknown command 6880847 [ 730.190173] binder: 25999:26001 ioctl c0306201 20000440 returned -22 10:18:53 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x7000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 730.222430] binder_alloc_mmap_handler: 4 callbacks suppressed [ 730.222447] binder_alloc: binder_alloc_mmap_handler: 25999 20001000-20004000 already mapped failed -16 10:18:53 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) 10:18:53 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 730.282791] binder: BINDER_SET_CONTEXT_MGR already set [ 730.296443] binder: 25999:26001 ioctl 40046207 0 returned -16 [ 730.302590] binder: 25999:26013 BC_FREE_BUFFER u0249000000000000 no match [ 730.310008] binder: 25999:26013 unknown command 6880847 [ 730.316605] binder: 25999:26013 ioctl c0306201 20000440 returned -22 [ 730.416410] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. 10:18:53 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0011000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x82, 0x0) mmap(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x0, 0x8031, r1, 0x2) getdents64(r0, &(0x7f0000000100)=""/111, 0x18) getdents(r0, &(0x7f0000000380)=""/246, 0xffffffff00000018) 10:18:53 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0e630c4000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) [ 730.694868] binder: 26031:26033 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 730.702383] binder: 26031:26033 unknown command 0 [ 730.707588] binder: 26031:26033 ioctl c0306201 20000440 returned -22 [ 730.718016] binder_alloc: binder_alloc_mmap_handler: 26031 20001000-20004000 already mapped failed -16 [ 730.728437] binder: 26031:26036 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 730.728462] binder: BINDER_SET_CONTEXT_MGR already set [ 730.735856] binder: 26031:26036 unknown command 0 [ 730.746560] binder: 26031:26033 ioctl 40046207 0 returned -16 [ 730.758098] binder: 26031:26036 ioctl c0306201 20000440 returned -22 10:18:53 executing program 5: semop(0x0, &(0x7f0000000080), 0x13) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000040)=""/11, 0xffffff3a) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000140), &(0x7f0000000180)=0x8) ioctl$TIOCGETD(r0, 0x545d, &(0x7f0000000000)) r1 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vhci\x00', 0x501401, 0x0) write$FUSE_INIT(r1, &(0x7f0000000240)={0x50, 0xfffffffffffffffe, 0x6, {0x7, 0x1b, 0x69a, 0x100000, 0x63d, 0x81, 0x101, 0x3}}, 0x50) 10:18:53 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x6879, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:53 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) 10:18:53 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x80ffff00000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:18:53 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000280)="732f00ef0eb12908e4a29900000000000000072f7378706972655f6e6f6465f374d6d8edc8d4c6e6fdf026eca44ec3c11a5b681ea7390c1aa826282182f195e1de353d1c72c270712006dabfd8c1b5820e7f4355ed98776f883cac007194162fb548279123ae6e9e5d213eabc3a260634a11d1353ad80178c854d1a0fb67f6000000000000000000000000000000", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000000040)={0x0, 0x2, 0x10, 0x1, 0x5, 0x400}, &(0x7f0000000080)=0x14) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000180)={r2, @in6={{0xa, 0x4e24, 0x6, @mcast1, 0x7}}}, &(0x7f00000000c0)=0x84) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) ioctl$KVM_INTERRUPT(r0, 0x4004ae86, &(0x7f0000000240)=0xffffffff) getdents64(r1, &(0x7f0000000100)=""/111, 0x18) getdents(r1, &(0x7f0000000380)=""/246, 0xffffffff00000018) 10:18:53 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="6c63404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) [ 730.864607] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 730.903875] binder: 26046:26050 unknown command 1077961580 10:18:54 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x2878, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:54 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) [ 730.925706] binder: 26046:26050 ioctl c0306201 20000440 returned -22 [ 730.957986] binder_alloc: binder_alloc_mmap_handler: 26046 20001000-20004000 already mapped failed -16 10:18:54 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0xfdfdffff00000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 731.021236] binder: BINDER_SET_CONTEXT_MGR already set [ 731.021272] binder: 26046:26059 unknown command 1077961580 [ 731.039102] binder: 26046:26050 ioctl 40046207 0 returned -16 [ 731.081682] binder: 26046:26059 ioctl c0306201 20000440 returned -22 [ 731.085125] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. 10:18:54 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="003e404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:54 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x9335000000000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:54 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) [ 731.248295] binder: 26078:26082 unknown command 1077952000 [ 731.258808] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 731.275521] binder: 26078:26082 ioctl c0306201 20000440 returned -22 [ 731.289306] binder_alloc: binder_alloc_mmap_handler: 26078 20001000-20004000 already mapped failed -16 [ 731.339964] binder: 26078:26086 unknown command 1077952000 [ 731.345934] binder: BINDER_SET_CONTEXT_MGR already set [ 731.355701] binder: 26078:26082 ioctl 40046207 0 returned -16 [ 731.360463] binder: 26078:26086 ioctl c0306201 20000440 returned -22 10:18:54 executing program 5: semop(0x0, &(0x7f0000000080), 0x13) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000040)=""/11, 0xffffff3a) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) ioctl$TIOCGPTPEER(r0, 0x5441, 0xfff) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) ioctl$KDGKBMODE(r0, 0x4b44, &(0x7f0000000080)) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000140), &(0x7f0000000180)=0x8) ioctl$TIOCGETD(r0, 0x545d, &(0x7f0000000000)) 10:18:54 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0xfdfdffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:18:54 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x402e0000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:54 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) 10:18:54 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0023404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:54 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getdents64(r0, &(0x7f0000000300)=""/111, 0x9e) getdents(r0, &(0x7f0000000180)=""/246, 0xf6) [ 731.796738] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 731.809665] binder: 26097:26099 unknown command 1077945088 [ 731.829883] binder: 26097:26099 ioctl c0306201 20000440 returned -22 10:18:55 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xcb2f000000000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 731.862878] binder_alloc: binder_alloc_mmap_handler: 26097 20001000-20004000 already mapped failed -16 10:18:55 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x80ffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 731.919999] binder: BINDER_SET_CONTEXT_MGR already set [ 731.920698] binder: 26097:26111 unknown command 1077945088 [ 731.948660] binder: 26097:26099 ioctl 40046207 0 returned -16 [ 731.959403] binder: 26097:26111 ioctl c0306201 20000440 returned -22 10:18:55 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0025404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:55 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x9f01000000000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:55 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) [ 732.120094] binder: 26124:26128 unknown command 1077945600 [ 732.136218] binder: 26124:26128 ioctl c0306201 20000440 returned -22 10:18:55 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x3f000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 732.171399] binder_alloc: binder_alloc_mmap_handler: 26124 20001000-20004000 already mapped failed -16 [ 732.208579] binder: BINDER_SET_CONTEXT_MGR already set [ 732.233456] binder: 26124:26128 ioctl 40046207 0 returned -16 [ 732.252565] binder: 26124:26132 unknown command 1077945600 [ 732.275842] binder: 26124:26132 ioctl c0306201 20000440 returned -22 10:18:55 executing program 5: semop(0x0, &(0x7f0000000080), 0x13) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000040)=""/11, 0xffffff3a) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)) r1 = socket$kcm(0x29, 0x200000000000000, 0x0) close(r1) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='pids.events\x00', 0x0, 0x0) r3 = openat$cgroup_ro(r2, &(0x7f0000000400)='io.stat\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TUNGETSNDBUF(r2, 0x800454d3, &(0x7f0000000480)) bpf$OBJ_GET_MAP(0x7, &(0x7f00000002c0)={&(0x7f0000000280)='./file0\x00', 0x0, 0x8}, 0x10) close(r4) sendmsg(r3, &(0x7f0000000300)={&(0x7f0000000500)=@in6={0xa, 0x4e24, 0x6c1, @mcast2, 0x3}, 0x80, &(0x7f0000000240)=[{&(0x7f0000000700)="e2545afb73450a53eb11f9dd1edaa20aadb9ea9553d2b73f8ff7fd24c81825d9c9c84b4d7a1a8c37b5edff1e8ecd44c6c84e029ee2b074a05b15364c7222298bc114c6dfb389608ab539380e", 0x4c}], 0x1, &(0x7f0000000780), 0x0, 0xc044}, 0x1) r5 = socket$kcm(0x2, 0x8000000003, 0x2) ioctl$PERF_EVENT_IOC_PERIOD(r4, 0x8981, &(0x7f0000000040)) sendmsg(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000380)=@pptp={0x18, 0x2, {0x0, @multicast1}}, 0x80, &(0x7f0000000980), 0x0, &(0x7f0000000400), 0x0, 0x20000001}, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x24000, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000080)={"000000000000000000e9dc00", 0x200082}) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cpuacct.usage_sys\x00', 0x0, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r5, 0x89e0, &(0x7f0000000440)={r3, r7}) socketpair(0x1, 0x1, 0x0, &(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r8, 0x89f1, &(0x7f0000000080)='ip6tnl0\x00') bpf$MAP_CREATE(0x0, &(0x7f0000346fd4)={0x0, 0x0, 0x0, 0x8d4, 0x20}, 0x2c) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0xd, 0x2, &(0x7f0000346fc8)=ANY=[@ANYBLOB="187000b9acfa0b60952875c40067e3ba5b2aff"], &(0x7f0000000000)='GPL\x00', 0x0, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) close(r9) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'yam0\x00', 0x200}) bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x4, 0x4, 0x4, 0x4, 0x0, 0x1}, 0x2c) socketpair(0x1, 0x1, 0x0, &(0x7f00000006c0)) 10:18:55 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x23410000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:55 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0xffff8000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:18:55 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="000a404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:55 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) 10:18:55 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getdents64(r1, &(0x7f0000000100)=""/111, 0x18) faccessat(r0, &(0x7f0000000040)='./file0\x00', 0x8, 0x200) getdents(r1, &(0x7f0000000380)=""/246, 0xffffffff00000018) getsockopt$bt_BT_POWER(r0, 0x112, 0x9, &(0x7f0000000080)=0xfffffffffffffe00, &(0x7f00000000c0)=0x1) [ 732.698252] binder: 26154:26156 unknown command 1077938688 [ 732.703945] binder: 26154:26156 ioctl c0306201 20000440 returned -22 [ 732.773498] binder_alloc: binder_alloc_mmap_handler: 26154 20001000-20004000 already mapped failed -16 10:18:56 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x983f0000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 732.836584] binder: BINDER_SET_CONTEXT_MGR already set [ 732.859319] binder: 26154:26164 unknown command 1077938688 [ 732.884675] binder: 26154:26156 ioctl 40046207 0 returned -16 10:18:56 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x80ffff00000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 732.912266] binder: 26154:26164 ioctl c0306201 20000440 returned -22 10:18:56 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="000b404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:56 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x2017, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:56 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) [ 733.067924] binder: 26180:26184 unknown command 1077938944 [ 733.085433] binder: 26180:26184 ioctl c0306201 20000440 returned -22 [ 733.105044] binder_alloc: binder_alloc_mmap_handler: 26180 20001000-20004000 already mapped failed -16 [ 733.127733] binder: BINDER_SET_CONTEXT_MGR already set [ 733.142459] binder: 26180:26184 ioctl 40046207 0 returned -16 [ 733.153825] binder: 26180:26187 unknown command 1077938944 10:18:56 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 733.216968] binder: 26180:26187 ioctl c0306201 20000440 returned -22 10:18:57 executing program 5: semop(0x0, &(0x7f0000000080), 0x13) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000040)=""/11, 0xffffff3a) mlockall(0x7) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000140), &(0x7f0000000180)=0x8) ioctl$TIOCGETD(r0, 0x545d, &(0x7f0000000000)) 10:18:57 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) 10:18:57 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x753, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:57 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0043404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:57 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0xfdfdffff00000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:18:57 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/sys/net/ipv4/vs/nat_icmp_send\x00', 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x8000, 0x8000, 0x1, 0x20, r0, 0x7}, 0x2c) msync(&(0x7f00000e6000/0x2000)=nil, 0x2000, 0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x10, r1, 0x0) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000280)=0x0) sched_setscheduler(r2, 0x6, &(0x7f00000002c0)=0x6) getdents64(r0, &(0x7f0000000200)=""/111, 0xffffffffffffff8a) prctl$setmm(0x23, 0x4, &(0x7f0000464000/0x4000)=nil) setsockopt$IP_VS_SO_SET_EDITDEST(r0, 0x0, 0x489, &(0x7f0000000100)={{0x0, @local, 0x4e23, 0x2, 'fo\x00', 0xe, 0x2, 0x42}, {@remote, 0x4e21, 0x5, 0x4f, 0x1ff, 0x7f}}, 0x44) r3 = getpid() ioctl$sock_ifreq(r0, 0x8934, &(0x7f0000000300)={'gretap0\x00', @ifru_mtu=0x5}) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000080)={0x0, 0x0}, &(0x7f00000000c0)=0xc) r5 = getegid() setsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000001c0)={r3, r4, r5}, 0xc) getdents(r0, &(0x7f0000000380)=""/246, 0xf6) 10:18:57 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) 10:18:57 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) ioctl$LOOP_CLR_FD(r0, 0x4c01) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getdents64(r0, &(0x7f0000000100)=""/111, 0x6f) read$FUSE(r0, &(0x7f0000000480), 0x1000) getdents(r1, &(0x7f0000000380)=""/246, 0xffffffff00000018) ioctl$KVM_GET_DEVICE_ATTR(r0, 0x4018aee2, &(0x7f0000000080)={0x0, 0x3535, 0x10000, &(0x7f0000000040)=0x8}) [ 733.958803] binder: 26213:26217 unknown command 1077953280 [ 733.981337] binder: 26213:26217 ioctl c0306201 20000440 returned -22 10:18:57 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x2a03, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 734.037598] binder_alloc: binder_alloc_mmap_handler: 26213 20001000-20004000 already mapped failed -16 [ 734.076116] binder: BINDER_SET_CONTEXT_MGR already set 10:18:57 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 734.105407] binder: 26213:26217 ioctl 40046207 0 returned -16 [ 734.129670] binder: 26213:26227 unknown command 1077953280 10:18:57 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) 10:18:57 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x9088, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 734.155121] binder: 26213:26227 ioctl c0306201 20000440 returned -22 [ 734.257832] net_ratelimit: 5 callbacks suppressed [ 734.257843] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. 10:18:58 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xc490, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:58 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0006404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:58 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) 10:18:58 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:18:58 executing program 5: semop(0x0, &(0x7f0000000080), 0x13) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000040)=""/11, 0xffffff3a) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x80, 0x0) ioctl$DRM_IOCTL_SET_UNIQUE(r1, 0x40106410, &(0x7f00000000c0)={0xe2, &(0x7f0000000240)="bb97026e1c268fad1ce8784f26eb73d6f131eddcf7b7bdd4db6917b97b2b0c8f2c6b85d85298010afd9b3e26eea7a00c030cd64ed88a51f5272c46db832d9b0338b69479f7a79b5d239d9758377592efecfc52fc7af9ca1b26b4bb6536e78affa406cdd9d668e670b2be2356da9b505361fb6953da09ed6954c0a3774d5d94836b77d7a6b4f83fc483f21aaea17da715a58a036b87f70ffcd77115c7a9e6e8057dd2ac04a0eb5f012e3569e3441f74482f2e1ce4f78522b6ad43ef137170635a6eb6afbf314e18cc2d15f63baabc78508bc1e88246a9cfdb72f19921800b83b7221c"}) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000140), &(0x7f0000000180)=0x8) ioctl$TIOCGETD(r0, 0x545d, &(0x7f0000000080)) 10:18:58 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getdents64(r1, &(0x7f0000000100)=""/111, 0x18) getdents(r0, &(0x7f0000000280)=""/246, 0xfff6) 10:18:58 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xe0a10000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 734.891741] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 734.911790] binder: 26268:26274 unknown command 1077937664 [ 734.918774] binder: 26268:26274 ioctl c0306201 20000440 returned -22 [ 734.956839] binder_alloc: binder_alloc_mmap_handler: 26268 20001000-20004000 already mapped failed -16 [ 735.007383] binder: BINDER_SET_CONTEXT_MGR already set 10:18:58 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0xfffffdfd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:18:58 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) 10:18:58 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x98f80000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 735.032505] binder: 26268:26274 ioctl 40046207 0 returned -16 [ 735.035994] binder: 26268:26281 unknown command 1077937664 [ 735.086955] binder: 26268:26281 ioctl c0306201 20000440 returned -22 10:18:58 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="001a404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) [ 735.164831] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. 10:18:58 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) 10:18:58 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xe3cb000000000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:58 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0xfdfdffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 735.279706] binder: 26302:26303 unknown command 1077942784 [ 735.305542] binder: 26302:26303 ioctl c0306201 20000440 returned -22 [ 735.334877] binder_alloc: binder_alloc_mmap_handler: 26302 20001000-20004000 already mapped failed -16 [ 735.369001] binder: BINDER_SET_CONTEXT_MGR already set 10:18:58 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) 10:18:58 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x3b24, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 735.394234] binder: 26302:26313 unknown command 1077942784 [ 735.419735] binder: 26302:26311 ioctl 40046207 0 returned -16 [ 735.451898] binder: 26302:26313 ioctl c0306201 20000440 returned -22 10:18:58 executing program 5: semop(0x0, &(0x7f0000000080), 0x13) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x88000, 0x0) read(r0, &(0x7f0000000040)=""/11, 0xffffff3a) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) pipe(&(0x7f00000001c0)={0xffffffffffffffff}) r2 = syz_open_dev$adsp(&(0x7f0000000300)='/dev/adsp#\x00', 0x2, 0x0) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r2, 0x84, 0x7c, &(0x7f0000000140)={0x0, 0x80, 0x8ba}, &(0x7f0000000180)=0x8) setsockopt$inet_sctp6_SCTP_RTOINFO(r1, 0x84, 0x0, &(0x7f0000000200)={r3, 0x5, 0xe5f, 0x3}, 0x10) setsockopt$netlink_NETLINK_PKTINFO(r1, 0x10e, 0x3, &(0x7f0000000280)=0xbd6, 0x4) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000600)=ANY=[@ANYRES32=0x0, @ANYBLOB="8c000000e7b6cadd2ced9365b21231a4bdff68a676975e6efa81ad3c3ea933c46beafead46a907cdcb14d1bc7ece5bf376bb1c950484c1b6ebbcf6ed91adef5101cb61f4f5b3d7adc88120f7b751f7dac5b626ed2d1c2a1954a19b7774e7e0ccd5525c4a90f45a60ed4a3b392113c4410979ee93427bc0d214a9347af15d608c4aa9d7259b0ed3dc974943636636c2036df67e76692de1b3c35ce92800bea7fbca08e44a2287ed9bbb767b94b205c3caf3d2d4463e49a7cf0392d8a64d53ad13a419ec5c0d74f68839513f4a3107bc774b64b49e"], &(0x7f0000000480)=0x94) r5 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/sequencer2\x00', 0x44000, 0x0) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r5, 0x84, 0x18, &(0x7f00000004c0)={r4, 0x3f}, &(0x7f0000000380)=0x72) ioctl$TIOCGETD(r0, 0x545d, &(0x7f0000000000)) r7 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x1, 0x0) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r7, 0x84, 0x76, &(0x7f00000000c0)={r6, 0x8}, 0x8) 10:18:58 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:18:58 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) 10:18:58 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x6000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:58 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0012404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:58 executing program 4: r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/autofs\x00', 0x40, 0x0) ioctl$EVIOCGVERSION(r0, 0x80044501, &(0x7f0000000180)=""/241) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) getdents64(r1, &(0x7f0000000100)=""/111, 0x18) getdents(r1, &(0x7f0000000280)=""/246, 0xd9672f37b9de77ad) write$FUSE_STATFS(r0, &(0x7f0000000080)={0x60, 0x0, 0x5, {{0xa86, 0x0, 0x6, 0xfffffffffffffff9, 0x100, 0x7, 0x4, 0xffffffff7fffffff}}}, 0x60) 10:18:59 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) [ 735.868546] binder: 26336:26344 unknown command 1077940736 [ 735.895356] binder: 26336:26344 ioctl c0306201 20000440 returned -22 10:18:59 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000966000/0x4000)=nil, 0x4000, 0x4) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getdents64(r0, &(0x7f0000000100)=""/111, 0x18) getdents(r0, &(0x7f0000000380)=""/246, 0xffffffff00000018) 10:18:59 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x38b3, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 735.926670] binder_alloc: binder_alloc_mmap_handler: 26336 20001000-20004000 already mapped failed -16 [ 735.950545] binder: BINDER_SET_CONTEXT_MGR already set 10:18:59 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x3f00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 735.983148] binder: 26336:26344 ioctl 40046207 0 returned -16 [ 736.003029] binder: 26336:26350 unknown command 1077940736 [ 736.020451] binder: 26336:26350 ioctl c0306201 20000440 returned -22 10:18:59 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) 10:18:59 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="002d404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) [ 736.181817] binder: 26369:26373 unknown command 1077947648 [ 736.211177] binder: 26369:26373 ioctl c0306201 20000440 returned -22 [ 736.237688] binder_alloc: binder_alloc_mmap_handler: 26369 20001000-20004000 already mapped failed -16 [ 736.248812] binder: BINDER_SET_CONTEXT_MGR already set [ 736.254155] binder: 26369:26373 ioctl 40046207 0 returned -16 [ 736.285773] binder: 26369:26376 unknown command 1077947648 [ 736.304082] binder: 26369:26376 ioctl c0306201 20000440 returned -22 10:18:59 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) 10:18:59 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xffffff97, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:18:59 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x80ffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:18:59 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0032404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:18:59 executing program 5: semop(0x0, &(0x7f0000000080), 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000040)=""/11, 0xffffff3a) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000140), &(0x7f0000000180)=0x8) ioctl$TIOCGETD(r0, 0x545d, &(0x7f0000000000)) 10:18:59 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x2441c0, 0x0) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f00000000c0)=0x0) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f00000001c0)=0x0) kcmp(r2, r3, 0x6, r1, r1) getdents64(r1, &(0x7f0000000100)=""/111, 0x18) write$P9_RSYMLINK(r0, &(0x7f0000000040)={0x14, 0x11, 0x1, {0x5, 0x2, 0x3}}, 0x14) setsockopt$bt_BT_FLUSHABLE(r0, 0x112, 0x8, &(0x7f0000000080)=0x8, 0x4) getdents(r1, &(0x7f0000000380)=""/246, 0xffffffff00000018) [ 736.790467] binder: 26389:26396 unknown command 1077948928 [ 736.812824] binder: 26389:26396 ioctl c0306201 20000440 returned -22 [ 736.827269] binder_alloc: binder_alloc_mmap_handler: 26389 20001000-20004000 already mapped failed -16 10:19:00 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getdents64(r0, &(0x7f0000000100)=""/111, 0x18) pipe2(&(0x7f0000000040), 0x84800) getdents(r0, &(0x7f0000000380)=""/246, 0xffffffff00000018) 10:19:00 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x7f30, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 736.837442] binder: BINDER_SET_CONTEXT_MGR already set [ 736.843020] binder: 26389:26396 ioctl 40046207 0 returned -16 [ 736.870661] binder: 26389:26402 unknown command 1077948928 10:19:00 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) [ 736.893788] binder: 26389:26402 ioctl c0306201 20000440 returned -22 10:19:00 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0036404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:00 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x3f000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:00 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xcbe80000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:00 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) [ 737.083643] binder: 26420:26425 unknown command 1077949952 [ 737.105966] binder: 26420:26425 ioctl c0306201 20000440 returned -22 10:19:00 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0xfdfdffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:00 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x73d7000000000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 737.131459] binder_alloc: binder_alloc_mmap_handler: 26420 20001000-20004000 already mapped failed -16 [ 737.161474] binder: BINDER_SET_CONTEXT_MGR already set [ 737.174022] binder: 26420:26425 ioctl 40046207 0 returned -16 10:19:00 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) [ 737.207220] binder: 26420:26431 unknown command 1077949952 [ 737.234486] binder: 26420:26431 ioctl c0306201 20000440 returned -22 10:19:00 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:00 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="002f404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:00 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xf45b, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:00 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(0xffffffffffffffff, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) 10:19:00 executing program 5: semop(0x0, &(0x7f0000000080), 0x13) r0 = openat$full(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/full\x00', 0x480000, 0x0) bind$unix(r0, &(0x7f0000000200)=@file={0x0, './file0\x00'}, 0x6e) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x200000, 0x0) read(r1, &(0x7f0000000040)=""/11, 0xffffff3a) write(r0, &(0x7f0000000280)="d73b11e3d15c70fda64f7244da9a3e3362543ade5026e7eb8d50c2cbc2932aaf2cf37735aafed163a5d69bbbb3946ab7ae91a90488eed873a2a2b120699cfca313827edf400115cbcfe87cd1f4a0a8efdaa807e21f09ed40eda45e7ddf00fa898c6a3dd3ea3fd2233b56b0b5a469814b252e73e37a8aa2f8b3a8a3ff237d64c2e8884fcca4e16d7ec7fd783f6139725b33d8f74d8096580703c049a2b34b947878dbd4dde36ac04cc055f8b87254d1776934d6f47762dfcc19c66311fd781f95eaba70965e5991d287b7e16e754a4025bc20e595276869779865b64f1dd1e0396794828f38299b5fc13058ed61abdccdd87857d6edac2c87e1ec90adbf1b67008eb340ffc238456dd427ac84a367cdb2cda71165fe854db79dbc05df3b5810a8604307fd3a3a4fe7a9354c8dd4a7de4d361a8e33ac2593846968a18f8d87daa9005560ad96619425c64fb5553a55f80a180a0bb830804c46d38b60c736a83e30dfac35f03d22e074268c795e43dc1abc5c0515d3fed74e4a51fc8797e31c6dde2fbecd630ea7833edb08fe6d4048c28b4e510d344d6b2c9544ae3621fabf662b10142c9e46cbd025b8b71e28a4848607db860fedc2d989ece42158c6c248931f1e775c044ce0222d102b9ea53c9e4de3a3aee463709aa5ce78b36ee667df20b890bff7bec7945c57e4a3cfbf802f12f90a262bb40bf306c136746c5ad034361fde57cb1addbfe348c5ad3fba2bfdef3b6c5d46bdb74904fcf90a636f64294f2db56b0d425a5a9e0b4d3f0e3f768072fe92944260f57a6b618bbb68c1f39a972259a21117a3331d9da3816668740fd275585a0a2f12b9e1ceb51a2b8018e06fcf4529eedc15a17df29645d03a6275dba085198a8617240d6ec4e8573bf16d8b47afd43abfd2d03af321ecb73b2c4ed31b70d9c35652e71b25e08c2967093decd60ecd304e366337fc7dc0802ac1a3ae41d418f74ba8340cbdc91635fe299e0d13711959f92d95fdc54295d7fc2f4394b84e915ad68eefd8d5d5b32bc123a160356cf37b8844de196dcbf1f2cf1fd93b5491880d77541f9c5f172d45820a14a88ad4df030f1ecc40c7172f2ddeaea1aba053b54b437dbd8cfc0f28be3d324b93daf5ddf4a417481c8cb4da79d9b9a44e0c4e9a0135abc3d23670048f2c1056b9d99215237a8a90d92c92e3a9ca6dcf67709bb179fec3d0bbff89342e2583dc106028995acc685826b5f5629fcee7e5923d76578eec6263581aaf9c250b92721e3ce48c16c5c0660bb7a311762be3cfbbc1623e07e7e46554a35cc37c44c306f7d371d0865ab7e70de27596e264bd014704e1198560ce82a90a88de88b6d200d48eed0a09346e88a83249437578da445a6a1886ec58d07be04ec1ca2cba199d22c3771bf4697e122db4ded3216b0ae62caf867a28c8f471735d1b0112ed8f85054c69be275342244454173656ea07911b8310e4cdc5e8a7b824e96ff5ef2741c1c917b0b998239fea9c27adcefbdb7f2e3788d941643fbd16943f23c0e0b9da5ddfcb4558c8c9071ab6d93fc40f5b224fc400bec92f6e915210a1fe3d79fea4ef46c867cc57bda61980acc9ee5a2373177cbe6f5611156c5520bf59d103f8361248a98399e847006ea65abddb9c8c0571b0d026ed0c402bc896720bd269c67af215647355ab1a0202f825c32bf054957c502e7b00981498b5c2fca016fa452dd18d2dcff69b024c7540505919ea2caea059a7779020587cf66c1ba17e66e6668b0a3e5345be290b6f013b79055808ecb9929c3b71465099370e41083b2ba9f6bd3a7cb7c85e2c2b6ef11e9b2cd4903ec6d9646009cf874fe10e6b4d35808915a58c9d6addfb5be66dfab9c06c2533bbfa0f5a71874887fc75c04f526ff29c3cb59b2a04628643582ae28532f3e0b9f42eee67d8bdace8656732e41fc1ce2303ad24a404cde7fbae59693fcedcec1ba94442fb13aa491449a228a96b0621a5b64d0d5ab2146e5a31f809fa39328ba8474260e2aab945ac1936deaae9e9ecf246df04c5f3a1789c19585b791bd540392eea8dc6de71187cd6018b2d54e9afcc64f6a5e9884768f13b4daa249c6ffee0d86a47e4bcbc58fe5a6724dd7665ab5d4aea84e6be3d518764339a7e91cd6236a127ed48463a2a247eaecbc5b7bec95f00c02a632395282d5d7baca4236df92df0fa9f54021897e1d636f7cfa652fed464ccb4e36e9578582f812b51e0c50fc4e47fbe1389c3ae773b342fc5e67a85c2557f712a4fda055ab5b0539471be79d9c9eb3c1553cc56f8b6b646e4981f8266bf4198ac8f2cffd02cba7f683a0ac9603f87bd0971c9b58fb3d242d935bd032ddc735bf2b5accde9ffe6c9d67766e1a1d4eed5e79b17532b71c6382dbb19ec6505270ea63a72824dc7cf101e6ff8450e420adfc28f230f0aee2af95ab795d4e42874b2f592352fbf9557ad551cae0c22e4e1b515409a5dd4465b0d03f69f6835f32013cb7ea403586c00c1e1b912f1b1cefbbbabd3ca7d7c50faa6a550fa93dc28b78c619ef2552d2677d38ff0a7125edc50efa564bca9c1e21f784dba1eb226fe7d286e4a9d1ae457168650e8917ead75bd732c748eedf54e9c9dccd047ac754feebe115848ecb9e63d6fa8ca3f83717be81bad9c962b9e92c3f15cd09c6770960467f3deb2f98266a8d4e2106db0c02d98a5f8b65eb44fb23b26cd9dba93de06cb2428e66c259bfcae8b02455af1bf28eccecd79fd34c95ec0351c456a031d576f19d949215aab56544c6a209bd3e194f48ee763e65ae8b5f9b330e03e1c48bc67aee38f761ebe635869c736a3b17d286b70c69fdb4a7962be00185b3d54c36ff13b6729aef58fcd505546368148af785402be84c3511c8f4aababcba5053790d2c1ae4d4c6797d5ab74c27b9134c2c7b67d6bd2b76e2b2fb2a427789f747755813a77edccade50e8d4414bcb9fe8b914662e42ba39b744b7bf3fdb694eec898faa33169c5165129e81a2e99327d4e9d3d37044b836c6b67b2022767949e8332a64c3f42c4c4881a3e6815c9cac9586b3558690b7693cfb85e777b340f42148ce17c138d2fb6e4d0dd8d0792ad7f785dc4dfaeeb95e360d02b73727dca1d463e9a161da87f57e97ab255a7dabf43cc0993856ca6a01911619c38e58aa30192222ca11e1463b787a33462ee3aa99e5bcf797020ad4505d290a6319e853ad18ef1845d25726dc5495f2b94787f3dde28b145d8d77f7cda6656057d116023e64ed786fa3d30071018eca0691aa310b44842709450d15c5756c1ce052b574f755c367aab0fa102760382dd07c0d684c258580a967a124ba0f3401c913ab424eef2aca511e0892efc07750c5dac0fa745bcc453a677fce742664ccf8e6b292d0fa6052a9ed6f7a0b193e23b41f3ce7af27ad4214bb0fbec85a7a8928b22347cf1c8d694a4a306265aebe53faf600cb2bdb8d2000df0a27b2405816daa5e4f3e23ce671bd537f7d84eca9d40d43eb1013c992f5a47b2b4d31ee9ad6c0e25434130dad07187631e9f2280b9367e49533a642e2bc725587cc9b26ac3c90100a9ce87a527f4a1578dd3e102801ca977f976f9f97abf51d722a737230a9548d9e2825b3598ca1f21f9da2830baa36f9eac34047b42666e5e248bf0c511a0d04958c05970aff15424c6f01bbbae2b963ccf09cd9ec7a7404bebeb7bd8c183f663fe2a4831499472c02807da6e449663c8bbfcd46646af6396a4db4b8b5221b8295215dfd68f8502f3c4637f1711c0910afd5defd65d8295718d65cbe0458762b99242f148fc0e99387da9d19434eca748dc3308820e3878cf46a29ba566d93c65f5fb7b55b2763277b6b9cd4dee9c9c4391cd8dc10c9e2020bb6343b67d9f673bd24f856f3f7c998a77785b38281582d8ef0d9a9b1029da93dab26edadf31b1b359964ff10fa8dbb28733ad834750d194ae2846e46906a28dec7133b12df48e274216bd379491ddfa577a90b1d55f3c2299264f64c91e37c6c112eb8acdf389f942adc726a8e48482c1db1393fa748f0bf2f71c29ea20110269ccc2ab61e0ca1c77a097bf2325ccb3b8b035db0456fb75a0dd53fa77216bf13c036d3173c1a7c3eba24babec40ec949eb4f3372cbb3c5b39065d214724d5d3501bb940e617ece95a72b926500892377303694ebd4d47393e559a4a529388ab831e9d12b0c6275b6cca25b4271f1902fe42a910b2c4864c0d3ab83fa858ed2e5ef81f191c7c07c571a07392ebaa7417c16cf726f2be9236b5c5ca59908b2d9576fd1f04cbb438b655e0d5702fb5cce1b9349d541a8e91be65164e21f11d987e2eab382ff1f1af20d3d1f7ad003e3e99663b3bd1f102333f287eb0ed91db4391cd75643e1ee4848064c9011fd551825566e393a5c04c3cdc34a6dcf3eecd3c004b7446d65dfc7438d9799c431d8b789ed54ace43c80b57c393719a117e74fcee5aefd440704c2fdef8fb13ecc5964364cb653328d4e36053f8ef1e8d115b9f10208e7a05d8fc04951c92760d129b499cc46bd7686c7d54bbf2281180cd91537e23efdc2bd1b4b046638786e3dec553b1b35e8ce1a8138ee35840306b638bb6bddd4acefb326aedd861ec1147c5aa4cb292dd0f31daae8605226177d014811c027d8d4d3dad54782578a70dc6682ac4aa3e489154f073fc14ea5d63e3a8a885128354d9042e56f486b9e16c019723944e37fbf926cb8d3540ed6092034c215ffafda9f2b870593e068faeedf06a2b65bb0a29ae8c53a0bd748dfe651148b0e55c08d4be72d672ff96728397ec9bca80c333f9f78d272e912261205e064abf19641009fcfb38563299da51a92ea25b6f5369eba1aa9fad6fc9044760dc0afc5c0477b7f0011b5ddda201bf16c67295dd60ec332275796707f68d38bb602d249eb268871738483699cb5c8ae734a699450c2f58cae181cd295023b681fe054ab68fb4208f00a34fd77a86a3ec1dac4f1f5472d182fab76ec627dfbf0e596c9a7e9ccd4b1ef549c798e177dc87c8d9a7b88f05e6dc0b8af58eb77a13f16059f1d648c8db5a421b18ce69df0f118b03c1ab83552d658cc8b4a201c17121145a8552f346571516a3d352a7e061f27daec1392166f4d0e477038ff3cb5a077e7b97c0dcb82a2d79418c561255636e95c615929f90a529d801673164adc1a489093348ae6f6c28e87fd64f65f458ce5f4589597fa04bdaeefe6b965a188b3f3b0ae6ed3cc9cd2abf8e242dd3930667362e8c52c2e80b5cb14d583a1149ddb20493ae9628d4320a7f71ee9fe170297cd9eca5c273fd36cadf44a0fa2d3cf79b65a9a288a0fc03993a2db1ab224c36a2469448af82f5e84964e303a3cf6aa431fd784b6040e3edd65af7bb03e2b956cc21f4b5364207a4b48b729d838a09895d54592d25db7ee211adbf3b3bf13e01f7d025aca389a655bd0356a9fb27aa0f7b7416b97f89ce242897f7b68d04eed3b9e6bfa637e4d15688efc42ad87508573207ffcac3b6aeb4327d39ef29089bd92170a93f42fe254a7e1eed3ea1406fb946173d4c2715f36aaa572ff5eeea4619c33cad9e8280a96892f375b5163dc5875c1a80a483562993044b473c722608067ba9666fa1f765775a7e5f4b99bbd2f817b0e613e85a97a77d32234ceead94e0ca4ece1372c922ccc031ae03100102ce30c698060ad27dfa320336763ad57ee6253ec118f6f18b9dad38e79c7ab06aac13ad43f14d273ae5e964c1c0a6a48f806aa39356ac4d7305624fc1ffb2901b75b7fa4593689fc91eddfcc10c68df15f0be03ee9e3a", 0x1000) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000100)=0x7ed) r2 = semget$private(0x0, 0x3, 0x80) semop(r2, &(0x7f0000000080)=[{0x1, 0x4000000000000, 0x1800}, {0x2d9e365e151dd399, 0x5, 0x1800}, {0x2, 0x7fffffff, 0x1000}, {0x3, 0x20, 0x1000}, {0x0, 0x1, 0x800}, {0x9342316b83591fff, 0x3, 0x1000}, {0x0, 0x4, 0x1000}, {0x1, 0xb, 0x1800}], 0x8) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000001280)=0x0) syz_open_procfs(r3, &(0x7f00000012c0)='net/protocols\x00') getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000140), &(0x7f0000000180)=0x8) ioctl$TIOCGETD(r1, 0x545d, &(0x7f0000000000)) prctl$setendian(0x14, 0x3) 10:19:00 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x400, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getdents64(r1, &(0x7f0000000100)=""/111, 0x18) ioctl$TIOCLINUX7(r0, 0x541c, &(0x7f0000000040)={0x7, 0x1}) getdents(r1, &(0x7f0000000380)=""/246, 0xffffffff00000018) [ 737.741527] binder: 26458:26466 unknown command 1077948160 [ 737.772461] binder: 26458:26466 ioctl c0306201 20000440 returned -22 10:19:00 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(0xffffffffffffffff, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) 10:19:00 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xd0f2000000000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:01 executing program 5: semop(0x0, &(0x7f0000000080), 0x13) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000040)=""/11, 0xffffff3a) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000140), &(0x7f0000000180)=0x8) ioctl$TIOCGETD(r0, 0x545d, &(0x7f0000000000)) [ 737.802648] binder_alloc: binder_alloc_mmap_handler: 26458 20001000-20004000 already mapped failed -16 10:19:01 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 737.906929] binder: BINDER_SET_CONTEXT_MGR already set [ 737.915974] binder: 26458:26472 unknown command 1077948160 [ 737.931175] binder: 26458:26466 ioctl 40046207 0 returned -16 [ 737.959191] binder: 26458:26472 ioctl c0306201 20000440 returned -22 10:19:01 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xabd1000000000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:01 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(0xffffffffffffffff, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) 10:19:01 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="4c63404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:01 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0xfdfdffff00000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 738.124720] binder: 26500:26501 unknown command 1077961548 [ 738.140565] binder: 26500:26501 ioctl c0306201 20000440 returned -22 10:19:01 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6(0xa, 0x80003, 0x840000000000006) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) 10:19:01 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xab18000000000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 738.170924] binder_alloc: binder_alloc_mmap_handler: 26500 20001000-20004000 already mapped failed -16 [ 738.192595] binder: BINDER_SET_CONTEXT_MGR already set [ 738.207789] binder: 26500:26501 ioctl 40046207 0 returned -16 10:19:01 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000180)=0x0) r3 = syz_open_procfs(r2, &(0x7f00000001c0)='net/route\x00') getdents64(r1, &(0x7f0000000100)=""/111, 0x18) ioctl$TIOCSWINSZ(r0, 0x5414, &(0x7f0000000040)={0x0, 0x7f, 0x1, 0x5}) ioctl$sock_FIOGETOWN(r3, 0x8903, &(0x7f0000000240)=0x0) sched_rr_get_interval(r4, &(0x7f00000000c0)) getdents(r1, &(0x7f0000000380)=""/246, 0xffffffff00000018) setsockopt$kcm_KCM_RECV_DISABLE(r3, 0x119, 0x1, &(0x7f0000000200)=0x2c4, 0x4) [ 738.248616] binder: 26500:26506 unknown command 1077961548 [ 738.269873] binder: 26500:26506 ioctl c0306201 20000440 returned -22 10:19:01 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0463404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:01 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 738.346322] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. 10:19:01 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xcbe8, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 738.477732] binder: 26527:26528 unknown command 1077961476 [ 738.491358] binder: 26527:26528 ioctl c0306201 20000440 returned -22 [ 738.509176] binder_alloc: binder_alloc_mmap_handler: 26527 20001000-20004000 already mapped failed -16 [ 738.571797] binder: BINDER_SET_CONTEXT_MGR already set [ 738.593818] binder: 26527:26528 ioctl 40046207 0 returned -16 [ 738.613160] binder: 26527:26534 unknown command 1077961476 [ 738.628701] binder: 26527:26534 ioctl c0306201 20000440 returned -22 10:19:02 executing program 5: semop(0x0, &(0x7f0000000080), 0x13) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000040)=""/11, 0xffffff3a) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000080)='cpuset}\x00', 0xffffffffffffffff}, 0x30) migrate_pages(r1, 0x2, &(0x7f00000001c0)=0x6ecf, &(0x7f0000000240)=0x4) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000140), &(0x7f0000000180)=0x8) ioctl$TIOCGETD(r0, 0x545d, &(0x7f0000000000)) 10:19:02 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6(0xa, 0x80003, 0x840000000000006) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) 10:19:02 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x80ffff00000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:02 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x3e30000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:02 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="005f404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:02 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getdents64(r0, &(0x7f0000000100)=""/111, 0x18) getdents(r0, &(0x7f0000000380)=""/246, 0xfffffffffffffc99) [ 738.913883] binder: 26553:26558 unknown command 1077960448 [ 738.921020] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 738.929974] binder: 26553:26558 ioctl c0306201 20000440 returned -22 [ 738.949728] binder_alloc: binder_alloc_mmap_handler: 26553 20001000-20004000 already mapped failed -16 10:19:02 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xa8a70000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 738.985160] binder: BINDER_SET_CONTEXT_MGR already set [ 738.992434] binder: 26553:26563 unknown command 1077960448 [ 739.009970] binder: 26553:26563 ioctl c0306201 20000440 returned -22 [ 739.025045] binder: 26553:26558 ioctl 40046207 0 returned -16 10:19:02 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6(0xa, 0x80003, 0x840000000000006) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) 10:19:02 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0031404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:02 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x3f00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:02 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xf0500000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 739.181252] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 739.207088] binder: 26580:26582 unknown command 1077948672 [ 739.223030] binder: 26580:26582 ioctl c0306201 20000440 returned -22 [ 739.244576] binder_alloc: binder_alloc_mmap_handler: 26580 20001000-20004000 already mapped failed -16 [ 739.264946] binder: BINDER_SET_CONTEXT_MGR already set [ 739.282484] binder: 26580:26582 ioctl 40046207 0 returned -16 10:19:02 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x8386, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 739.296644] binder: 26580:26587 unknown command 1077948672 [ 739.312729] binder: 26580:26587 ioctl c0306201 20000440 returned -22 10:19:02 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0xffff8000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:02 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) 10:19:02 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="003b404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:02 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x5c8, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:02 executing program 5: semop(0x0, &(0x7f0000000080), 0x13) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000040)=""/11, 0xffffff3a) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000140), &(0x7f0000000180)=0x8) ioctl$TIOCGETD(r0, 0x545d, &(0x7f0000000000)) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vsock\x00', 0x4000, 0x0) ioctl$KVM_IRQ_LINE_STATUS(r1, 0xc008ae67, &(0x7f00000000c0)={0xd9, 0x3b9}) 10:19:02 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000080)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x8) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) listen(r0, 0x400000066fb) r1 = socket$packet(0x11, 0x3, 0x300) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000080)={0x0, 0xc7}, &(0x7f00000000c0)=0x8) r3 = creat(&(0x7f00000001c0)='./file0\x00', 0x90) ioctl$VT_GETSTATE(r3, 0x5603, &(0x7f0000000200)={0x3f, 0x7, 0x89}) fsetxattr$trusted_overlay_origin(0xffffffffffffffff, &(0x7f0000000240)='trusted.overlay.origin\x00', &(0x7f0000000280)='y\x00', 0x2, 0x2) getresuid(&(0x7f0000000740), &(0x7f0000000780), &(0x7f00000007c0)=0x0) ioctl$KVM_GET_DEBUGREGS(r3, 0x8080aea1, &(0x7f0000000d40)) fstat(r3, &(0x7f0000000900)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$9p_fd(0x0, &(0x7f0000000600)='./file0\x00', &(0x7f0000000700)='9p\x00', 0x24000, &(0x7f0000000dc0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r3, @ANYBLOB=',wfdno=', @ANYRESHEX=r1, @ANYBLOB=',msize=0x000000000000a04b,fscache,dfltuid=', @ANYRESHEX=r4, @ANYBLOB="2c63616368653d6d6d61702c6e6f0fc7ea2e88405e7a2cee2fb76ec86011dd60053c0f6ff6c9b7c3e792476465776d61702c736d61636b6673747261acb24b5652ea7840d6d72540a36712d09bef125674663d565ae8a9a01a9718a887c026f91b831153ca4dfcea2a4d0a32c6", @ANYRESDEC=r5, @ANYBLOB=',\x00']) ioctl$KDGKBSENT(r1, 0x4b48, &(0x7f0000000180)={0x30d, 0x0, 0xfc}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x1461bcd4d1a936ef, &(0x7f0000000240)=ANY=[], &(0x7f0000000840)="47fdff00bfda6078152b65882e14907ffbc5b30908d22a65be2535b4722b05c8511e22624a9c89564af6ed57a50955cbd23714bff0fedf5bd90d25fdbb9e4496bc07a30b34455c4715debdf9e292a0a3b17cb4f4affe7846d4100404dec97fec764bcc4926bf87f4e889f12d8ff05d3e44538aa627cac143caa205bc6c0969812d51996f3140f7ce18e8c76dd77c8acc830000000000000000000000000000000000000000", 0x0, 0xfffffffffffffd45, &(0x7f0000000340)=""/251}, 0x48) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1, 0x8, &(0x7f0000000240)=ANY=[@ANYBLOB="7a0af8ff75256400bfa100000000000007010000f8ffffffb702000004000000bf130000000000008500000006000000b7000000000000009500000000000000"], &(0x7f0000000100)='GPL\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r6, 0x8000a0, 0xe, 0x85, &(0x7f0000000300)="00000074000000000000000039e4", &(0x7f0000000340)=""/133, 0x429}, 0x28) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000001a00)={0x0, 0xffffffffffffffff, 0x0, 0xc, &(0x7f00000019c0)='cgroup.type\x00', 0xffffffffffffffff}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000280)={0x0, 0xffffffffffffffff, 0x0, 0xe6, &(0x7f0000000440)="a0b2b16ba9e26fe2f44dcd77e7b5de67d5a82b544d5c2a86afa699435934ec5b8aacdbe081154c67a57f1147621aaf5f1c986fc63744bb3b6feadf5ea2b7b1d3d913e88efb17a157de15b10accf1f593209067d9f74cff9f7a58b016bbb545d13eed523c437bb0af412caec2afc7001714eeecb02c9e1ed34819825409ffa4b4e12b920f0826cbccbafd337736448fb991d8235601790cb321ba07c48efac337d32f030e6cebc3f28ba2b807514bc7a7e0bf367d6323b83d9de1d8326f14f8d12da7eaa07e97f0672334e833b01dd2fa48f82af3d7f9841b34e8710167be803eb80404b4a331"}, 0x30) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000380)=ANY=[], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000140)={r7, 0x1800000000000000, 0x0, 0x29, &(0x7f0000000000), &(0x7f00000000c0)=""/41, 0x100}, 0x28) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000006c0)={r7, 0x0, 0xbd, 0x42, &(0x7f0000000540)="dfb1e4bd45c49ec2c0f7f06163e0a934d508b44fc44e86cf2d19a1480d6a17f084dd811053592e79b9ce747f257f308c83f29cdfcb53efad8e8d368c6abe8db0675f8e51a22be3449fb72219c32285ee8401fd9ac422ab651f0194c4f9ebd787844bb3270e027620162168ac35cc01e2e6f7b2870d2fce9434ed5a32b66992c01e83edb7a9933d082c8a1cc85d4c869cb4f0754a73b9ba2cdcced964f3774a5fdf79abaa784a0bf73e7ee75d3b6ff9623c93a9c0829669c10de56cc25b", &(0x7f0000000640)=""/66, 0xfe}, 0x28) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000440)={&(0x7f0000000400)='./file0\x00', 0x0, 0x8}, 0x10) syz_open_dev$adsp(&(0x7f0000000d00)='/dev/adsp#\x00', 0x80000000, 0x1) execveat(r0, &(0x7f0000000800)='./file1\x00', &(0x7f0000000b80)=[&(0x7f0000000a80)="c076626f786e6574306e6f64657676626f786e65743073656c6600", &(0x7f0000000ac0)='\x00', &(0x7f0000000b00)='dfltuid', &(0x7f0000000b40)='syzkaller\x00'], &(0x7f0000000cc0)=[&(0x7f0000000bc0)='nodevmap', &(0x7f0000000c00)='trusted.overlay.origin\x00', &(0x7f0000000c40)=')\x00', &(0x7f0000000c80)='trusted.overlay.origin\x00'], 0x100) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000500)={0xffffffffffffffff, &(0x7f00000002c0)="b86dfa32da56c4eaa38d2491c97f7b81570dc6167c3b57679ef8fae12cb85e3bedaac4858edd7feea053dc", &(0x7f00000004c0)="52379817b7728cb82a61875ac903d00e9a48a965faa4fdddcfe6ecbdd151ba332e6999227ccdf2f5fc"}, 0x20) ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000100)={r2, 0x5}, 0x8) getpeername(r0, &(0x7f00000002c0), &(0x7f0000000340)=0x80) [ 739.832895] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. 10:19:03 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x307f000000000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 739.895676] binder: 26607:26616 unknown command 1077951232 [ 739.920171] binder: 26607:26616 ioctl c0306201 20000440 returned -22 [ 739.940265] binder: BINDER_SET_CONTEXT_MGR already set [ 739.940950] binder: 26607:26620 unknown command 1077951232 [ 739.962928] binder: 26607:26616 ioctl 40046207 0 returned -16 10:19:03 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xbb800000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:03 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) 10:19:03 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0xfffffdfd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:03 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) bpf$BPF_MAP_GET_NEXT_ID(0xc, &(0x7f0000000080)=0x1, 0x4) ioctl$TIOCMSET(r0, 0x5418, &(0x7f0000000040)=0x8) getdents64(r1, &(0x7f0000000100)=""/111, 0x18) getdents(r1, &(0x7f0000000380)=""/246, 0xffffffff00000018) [ 740.031864] binder: 26607:26620 ioctl c0306201 20000440 returned -22 10:19:03 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0041404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:03 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x2341000000000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 740.123718] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. 10:19:03 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) [ 740.228980] binder: 26645:26646 unknown command 1077952768 [ 740.262236] binder: 26645:26646 ioctl c0306201 20000440 returned -22 10:19:03 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 740.289959] binder: BINDER_SET_CONTEXT_MGR already set [ 740.313469] binder: 26645:26650 unknown command 1077952768 [ 740.321039] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. 10:19:03 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x60fe000000000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 740.354100] binder: 26645:26646 ioctl 40046207 0 returned -16 [ 740.378324] binder: 26645:26650 ioctl c0306201 20000440 returned -22 10:19:03 executing program 5: semop(0x0, &(0x7f00000000c0)=[{0x0, 0x1, 0xdbe368d120b6e7d5}], 0x1) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000040)=""/11, 0xffffff3a) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) clone(0x2, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000140), &(0x7f0000000180)=0x8) ioctl$TIOCGETD(r0, 0x545d, &(0x7f0000000000)) 10:19:03 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0xffff8000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:03 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0037404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:03 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x97ffffff, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:03 executing program 0: r0 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) 10:19:03 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) setxattr$security_selinux(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='security.selinux\x00', &(0x7f00000000c0)='system_u:object_r:inetd_log_t:s0\x00', 0x21, 0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getdents64(r0, &(0x7f0000000100)=""/111, 0x18) getdents(r0, &(0x7f0000000380)=""/246, 0xffffffff00000018) 10:19:04 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x0, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) [ 740.814934] binder: 26674:26684 unknown command 1077950208 [ 740.843767] binder: 26674:26684 ioctl c0306201 20000440 returned -22 10:19:04 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x7828, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 740.878893] binder_alloc_mmap_handler: 2 callbacks suppressed [ 740.878912] binder_alloc: binder_alloc_mmap_handler: 26674 20001000-20004000 already mapped failed -16 [ 740.913558] binder: BINDER_SET_CONTEXT_MGR already set [ 740.936062] binder: 26674:26684 ioctl 40046207 0 returned -16 [ 740.953289] binder: 26674:26689 unknown command 1077950208 [ 740.969122] binder: 26674:26689 ioctl c0306201 20000440 returned -22 10:19:04 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x80ffff00000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:04 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x50f0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 740.985165] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. 10:19:04 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0a63404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:04 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x0, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) [ 741.167821] binder: 26712:26716 unknown command 1077961482 [ 741.201752] binder: 26712:26716 ioctl c0306201 20000440 returned -22 [ 741.216241] binder_alloc: binder_alloc_mmap_handler: 26712 20001000-20004000 already mapped failed -16 [ 741.236735] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 741.245820] binder: BINDER_SET_CONTEXT_MGR already set [ 741.255733] binder: 26712:26716 ioctl 40046207 0 returned -16 [ 741.266361] binder: 26712:26720 unknown command 1077961482 [ 741.277344] binder: 26712:26720 ioctl c0306201 20000440 returned -22 10:19:04 executing program 5: semop(0x0, &(0x7f0000000080), 0x13) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000040)=""/11, 0xffffff3a) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000140), &(0x7f0000000180)=0x8) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000080)={0x90caffe, 0x3, 0x5, 0x3, 0xff, 0x7, 0x4, 0xffffffff, 0x14898f6b, 0x200, 0xcac, 0x6}) ioctl$TIOCGETD(r0, 0x545d, &(0x7f0000000000)) 10:19:04 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:04 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x46eb, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:04 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x0, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) 10:19:04 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0363404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:04 executing program 4: openat$zero(0xffffffffffffff9c, &(0x7f0000000040)='/dev/zero\x00', 0x4402, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getdents64(r0, &(0x7f0000000100)=""/111, 0x18) getdents(r0, &(0x7f0000000380)=""/246, 0xffffffff00000018) [ 741.752862] binder: 26735:26739 unknown command 1077961475 [ 741.765617] binder: 26735:26739 ioctl c0306201 20000440 returned -22 10:19:04 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x699b, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 741.799937] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 741.811037] binder_alloc: binder_alloc_mmap_handler: 26735 20001000-20004000 already mapped failed -16 10:19:05 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1263484000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) [ 741.877065] binder: BINDER_SET_CONTEXT_MGR already set [ 741.885474] binder: 26735:26749 unknown command 1077961475 [ 741.900073] binder: 26735:26749 ioctl c0306201 20000440 returned -22 [ 741.919491] binder: 26735:26739 ioctl 40046207 0 returned -16 10:19:05 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x80ffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:05 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x0) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) 10:19:05 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x4862000000000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 742.043383] binder: 26767:26768 got reply transaction with no transaction stack [ 742.066376] binder: 26767:26768 transaction failed 29201/-71, size 26388279066624-0 line 2762 [ 742.087977] binder_alloc: binder_alloc_mmap_handler: 26767 20001000-20004000 already mapped failed -16 [ 742.106077] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. 10:19:05 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x834, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 742.141440] binder: BINDER_SET_CONTEXT_MGR already set [ 742.154556] binder: 26767:26775 got reply transaction with no transaction stack [ 742.174010] binder: 26767:26768 ioctl 40046207 0 returned -16 [ 742.189504] binder: 26767:26775 transaction failed 29201/-71, size 26388279066624-0 line 2762 [ 742.222520] binder: undelivered TRANSACTION_ERROR: 29201 [ 742.229487] binder: undelivered TRANSACTION_ERROR: 29201 10:19:05 executing program 5: semop(0x0, &(0x7f0000000080), 0x13) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000140)={0x0}, &(0x7f0000000180)=0x8) r2 = syz_open_dev$adsp(&(0x7f0000000040)='/dev/adsp#\x00', 0x53, 0x0) setsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0x14, &(0x7f00000000c0)=@assoc_value={r1}, 0x8) ioctl$TIOCGETD(r0, 0x545d, &(0x7f0000000000)) 10:19:05 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x0) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) 10:19:05 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xf884, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:05 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="005d404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:05 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x3f000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:05 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000240)='/proc/sys/net/ipv4/vs/conn_reuse_mode\x00', 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x80004) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getdents64(r0, &(0x7f0000000100)=""/111, 0x18) getdents(r0, &(0x7f0000000380)=""/246, 0xffffffff00000018) [ 742.707758] binder: 26799:26800 unknown command 1077959936 [ 742.757296] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 742.772775] binder: 26799:26800 ioctl c0306201 20000440 returned -22 10:19:06 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x8ed000000000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:06 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0xfdfdffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 742.818449] binder_alloc: binder_alloc_mmap_handler: 26799 20001000-20004000 already mapped failed -16 10:19:06 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x0) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) [ 742.876209] binder: BINDER_SET_CONTEXT_MGR already set [ 742.915524] binder: 26799:26821 unknown command 1077959936 [ 742.939698] binder: 26799:26813 ioctl 40046207 0 returned -16 [ 742.947699] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. 10:19:06 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xf050000000000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 742.975989] binder: 26799:26821 ioctl c0306201 20000440 returned -22 10:19:06 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(0xffffffffffffffff, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) 10:19:06 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x3f00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 743.111574] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. 10:19:06 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x243b, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:06 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0059404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:06 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(0xffffffffffffffff, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) 10:19:06 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:06 executing program 5: semop(0x0, &(0x7f0000000080), 0x13) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) futex(&(0x7f0000000000), 0x3, 0x0, &(0x7f00000000c0)={0x0, 0x1c9c380}, &(0x7f00000001c0), 0x2) read(r0, &(0x7f0000000040)=""/11, 0xffffff3a) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r1 = socket$bt_hidp(0x1f, 0x3, 0x6) accept(r1, &(0x7f0000000240)=@ax25, &(0x7f00000002c0)=0x80) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000140), &(0x7f0000000180)=0x8) ioctl$TIOCGETD(r0, 0x545d, &(0x7f0000000080)) 10:19:06 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000001440)="2f70726f632f7379502f6e65743ac1761ca9d18c002f73796e6356a1e661cab6bd231494", 0x2, 0x0) ustat(0x2, &(0x7f0000001540)) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000700)=0x0) move_pages(r1, 0x7, &(0x7f0000000740)=[&(0x7f0000911000/0x1000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f000094a000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f000081b000/0x2000)=nil, &(0x7f0000802000/0x2000)=nil], &(0x7f0000000780)=[0x80, 0xfb50], &(0x7f00000007c0)=[0x0, 0x0], 0x4) execve(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000600)=[&(0x7f0000000280)='/dev/ptmx\x00', &(0x7f00000002c0)='/dev/ptmx\x00', &(0x7f0000000300)='ppp0\'-lo&\x00', &(0x7f0000000340)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", &(0x7f0000000480)='\x00', &(0x7f00000004c0)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", &(0x7f0000000500)='/dev/ptmx\x00', &(0x7f0000000540)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", &(0x7f0000000580)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", &(0x7f00000005c0)='/dev/ptmx\x00'], &(0x7f00000006c0)=[&(0x7f0000000680)=']\x00']) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) signalfd4(r2, &(0x7f0000000900)={0x2}, 0x8, 0x80000) execveat(r0, &(0x7f0000000ec0)='./file0\x00', &(0x7f0000001000)=[&(0x7f0000000f00)="766d6e65743123d700", &(0x7f0000000f40)="2faf00", &(0x7f0000000f80)=']\x00', &(0x7f0000000fc0)=']mime_type{+\x00'], &(0x7f0000001180)=[&(0x7f0000001040)='\x00', &(0x7f0000001080)='\x00', &(0x7f00000010c0)="70726f636e6f64657627626465762774727573746564406b657972696e67212a23a600", &(0x7f0000001100)='*}selinuxposix_acl_accessvmnet0\x00', &(0x7f0000001140)="2f1f6c6f657468305b2973656375726974793665746830626465762a707070313a00"], 0x1800) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) ptrace$getenv(0x4201, r1, 0xffd, &(0x7f0000000e80)) setsockopt$inet_sctp_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000880)=0x6, 0x4) unlinkat(r0, &(0x7f0000000940)='./file0\x00', 0x0) fgetxattr(r2, &(0x7f0000000800)=@known='com.apple.system.Security\x00', &(0x7f0000000840)=""/52, 0x34) r3 = open$dir(&(0x7f0000000040)='./file0\x00', 0x0, 0x10100) getdents64(r2, &(0x7f0000000100)=""/111, 0x18) ioctl$KDGKBDIACR(r2, 0x4b4a, &(0x7f0000000180)=""/197) getdents(r2, &(0x7f0000000380)=""/246, 0xffffffff00000018) ioctl$EVIOCSREP(r0, 0x40084503, &(0x7f00000008c0)=[0x6, 0x1]) execveat(r0, &(0x7f0000000980)='./file0\x00', &(0x7f0000000b40)=[&(0x7f00000011c0)=']\x00', &(0x7f0000000a00)='\x00', &(0x7f0000000a40)=']mime_type{+\x00', &(0x7f0000000a80)='/dev/ptmx\x00', &(0x7f0000000ac0)="766d6e65743123d700", &(0x7f0000001380)="524528a257eba8a1828d28d50a46f15a7f542aedfb23e7441d6d8a78b762ecad0cf6a9c6f7257d55ac59f8562e62b8a0be32d4a13530e9af46c1b6e09377231b3e5dbcac9cdcef14caf14aadcf3041aa61"], &(0x7f0000000e00)=[&(0x7f0000000b80)='*}selinuxposix_acl_accessvmnet0\x00', &(0x7f0000000bc0)=']\x00', &(0x7f0000000c00)='[\'\x00', &(0x7f0000000c40)='\x00', &(0x7f0000000c80)='vboxnet0\\\x00', &(0x7f0000000cc0)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", &(0x7f0000000d00)='ppp0\'-lo&\x00', &(0x7f0000001200)="636f6d2e6170706c652e73797374656d2e536563757269747900d76873a0f8ef79d864ca043cd6bc0f31cd3cdada44200e36a3579f3f77d6c6d48e14c068b1506f4fcdc5dc69024f1bbe29a840602e663221f7e45750286a5228aabc575b0e820ac5fcb6d9be2434b8cf743414fa215d776a373df38741a3a044420c308f4435042ba72f463f6e58bd6725343d8a36b722d4ff18a4c213012585d25c57821c893ebdae67aefbac71558574695a91168a2f14ce80859e5dfe4ab3b651e2062d4dbfcfa65c80bfb5480452f4db98fe4dd1166bb8898acc8af4f16c95321bf2f04940ce8b4a41f59d1f350ba2f872595db641b30593a8f5073ce70bd2d6cf9d07b7f1d5a9da9b310b76ea8f75277c0d4a979395b9a19d85ef60fd7a5005c9c94c277b4d9c9cd3f86b8aa74b44c2417258b73591d5988ac4562bc1fb8b8e00010c7420dd7203a6349603d187756310e8d01676a38b4659ae1920281918f0c477b1d9023d19ec872b377f7f5af4a0abb37c5d451f748e", &(0x7f0000000d80)='\x00', &(0x7f0000000dc0)=']\x00'], 0x0) r4 = syz_genetlink_get_family_id$nbd(&(0x7f0000000b00)='nbd\x00') sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000001400)={&(0x7f00000009c0)={0x10, 0x0, 0x0, 0x100151}, 0xc, &(0x7f0000000d40)={&(0x7f0000001480)={0x8c, r4, 0x8, 0x70bd2c, 0x25dfdbfe, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7fff}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x101}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0xfffffffeffffffff}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x40}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_SOCKETS={0x1c, 0x7, [{0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8, 0x1, r0}]}, @NBD_ATTR_SERVER_FLAGS={0xc}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x8c}, 0x1, 0x0, 0x0, 0x20040800}, 0x4000050) faccessat(r0, &(0x7f0000000080)='./file0\x00', 0x3c, 0x1a00) [ 743.624436] binder: 26851:26852 unknown command 1077958912 10:19:06 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x9650, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 743.665679] binder: 26851:26852 ioctl c0306201 20000440 returned -22 [ 743.680916] binder_alloc: binder_alloc_mmap_handler: 26851 20001000-20004000 already mapped failed -16 [ 743.691255] binder: BINDER_SET_CONTEXT_MGR already set [ 743.696840] binder: 26851:26852 ioctl 40046207 0 returned -16 [ 743.702971] binder: 26851:26866 unknown command 1077958912 [ 743.709091] binder: 26851:26866 ioctl c0306201 20000440 returned -22 10:19:06 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0026404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:06 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(0xffffffffffffffff, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) 10:19:06 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:07 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xd1ab, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 743.848495] binder: 26877:26880 unknown command 1077945856 [ 743.872736] binder: 26877:26880 ioctl c0306201 20000440 returned -22 [ 743.899119] binder_alloc: binder_alloc_mmap_handler: 26877 20001000-20004000 already mapped failed -16 [ 743.920839] binder: BINDER_SET_CONTEXT_MGR already set [ 743.930985] binder: 26877:26880 ioctl 40046207 0 returned -16 [ 743.941724] binder: 26877:26886 unknown command 1077945856 10:19:07 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x0, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) [ 743.962430] binder: 26877:26886 ioctl c0306201 20000440 returned -22 10:19:07 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xf898, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:07 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0017404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:07 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0xfdfdffff00000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 744.113325] binder: 26898:26900 unknown command 1077942016 [ 744.138129] binder: 26898:26900 ioctl c0306201 20000440 returned -22 10:19:07 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x9f01, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 744.167035] binder_alloc: binder_alloc_mmap_handler: 26898 20001000-20004000 already mapped failed -16 [ 744.238659] binder: 26898:26904 unknown command 1077942016 [ 744.239000] binder: BINDER_SET_CONTEXT_MGR already set [ 744.252328] binder: 26898:26904 ioctl c0306201 20000440 returned -22 [ 744.270921] binder: 26898:26900 ioctl 40046207 0 returned -16 10:19:07 executing program 5: semop(0x0, &(0x7f0000000080), 0x13) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000040)=""/11, 0xffffff3a) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r2, 0xae04) ioctl$DRM_IOCTL_RES_CTX(r1, 0xc0106426, &(0x7f00000001c0)={0x1, &(0x7f00000000c0)=[{}]}) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000140), &(0x7f0000000180)=0x8) ioctl$TIOCGETD(r0, 0x545d, &(0x7f0000000000)) 10:19:07 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x0, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) 10:19:07 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x23fa0000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:07 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:07 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="004e404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:07 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getdents64(r0, &(0x7f0000000100)=""/111, 0x18) getdents(r0, &(0x7f0000000380)=""/246, 0xffffffff00000018) pipe2$9p(&(0x7f0000000040), 0x4800) [ 744.608283] binder: 26925:26933 unknown command 1077956096 [ 744.627227] binder: 26925:26933 ioctl c0306201 20000440 returned -22 10:19:07 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x0, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) 10:19:07 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xfa23, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 744.656448] binder_alloc: binder_alloc_mmap_handler: 26925 20001000-20004000 already mapped failed -16 [ 744.670504] binder: BINDER_SET_CONTEXT_MGR already set [ 744.676995] binder: 26925:26933 ioctl 40046207 0 returned -16 [ 744.695614] binder: 26925:26941 unknown command 1077956096 10:19:07 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0xfffffdfd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 744.707391] binder: 26925:26941 ioctl c0306201 20000440 returned -22 10:19:07 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0020404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:08 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xb856000000000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:08 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) [ 744.883500] binder: 26958:26959 unknown command 1077944320 [ 744.912846] binder: 26958:26959 ioctl c0306201 20000440 returned -22 [ 744.944264] binder_alloc: binder_alloc_mmap_handler: 26958 20001000-20004000 already mapped failed -16 [ 744.944504] net_ratelimit: 5 callbacks suppressed [ 744.944514] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 745.024897] binder: BINDER_SET_CONTEXT_MGR already set [ 745.045718] binder: 26958:26964 unknown command 1077944320 [ 745.055434] binder: 26958:26959 ioctl 40046207 0 returned -16 [ 745.057297] binder: 26958:26964 ioctl c0306201 20000440 returned -22 10:19:08 executing program 5: semop(0x0, &(0x7f0000000080), 0x13) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000040)=""/11, 0xffffff3a) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f00000002c0)={0x0, 0x5c, &(0x7f0000000240)=[@in={0x2, 0x4e21, @broadcast}, @in={0x2, 0x4e22}, @in6={0xa, 0x4e20, 0x9, @mcast1, 0x100000000}, @in={0x2, 0x4e23, @rand_addr=0x7}, @in={0x2, 0x4e22, @local}]}, &(0x7f0000000300)=0x10) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000140)={r1}, &(0x7f0000000180)=0x8) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000080)={0x7, 0x3b, 0x9, 0x5, 0x4, 0x3ff, 0x10a6, 0x3, 0x7f, 0x1}) ioctl$TIOCGETD(r0, 0x545d, &(0x7f0000000000)) 10:19:08 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x3f000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:08 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x38b3000000000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:08 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) 10:19:08 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="001e404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:08 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f000016a000/0x2000)=nil, 0x2000, 0x1000000) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x42000, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) syz_open_dev$admmidi(&(0x7f0000000080)='/dev/admmidi#\x00', 0x0, 0x40000) getdents64(r0, &(0x7f0000000100)=""/111, 0x18) getdents(r0, &(0x7f0000000380)=""/246, 0xffffffff00000018) [ 745.483479] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 745.505716] binder: 26979:26986 unknown command 1077943808 [ 745.531360] binder: 26979:26986 ioctl c0306201 20000440 returned -22 10:19:08 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x4560, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:08 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) 10:19:08 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0xfdfdffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 745.589362] binder: BINDER_SET_CONTEXT_MGR already set [ 745.615765] binder: 26979:26996 unknown command 1077943808 [ 745.632432] binder: 26979:26994 ioctl 40046207 0 returned -16 10:19:08 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xe3cb0000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 745.665554] binder: 26979:26996 ioctl c0306201 20000440 returned -22 [ 745.692815] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. 10:19:08 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0024404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:09 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488d") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) [ 745.827873] binder: 27018:27019 unknown command 1077945344 [ 745.872067] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 745.877848] binder: 27018:27019 ioctl c0306201 20000440 returned -22 [ 745.929092] binder_alloc_mmap_handler: 1 callbacks suppressed [ 745.929110] binder_alloc: binder_alloc_mmap_handler: 27018 20001000-20004000 already mapped failed -16 [ 745.965935] binder: BINDER_SET_CONTEXT_MGR already set [ 745.971513] binder: 27018:27019 ioctl 40046207 0 returned -16 [ 745.978091] binder: 27018:27024 unknown command 1077945344 [ 745.984006] binder: 27018:27024 ioctl c0306201 20000440 returned -22 10:19:09 executing program 5: semop(0x0, &(0x7f0000000080), 0x13) syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x10000, 0x400) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0xc000, 0x0) read(r0, &(0x7f0000000040)=""/11, 0xffffff3a) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000140), &(0x7f0000000180)=0x8) ioctl$TIOCGETD(r0, 0x545d, &(0x7f0000000000)) 10:19:09 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xb5e000000000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:09 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:09 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488d") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) 10:19:09 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="002c404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:09 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000040)={0x0, 0x1}, &(0x7f0000000080)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r1, 0x84, 0x0, &(0x7f00000000c0)={r2, 0x10000, 0x0, 0x1}, 0x10) getdents64(r1, &(0x7f0000000100)=""/111, 0x18) getdents(r1, &(0x7f0000000380)=""/246, 0xffffffff00000018) [ 746.420993] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 746.440293] binder: 27037:27038 unknown command 1077947392 [ 746.463971] binder: 27037:27038 ioctl c0306201 20000440 returned -22 10:19:09 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x900b0000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:09 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488d") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) [ 746.505752] binder_alloc: binder_alloc_mmap_handler: 27037 20001000-20004000 already mapped failed -16 [ 746.529120] binder: BINDER_SET_CONTEXT_MGR already set [ 746.546683] binder: 27037:27038 ioctl 40046207 0 returned -16 10:19:09 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0xfffffdfd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 746.565015] binder: 27037:27047 unknown command 1077947392 [ 746.579899] binder: 27037:27047 ioctl c0306201 20000440 returned -22 [ 746.597499] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. 10:19:09 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="005a404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:09 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xa1e0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:09 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d76") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) [ 746.781616] binder: 27066:27067 unknown command 1077959168 [ 746.794482] binder: 27066:27067 ioctl c0306201 20000440 returned -22 [ 746.809383] binder_alloc: binder_alloc_mmap_handler: 27066 20001000-20004000 already mapped failed -16 [ 746.827061] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 746.840202] binder: BINDER_SET_CONTEXT_MGR already set [ 746.846467] binder: 27066:27067 ioctl 40046207 0 returned -16 [ 746.853755] binder: 27066:27072 unknown command 1077959168 [ 746.876291] binder: 27066:27072 ioctl c0306201 20000440 returned -22 10:19:10 executing program 5: semop(0x0, &(0x7f0000000240)=[{0x7, 0xe84, 0x1800}, {0x7, 0x4a, 0x1800}, {0x0, 0x0, 0x1000}, {0x1, 0x5, 0x800}], 0x4) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCPKT(r0, 0x5420, &(0x7f00000001c0)=0xde40) read(r0, &(0x7f0000000040)=""/11, 0xffffff3a) r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/qat_adf_ctl\x00', 0x40100, 0x0) ioctl$SG_SET_COMMAND_Q(r1, 0x2271, &(0x7f00000000c0)) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) ioctl$FICLONERANGE(r0, 0x4020940d, &(0x7f0000000280)={r0, 0x0, 0x8, 0xd6}) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000140), &(0x7f0000000180)=0x8) ioctl$TIOCGETD(r0, 0x545d, &(0x7f0000000000)) 10:19:10 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:10 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x97db, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:10 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d76") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) 10:19:10 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0018404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:10 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getdents64(r0, &(0x7f0000000100)=""/111, 0x18) getdents(r0, &(0x7f0000000380)=""/246, 0x1a8) [ 747.339228] binder: 27089:27093 unknown command 1077942272 [ 747.345134] binder: 27089:27093 ioctl c0306201 20000440 returned -22 [ 747.355160] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 747.359596] binder_alloc: binder_alloc_mmap_handler: 27089 20001000-20004000 already mapped failed -16 [ 747.392376] binder: BINDER_SET_CONTEXT_MGR already set [ 747.409505] binder: 27089:27093 ioctl 40046207 0 returned -16 [ 747.423051] binder: 27089:27095 unknown command 1077942272 [ 747.433572] binder: 27089:27095 ioctl c0306201 20000440 returned -22 10:19:10 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d76") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) 10:19:10 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0xfdfdffff00000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 747.462277] QAT: Invalid ioctl 10:19:10 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x3b240000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:10 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0027404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) [ 747.524485] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 747.600346] binder: 27111:27113 unknown command 1077946112 [ 747.619773] binder: 27111:27113 ioctl c0306201 20000440 returned -22 10:19:10 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d7660") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) 10:19:10 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x9f010000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 747.663354] binder_alloc: binder_alloc_mmap_handler: 27111 20001000-20004000 already mapped failed -16 [ 747.726497] binder: 27111:27118 unknown command 1077946112 [ 747.727607] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 747.740958] binder: BINDER_SET_CONTEXT_MGR already set [ 747.758311] binder: 27111:27118 ioctl c0306201 20000440 returned -22 [ 747.792952] binder: 27111:27113 ioctl 40046207 0 returned -16 [ 748.192751] QAT: Invalid ioctl 10:19:11 executing program 5: semop(0x0, &(0x7f0000000080), 0x13) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000040)=""/11, 0xffffff3a) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) clone(0x200020fd, 0x0, 0xfffffffffffffffe, &(0x7f00000001c0), 0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000140), &(0x7f0000000180)=0x8) 10:19:11 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x80ffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:11 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x5b3b, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:11 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d7660") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) 10:19:11 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0463044000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:11 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socketpair$packet(0x11, 0x2, 0x300, &(0x7f0000000080)={0xffffffffffffffff}) fsetxattr$trusted_overlay_upper(r2, &(0x7f00000000c0)='trusted.overlay.upper\x00', &(0x7f0000000180)={0x0, 0xfb, 0x45, 0x1, 0x1, "e094d3b8cd89e10c4a232c13943e2579", "7deb555f30e2ee84ba274fe0715eafe23639a475fce5b41c29348ddee861d013fa4671a64f5a54dd24d4be3c1be825c4"}, 0x45, 0x3) ioctl$KVM_ASSIGN_SET_MSIX_NR(r0, 0x4008ae73, &(0x7f0000000240)={0x2, 0xfffffffffffff539}) getdents64(r1, &(0x7f0000000100)=""/111, 0x18) ioctl$BLKSECTGET(r0, 0x1267, &(0x7f0000000040)) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000200)='/proc/self/net/pfkey\x00', 0x4c0c0, 0x0) getdents(r1, &(0x7f0000000380)=""/246, 0xffffffff00000018) [ 748.239527] QAT: Invalid ioctl [ 748.297073] binder: 27137:27144 unknown command 38338560 [ 748.323854] binder: 27137:27144 ioctl c0306201 20000440 returned -22 10:19:11 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x752b, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 748.349434] binder_alloc: binder_alloc_mmap_handler: 27137 20001000-20004000 already mapped failed -16 [ 748.366002] binder: BINDER_SET_CONTEXT_MGR already set [ 748.373249] binder: 27137:27150 unknown command 38338560 [ 748.389026] binder: 27137:27144 ioctl 40046207 0 returned -16 10:19:11 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d7660") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) [ 748.407014] binder: 27137:27150 ioctl c0306201 20000440 returned -22 10:19:11 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0xffff8000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:11 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0005404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:11 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x10680000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 748.560168] binder: 27167:27169 unknown command 1077937408 [ 748.575508] binder: 27167:27169 ioctl c0306201 20000440 returned -22 10:19:11 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) [ 748.629433] binder_alloc: binder_alloc_mmap_handler: 27167 20001000-20004000 already mapped failed -16 [ 748.676514] binder: BINDER_SET_CONTEXT_MGR already set [ 748.705767] binder: 27167:27172 unknown command 1077937408 [ 748.706701] binder: 27167:27169 ioctl 40046207 0 returned -16 [ 748.715596] binder: 27167:27172 ioctl c0306201 20000440 returned -22 10:19:12 executing program 5: semop(0x0, &(0x7f0000000080), 0x13) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000040)=""/11, 0xffffff3a) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x18200, 0x4) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(0xffffffffffffff9c, 0x84, 0x72, &(0x7f00000000c0)={0x0, 0x8, 0x30}, &(0x7f00000001c0)=0xc) r3 = geteuid() syz_mount_image$f2fs(&(0x7f0000000300)='f2fs\x00', &(0x7f0000000340)='./file0\x00', 0x7, 0x6, &(0x7f0000000700)=[{&(0x7f0000000380)="4e0816bd37dd329731f9c30eb7b144e8b7edee9674167e1b7ed4bc134248b38b27990c3df0c847bf574fbcb3acd11431fa67edd0d80c5da631b864aaa6959667da54", 0x42, 0x6}, {&(0x7f0000000400)="6836166c0d092cd35dc76800078eea69b28d54dc60d836d1ad7e9a260da3ec4f2bfc4916529216033ff1f12a2e76d66c6de0739ece798123e0951d7e7aa5e7f54383cedd34cddb6e929441b5ecc8595141d45bcb324054d086a6d5f969e4bf0133ca685fe7a0b8451dee3218afed0c2fd9623fb144c9d447400a35769c41558bbd09ed9c7481f4b3227c849b10ef45b0eae14da5f8c1e83735afc8fe5ce866659d056a4da55f8550f2fa6b7d04ec359a09ad44b363855cdef5bd31d90af779b8848463efae00896a162a8500ea45b6a593a0691f31eea9456b52a48e4a29e7cf2dbd7906fcdac5d6", 0xe8, 0x7}, {&(0x7f0000000500)="c6f0316cf07bfc1c300eba5a033dacc896c0aed3861551c6d1e854ba4c0ae01f87e3c188324fbbc8bad24ff9a3e9a21016b10079030e15d3a1a3ad58b74c8e0e25ec89e0994e6997e4736abaef30", 0x4e, 0x7}, {&(0x7f0000000580)="6537593eb78a4cbd6f824206692d61a186e2b9fc36e1bdf6f45eae3e40c46908147447efc09404045c78170619d405887152745f", 0x34, 0x3}, {&(0x7f00000005c0)="5fec8d829f5f1efa2b411c536e7c9dab7f7d34b61bb13c5852dca3acc5fe90ed123d334938d7d9fcb15c655e", 0x2c, 0x101}, {&(0x7f0000000600)="40f7db26425b76813bd2e3a6ef5d0963ddce41060bd425da5603fdf7a932e06447f95833eaabcfe787c4b91249404ea475768a41e3125293ea1539dea9d93adc6cdae2c800f220a471e7c2ee9019313d0901a870d9068886a4dc344761fe89bb9c58a0cee7a68c977fa112184af27939773773b5a969c310220420e5d2c442c1b69a3d6caee19e21ff0be65de29f36b2ae7f63fed24443c64dd6538151f0fa07cbcd11ae9ac9abb4c8d96aab3c7f9a6eabb2b616c39fe1c485dfc860cb94a1c9e04a46f56d5abb12a749c8420363ea571b8855b45060331f28a64e9a405f2b5119e141dbc05e9acd146493ee024c11ebe88caaeae61d59998e", 0xf9, 0xffffffff}], 0x2, &(0x7f00000007c0)={[{@lfs_mode='mode=lfs'}], [{@subj_type={'subj_type', 0x3d, '/dev/ptmx\x00'}}, {@mask={'mask', 0x3d, 'MAY_WRITE'}}, {@euid_lt={'euid<', r3}}]}) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f0000000240)={r2, 0x3f, 0x1}, 0x8) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) getsockopt$inet_int(r1, 0x0, 0xb, &(0x7f0000000280), &(0x7f00000002c0)=0x4) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000140), &(0x7f0000000180)=0x8) ioctl$TIOCGETD(r0, 0x545d, &(0x7f0000000000)) 10:19:12 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) 10:19:12 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:12 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xb0db0000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:12 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0263404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:12 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00') sendmsg$IPVS_CMD_NEW_SERVICE(r0, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0x1c, r1, 0x3, 0x70bd2d, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x200}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) mprotect(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x4) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getdents64(r2, &(0x7f0000000100)=""/111, 0x18) getdents(r0, &(0x7f0000000300)=""/246, 0xf6) 10:19:12 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) 10:19:12 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xc8be, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 749.302352] binder: 27197:27202 unknown command 1077961474 [ 749.321392] binder: 27197:27202 ioctl c0306201 20000440 returned -22 [ 749.340228] binder_alloc: binder_alloc_mmap_handler: 27197 20001000-20004000 already mapped failed -16 [ 749.367828] binder: BINDER_SET_CONTEXT_MGR already set [ 749.379370] binder: 27197:27202 ioctl 40046207 0 returned -16 [ 749.390479] binder: 27197:27210 unknown command 1077961474 [ 749.401274] binder: 27197:27210 ioctl c0306201 20000440 returned -22 10:19:12 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x80ffff00000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:12 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040), 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) 10:19:12 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0019404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) [ 749.444200] F2FS-fs (loop5): Magic Mismatch, valid(0xf2f52010) - read(0x0) 10:19:12 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x1b0d, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 749.501525] F2FS-fs (loop5): Can't find valid F2FS filesystem in 1th superblock [ 749.549276] F2FS-fs (loop5): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 749.573009] F2FS-fs (loop5): Can't find valid F2FS filesystem in 2th superblock [ 749.588908] binder: 27225:27226 unknown command 1077942528 [ 749.621328] binder: 27225:27226 ioctl c0306201 20000440 returned -22 [ 749.639705] F2FS-fs (loop5): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 749.651165] binder_alloc: binder_alloc_mmap_handler: 27225 20001000-20004000 already mapped failed -16 [ 749.668762] F2FS-fs (loop5): Can't find valid F2FS filesystem in 1th superblock [ 749.681541] binder: BINDER_SET_CONTEXT_MGR already set [ 749.687346] F2FS-fs (loop5): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 749.694563] binder: 27225:27226 ioctl 40046207 0 returned -16 [ 749.701081] F2FS-fs (loop5): Can't find valid F2FS filesystem in 2th superblock [ 749.710124] binder: 27225:27237 unknown command 1077942528 [ 749.715979] binder: 27225:27237 ioctl c0306201 20000440 returned -22 10:19:13 executing program 5: r0 = semget(0x3, 0x9400e93cd609500a, 0x3fd) semop(r0, &(0x7f00000000c0)=[{0x1, 0x6, 0x1000}, {0x1, 0x30, 0x801}], 0x2) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) read(r1, &(0x7f0000000040)=""/11, 0xffffff3a) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x2400, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000100)) r2 = accept4(0xffffffffffffff9c, &(0x7f0000000240)=@generic, &(0x7f00000002c0)=0x80, 0x80800) sendmsg$nl_route(r2, &(0x7f0000000480)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000340)={&(0x7f00000003c0)=@mpls_delroute={0xa4, 0x19, 0x200, 0x70bd27, 0x25dfdbfe, {0x1c, 0x90, 0x0, 0x40e, 0xfd, 0x3, 0xfd, 0xf, 0x100}, [@RTA_TTL_PROPAGATE={0x8, 0x1a, 0x5}, @RTA_TTL_PROPAGATE={0x8, 0x1a, 0x8001}, @RTA_TTL_PROPAGATE={0x8, 0x1a, 0x8}, @RTA_DST={0x18, 0x1, [{0x4, 0x5, 0x2, 0xfff}, {0x10001, 0x0, 0xa, 0x6}, {0x0, 0x1000, 0x100, 0x8}, {0x611f, 0x8, 0x0, 0x9}, {0x6, 0x8001, 0x3, 0x8}]}, @RTA_TTL_PROPAGATE={0x8, 0x1a, 0x2}, @RTA_DST={0x18, 0x1, [{0x101, 0x1, 0x13e39249, 0x4}, {0x9, 0xa3c7, 0x7, 0x9}, {0x1f, 0x2, 0x80000001, 0x100000001}, {0xfffffffffffffff7, 0x20, 0x3, 0x4}, {0x8, 0xed, 0x3ff, 0x1}]}, @RTA_DST={0x10, 0x1, [{0x9, 0xff, 0x0, 0x43f4}, {0xcdd, 0x5, 0x5, 0x8}, {0x7f, 0xcd8, 0x8, 0x3ff}]}, @RTA_TTL_PROPAGATE={0x8, 0x1a, 0x9}, @RTA_DST={0x18, 0x1, [{0x6, 0x1, 0xffff, 0x1}, {0x80000001, 0x9, 0x8, 0x3}, {0xe701, 0x8, 0x9, 0x211}, {0x10000, 0x6, 0x200, 0x401}, {0x3f, 0x9, 0x7f, 0x3}]}, @RTA_TTL_PROPAGATE={0x8, 0x1a, 0x9}]}, 0xa4}, 0x1, 0x0, 0x0, 0x20008890}, 0x40000) clone(0x202020fe, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x100, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f00000001c0)=[@in={0x2, 0x4e21, @local}, @in={0x2, 0x4e20, @rand_addr=0xb5c5}], 0x20) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000140)={0x0}, &(0x7f0000000180)=0x8) ioctl$TCSETS(r3, 0x5402, &(0x7f0000000a80)={0x2, 0x8, 0x200, 0x80000000, 0x3, 0x401, 0x6, 0x8, 0x8, 0x1, 0x5, 0x7}) ioctl$TIOCGETD(r1, 0x545d, &(0x7f0000000380)) sendmsg$inet_sctp(r2, &(0x7f0000000a40)={&(0x7f00000004c0)=@in6={0xa, 0x4e21, 0x10001, @local, 0x770}, 0x1c, &(0x7f0000000900)=[{&(0x7f0000000500)="ea2399e207655b70a768abd141821a95efd2914698703c951df519bbc4edff3173e615ebeaaa070233fdc571415708cfeed80b584dcfb7b7bf133509e766f59ae77ee26ea7618c39d025e0db8473ca0e3124cc883b944d0069ad6651ed17efd9611379f4886f22f4da99a2e0256e90e39b8d49a0b4957e43b28541c93f", 0x7d}, {&(0x7f0000000580)="5f4e7e6f68b8546a7e68bb78906aaa20314cd6bb3523b292d813214875415f122e33c2b9dab2daaefd6d8946cd5b7c5621fcfb3e41fc200f2c7328391234d69c484e632c7d679db3f110ac1e4241ea0f75ba5beb0f600d518435b3fb6e1dfdceef4b556b59c09a34cdff47d9274857aaeb79a1ad9d8f1655e6ec9b34e8ee97a6c5103757dd9a6cf372fe4483f9d3fbb562700b534166007d2a6a796cb6253d1d3d6b8863dfe3f4f4e29da28353f1ae9c932a7b2f6d48e2be8af7d0354f466070ac228092e614f77a60ca485b5ad1bc2a8135", 0xd2}, {&(0x7f0000000680)="f70f8ed8865d129faf65803b8a256f2247d1767510245c148969e29fabea333c7038085d161fb9c31c8babbf819c464914a990729429a024322a5b29ff8672d4c432dbe6aa26ce7a738fe0360706d8caa702419bf5", 0x55}, {&(0x7f0000000700)="6ff19a4e54ff1179bf824d01086e93a500fac523b449b9a46c417417080761ec9622fb747f0cb97b7bfa931c8469804e4d354b3808ba4c88498bbeaa777db9c339bb4b884e9ee592a55d166332ea7ee296ed2cc80184844f674b6569fe2262b148d3f44964f5ec9d5402035dde5428c6ac7ba3", 0x73}, {&(0x7f0000000780)="0466326395a239433fc28368478ba99b2860eb9a0112ed601b538313e99a3978c128a3930318d7ceaa45e2bb1da56d5462da2847e85c1226e2c29c4ea74e1b18fc24b167b7f783589f94ba455452ccd1bddf5fddef6b8fcbe84a13bbddc8b597d5de44726b0522886011cbeb", 0x6c}, {&(0x7f0000000800)="d9ea1500cc68a3a79e10071acc11da0b6d2dd360fe0201c685aa414482c104038f426d18a76cee0146aae0624852aec84987809bb45de7a3e9940135e495526c54fe4f23b0f4fa59d2469214688249f2ef7472d0e678fcd7fcfaeaf96e67970ec4f06f3bdb64d2ccc0f2fa234ce97e4a0879986c535a83ed79b8da5eed0e29c440c581707777d89137349687e41b43ad9072533b08f3130afc9669b1bbf05eb2577c657484e7cb5634b25dbf525793e015f5e8fa1f680159c78864ab2dff633ce615503ff87af0b40bb6", 0xca}], 0x6, &(0x7f0000000980)=[@authinfo={0x18, 0x84, 0x6, {0xcd2d2f4}}, @init={0x18, 0x84, 0x0, {0xfff, 0x1000, 0x3ff, 0x2}}, @dstaddrv4={0x18, 0x84, 0x7, @multicast1}, @authinfo={0x18, 0x84, 0x6, {0x1}}, @sndrcv={0x30, 0x84, 0x1, {0x6, 0x20, 0x200, 0x91, 0x5, 0xdd7, 0x80000001, 0x1f, r4}}, @authinfo={0x18, 0x84, 0x6, {0x1}}, @dstaddrv4={0x18, 0x84, 0x7, @rand_addr=0x10000}], 0xc0, 0x800}, 0x40) 10:19:13 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000b30000/0x4000)=nil, 0x4000, 0x10004) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getdents64(0xffffffffffffffff, &(0x7f0000000100)=""/111, 0x18) sendto$unix(r0, &(0x7f0000000240)="4dadb5cff1be0dc0df81d4592a8d4fdc0bdaaea988ba24cce62f3c839ef5576103f726616efd0f129e7b22e40e6bc174c3a021a2662a057b6ac8f1ac7699eb415ea684", 0x43, 0x10, 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f00000002c0)={0x100, 0x40, 0x1ff}, 0xc) renameat(r0, &(0x7f00000001c0)='./file0\x00', r0, &(0x7f0000000200)='./file0\x00') openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000300)='/dev/vga_arbiter\x00', 0x8801, 0x0) ppoll(&(0x7f0000000040)=[{r0, 0x8000}, {r0, 0x10}], 0x2, &(0x7f00000000c0)={r1, r2+10000000}, &(0x7f0000000180)={0x100000001}, 0x8) getdents(r0, &(0x7f0000000480)=""/246, 0xf6) 10:19:13 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x189c000000000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:13 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040), 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) 10:19:13 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="6863404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:13 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 750.178896] F2FS-fs (loop5): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 750.186133] F2FS-fs (loop5): Can't find valid F2FS filesystem in 1th superblock 10:19:13 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x20d0000000000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:13 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040), 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) [ 750.289806] binder: 27252:27260 unknown command 1077961576 [ 750.310239] binder: 27252:27260 ioctl c0306201 20000440 returned -22 [ 750.325123] binder_alloc: binder_alloc_mmap_handler: 27252 20001000-20004000 already mapped failed -16 10:19:13 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x3f00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 750.384298] binder: BINDER_SET_CONTEXT_MGR already set [ 750.429441] binder: 27252:27260 ioctl 40046207 0 returned -16 [ 750.452121] binder: 27252:27266 unknown command 1077961576 10:19:13 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(0xffffffffffffffff, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) [ 750.477323] binder: 27252:27266 ioctl c0306201 20000440 returned -22 10:19:13 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="4863404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:13 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xfbae, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 750.652123] binder: 27288:27292 unknown command 1077961544 [ 750.662655] binder: 27288:27292 ioctl c0306201 20000440 returned -22 [ 750.680621] binder: BINDER_SET_CONTEXT_MGR already set [ 750.687539] binder: 27288:27294 unknown command 1077961544 [ 750.700303] binder: 27288:27292 ioctl 40046207 0 returned -16 [ 750.712594] binder: 27288:27294 ioctl c0306201 20000440 returned -22 10:19:14 executing program 5: semop(0x0, &(0x7f0000000080), 0x13) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000040)=""/11, 0xffffff3a) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) ioctl$TIOCGWINSZ(r0, 0x5413, &(0x7f0000000080)) fsetxattr$trusted_overlay_redirect(r0, &(0x7f00000005c0)='trusted.overlay.redirect\x00', &(0x7f0000000600)='./file0\x00', 0x8, 0x2) stat(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r0, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0, 0x0}) openat$vhci(0xffffffffffffff9c, &(0x7f0000000640)='/dev/vhci\x00', 0x44580, 0x0) syz_mount_image$msdos(&(0x7f00000000c0)='msdos\x00', &(0x7f00000001c0)='./file0\x00', 0x2, 0x3, &(0x7f0000000380)=[{&(0x7f0000000240)="cbb982599b4f660cee4dcf24777d8a4be49ffdf4f918ffdfc5f1322f5f480ff8eb180a", 0x23, 0x3}, {&(0x7f0000000280)="10839becd8a91e51d8f601e7c1357d9ba461781216bdff6cd1d2e523c96287fe4a79983ac95ccd3162a91c845ed68cc6bad0cc65b1b1932d1a632c5c03909b3bd565aeed2a", 0x45}, {&(0x7f0000000300)="050ca8b2c41bd431809db9628fe106f16637e846f4d73e5acec595316b93695fcbef758c9ae759e1fe6ddf9ffc178a1de75211672efaad49fba76eef260d9d966ed9c96a24a934fc676e779c06656ef0dac79ede6056c92734011045ce4a9df0fc382536a7ad93a7cde8bbf03bdea8fee055a73fde6b78a0397496aa3e6c63", 0x7f}], 0x800000, &(0x7f0000000540)={[{@fat=@codepage={'codepage', 0x3d, '864'}}, {@nodots='nodots'}, {@dots='dots'}, {@fat=@gid={'gid', 0x3d, r1}}, {@dots='dots'}, {@fat=@errors_continue='errors=continue'}], [{@uid_eq={'uid', 0x3d, r2}}]}) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000140), &(0x7f0000000180)=0x8) ioctl$TIOCGETD(r0, 0x545d, &(0x7f0000000000)) 10:19:14 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0xffff8000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:14 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(0xffffffffffffffff, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) 10:19:14 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xe81c0000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:14 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b63000000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) [ 751.198802] binder: 27310:27312 ERROR: BC_REGISTER_LOOPER called without request [ 751.234595] binder: 27310:27312 unknown command 0 [ 751.249867] binder: 27310:27312 ioctl c0306201 20000440 returned -22 [ 751.268963] binder_alloc_mmap_handler: 1 callbacks suppressed [ 751.268981] binder_alloc: binder_alloc_mmap_handler: 27310 20001000-20004000 already mapped failed -16 [ 751.310234] binder: BINDER_SET_CONTEXT_MGR already set [ 751.322581] binder: 27310:27312 ioctl 40046207 0 returned -16 [ 751.331840] binder: 27310:27320 ERROR: BC_REGISTER_LOOPER called without request [ 751.346053] binder: 27310:27320 unknown command 0 [ 751.352266] binder: 27310:27320 ioctl c0306201 20000440 returned -22 10:19:14 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(0xffffffffffffffff, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) 10:19:14 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xcb2f0000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:14 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffdfd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:14 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f00002c8000/0x4000)=nil, 0x4000, 0x3, 0x8032, r0, 0xffffffffffffffff) getdents64(r0, &(0x7f0000000100)=""/111, 0x18) getdents(r0, &(0x7f0000000380)=""/246, 0xffffffff00000018) 10:19:14 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0053404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:14 executing program 5: semop(0x0, &(0x7f0000000080), 0x13) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000040)=""/11, 0xffffff3a) socketpair(0x11, 0xa, 0x6, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f0000000280)={0x0, @rand_addr, @multicast2}, &(0x7f00000002c0)=0xc) ioctl$sock_inet6_SIOCADDRT(r1, 0x890b, &(0x7f0000000300)={@dev={0xfe, 0x80, [], 0xf}, @mcast1, @dev={0xfe, 0x80, [], 0x14}, 0x3, 0x1, 0x9, 0x400, 0x2, 0x80010000, r2}) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000140), &(0x7f0000000180)=0x8) ioctl$TIOCGETD(r0, 0x545d, &(0x7f0000000000)) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000080)='/dev/zero\x00', 0x1, 0x0) ioctl$KVM_XEN_HVM_CONFIG(r3, 0x4038ae7a, &(0x7f0000000240)={0x5, 0x9ac, &(0x7f00000000c0), &(0x7f00000001c0)="ae852601170e71e585ad444151eb8abb", 0x0, 0x10}) [ 751.492663] binder: 27334:27336 unknown command 1077957376 [ 751.521865] binder: 27334:27336 ioctl c0306201 20000440 returned -22 10:19:14 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x1392, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:14 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) 10:19:14 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff00000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 751.546636] binder_alloc: binder_alloc_mmap_handler: 27334 20001000-20004000 already mapped failed -16 10:19:14 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) syz_open_dev$dspn(&(0x7f0000000080)='/dev/dsp#\x00', 0x27d837ed, 0x101001) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, r1, 0x0) getdents64(r1, &(0x7f0000000100)=""/111, 0x18) ioctl$SNDRV_CTL_IOCTL_TLV_COMMAND(r0, 0xc008551c, &(0x7f0000000040)={0x1, 0x10, [0xffffffff, 0x8cd, 0xdd, 0xfffffffffffffff8]}) getdents(r1, &(0x7f0000000380)=""/246, 0xffffffff00000018) 10:19:14 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x73a0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 751.697439] binder: BINDER_SET_CONTEXT_MGR already set [ 751.698926] binder: 27334:27346 unknown command 1077957376 [ 751.717293] binder: 27334:27336 ioctl 40046207 0 returned -16 10:19:14 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) 10:19:14 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 751.754826] binder: 27334:27346 ioctl c0306201 20000440 returned -22 10:19:15 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0042404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:15 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x2017000000000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:15 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) [ 751.897484] binder: 27379:27382 unknown command 1077953024 [ 751.922437] binder: 27379:27382 ioctl c0306201 20000440 returned -22 10:19:15 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 751.945199] binder_alloc: binder_alloc_mmap_handler: 27379 20001000-20004000 already mapped failed -16 [ 751.988883] binder: BINDER_SET_CONTEXT_MGR already set [ 752.000846] binder: 27379:27382 ioctl 40046207 0 returned -16 [ 752.018466] binder: 27379:27386 unknown command 1077953024 [ 752.033899] binder: 27379:27386 ioctl c0306201 20000440 returned -22 10:19:15 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xdc050000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:15 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d7660") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) 10:19:15 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0030404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:15 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:15 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f0000000040)=0xfffffffffffffffd, 0x4) ioctl$KVM_CREATE_PIT2(r0, 0x4040ae77, &(0x7f0000000280)={0x8}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f0000000080)=0xfff, 0x4) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getdents64(r1, &(0x7f0000000100)=""/111, 0x18) getdents(r0, &(0x7f0000000180)=""/246, 0xffffffffffffff1a) ioctl$GIO_FONT(r0, 0x4b60, &(0x7f00000000c0)=""/21) 10:19:15 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x0, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) [ 752.443286] binder: 27408:27409 unknown command 1077948416 10:19:15 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x0, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) 10:19:15 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xbb80000000000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 752.495111] binder: 27408:27409 ioctl c0306201 20000440 returned -22 [ 752.524320] binder_alloc: binder_alloc_mmap_handler: 27408 20001000-20004000 already mapped failed -16 [ 752.563389] net_ratelimit: 2 callbacks suppressed [ 752.563401] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. 10:19:15 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x284b, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:15 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x80ffff00000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:15 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x0, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) [ 752.646905] binder: BINDER_SET_CONTEXT_MGR already set [ 752.656004] binder: 27408:27419 unknown command 1077948416 [ 752.666340] binder: 27408:27409 ioctl 40046207 0 returned -16 [ 752.701756] binder: 27408:27419 ioctl c0306201 20000440 returned -22 10:19:15 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="6063404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:15 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x80ffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:15 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) 10:19:16 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x84f8, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:16 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 752.853191] binder: 27443:27444 unknown command 1077961568 [ 752.928267] binder: 27443:27444 ioctl c0306201 20000440 returned -22 [ 752.964266] binder_alloc: binder_alloc_mmap_handler: 27443 20001000-20004000 already mapped failed -16 [ 753.045205] binder: BINDER_SET_CONTEXT_MGR already set [ 753.050919] binder: 27443:27453 unknown command 1077961568 [ 753.065473] binder: 27443:27444 ioctl 40046207 0 returned -16 [ 753.071999] binder: 27443:27453 ioctl c0306201 20000440 returned -22 10:19:16 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xd1b, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:16 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) 10:19:16 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d76") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) 10:19:16 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0d63000000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:16 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x80ffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:16 executing program 4: syz_open_dev$adsp(&(0x7f0000000340)='/dev/adsp#\x00', 0x74ad, 0x400000) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x4000, 0x0) ioctl$GIO_SCRNMAP(r0, 0x4b40, &(0x7f0000000280)=""/158) r1 = syz_open_dev$dspn(&(0x7f0000000040)='/dev/dsp#\x00', 0x8000, 0x240000) ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(r1, 0xc0a85322, &(0x7f0000000180)) r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000a22000/0x2000)=nil, 0x2000, 0x80000000000a) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f0000000480)={0x28, 0x3, 0x0, {0x6, 0x7, 0x0, ':.ppp1/'}}, 0x28) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) getsockopt$inet_mreqn(r2, 0x0, 0x23, &(0x7f0000000080)={@rand_addr, @loopback}, &(0x7f00000000c0)=0xc) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) sysfs$3(0x3) getdents64(r3, &(0x7f0000000100)=""/111, 0x18) getdents(r3, &(0x7f0000000380)=""/246, 0xffffffff00000018) ioctl$PPPOEIOCDFWD(r2, 0xb101, 0x0) [ 753.309414] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 753.349842] binder: 27473:27477 unknown command 0 10:19:16 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x53070000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 753.382464] binder: 27473:27477 ioctl c0306201 20000440 returned -22 10:19:16 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) [ 753.438702] binder_alloc: binder_alloc_mmap_handler: 27473 20001000-20004000 already mapped failed -16 10:19:16 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:16 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d76") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) [ 753.482809] binder: BINDER_SET_CONTEXT_MGR already set [ 753.490238] binder: 27473:27482 unknown command 0 [ 753.508076] binder: 27473:27482 ioctl c0306201 20000440 returned -22 10:19:16 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xbb80, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 753.549760] binder: 27473:27477 ioctl 40046207 0 returned -16 10:19:16 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) 10:19:16 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0046404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) [ 753.617233] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. 10:19:16 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:16 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x9da3, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 753.762262] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 753.786585] binder: 27506:27507 unknown command 1077954048 10:19:17 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488d") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) [ 753.808249] binder: 27506:27507 ioctl c0306201 20000440 returned -22 10:19:17 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) [ 753.848514] binder_alloc: binder_alloc_mmap_handler: 27506 20001000-20004000 already mapped failed -16 [ 753.904337] binder: BINDER_SET_CONTEXT_MGR already set [ 753.930982] binder: 27506:27507 ioctl 40046207 0 returned -16 [ 753.946866] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 753.967966] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 753.997512] binder: 27506:27521 unknown command 1077954048 [ 754.024314] binder: 27506:27521 ioctl c0306201 20000440 returned -22 10:19:17 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getdents64(r0, &(0x7f0000000100)=""/111, 0x18) open$dir(&(0x7f0000000040)='./file0\x00', 0x402080, 0x0) getdents(r0, &(0x7f0000000380)=""/246, 0xffffffff00000018) 10:19:17 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:17 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xa073000000000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:17 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) 10:19:17 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="000f404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:17 executing program 5: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xe3cb0000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 754.208133] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. 10:19:17 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xc08a0000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 754.248951] binder: 27539:27540 unknown command 1077939968 [ 754.259267] binder: 27539:27540 ioctl c0306201 20000440 returned -22 [ 754.285965] binder_alloc: binder_alloc_mmap_handler: 27539 20001000-20004000 already mapped failed -16 [ 754.320546] binder: BINDER_SET_CONTEXT_MGR already set 10:19:17 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) 10:19:17 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff8000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 754.347437] binder: 27539:27547 unknown command 1077939968 [ 754.375107] binder: 27539:27540 ioctl 40046207 0 returned -16 10:19:17 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x0, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) 10:19:17 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xa000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 754.418001] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 754.447885] binder: 27539:27547 ioctl c0306201 20000440 returned -22 10:19:17 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) [ 754.590545] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 754.646691] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. 10:19:17 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x5307, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:17 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0034404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:17 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff00000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:17 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) 10:19:17 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x4000, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getdents64(r0, &(0x7f0000000100)=""/111, 0x18) getdents(r0, &(0x7f0000000380)=""/246, 0xffffffff00000018) 10:19:17 executing program 5: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x23fa0000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 754.829767] binder: 27582:27584 unknown command 1077949440 10:19:18 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x7968, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 754.874939] binder: 27582:27584 ioctl c0306201 20000440 returned -22 [ 754.906170] binder_alloc: binder_alloc_mmap_handler: 27582 20001000-20004000 already mapped failed -16 10:19:18 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x10, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) 10:19:18 executing program 5: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x23fa0000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 754.946234] binder: BINDER_SET_CONTEXT_MGR already set [ 754.965585] binder: 27582:27596 unknown command 1077949440 [ 754.978975] binder: 27582:27584 ioctl 40046207 0 returned -16 10:19:18 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 754.996420] binder: 27582:27596 ioctl c0306201 20000440 returned -22 10:19:18 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="7463404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:18 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x39d0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 755.133312] binder: 27612:27613 unknown command 1077961588 [ 755.167748] binder: 27612:27613 ioctl c0306201 20000440 returned -22 10:19:18 executing program 5: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x23fa0000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 755.198686] binder_alloc: binder_alloc_mmap_handler: 27612 20001000-20004000 already mapped failed -16 10:19:18 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x40e70000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 755.251481] binder: BINDER_SET_CONTEXT_MGR already set [ 755.251794] binder: 27612:27619 unknown command 1077961588 [ 755.288686] binder: 27612:27613 ioctl 40046207 0 returned -16 [ 755.294614] binder: 27612:27619 ioctl c0306201 20000440 returned -22 10:19:18 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:18 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x10, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) 10:19:18 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0040404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:18 executing program 5: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x23fa0000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:18 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xfd, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:18 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:18 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x10, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) 10:19:18 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f00000000c0)="2f70726f632f73ff7327eb00000e00000000742c072f6578706972655b282dbe6573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mknod(&(0x7f0000000040)='./file0\x00', 0x1, 0xffffff7a) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getdents64(r1, &(0x7f0000000100)=""/111, 0x18) getdents(r1, &(0x7f0000000380)=""/246, 0xffffffff00000018) mkdirat(r0, &(0x7f0000000080)='./file1\x00', 0x102) [ 755.691413] binder: 27645:27655 unknown command 1077952512 [ 755.704251] binder: 27645:27655 ioctl c0306201 20000440 returned -22 [ 755.735088] binder: BINDER_SET_CONTEXT_MGR already set 10:19:18 executing program 5: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x23fa0000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:19 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x5811000000000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 755.755302] binder: 27645:27657 unknown command 1077952512 [ 755.772574] binder: 27645:27655 ioctl 40046207 0 returned -16 [ 755.775378] binder: 27645:27657 ioctl c0306201 20000440 returned -22 10:19:19 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:19 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x0, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) 10:19:19 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x32a0000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:19 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0061404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:19 executing program 5: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x23fa0000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:19 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x10, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) [ 756.050349] binder: 27680:27681 unknown command 1077960960 [ 756.080982] binder: 27680:27681 ioctl c0306201 20000440 returned -22 10:19:19 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80ffff00000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:19 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x3bdd, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:19 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) [ 756.169747] binder: BINDER_SET_CONTEXT_MGR already set [ 756.175201] binder: 27680:27681 ioctl 40046207 0 returned -16 [ 756.229969] binder: 27680:27687 unknown command 1077960960 [ 756.277550] binder: 27680:27687 ioctl c0306201 20000440 returned -22 10:19:19 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x33a9, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:19 executing program 5: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) preadv(0xffffffffffffffff, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x23fa0000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:19 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:19 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0033404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:19 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(0xffffffffffffffff, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) 10:19:19 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) socketpair$inet6_dccp(0xa, 0x6, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$DRM_IOCTL_RES_CTX(r0, 0xc0106426, &(0x7f0000000080)={0x1, &(0x7f0000000040)=[{0x0}]}) ioctl$KVM_SET_ONE_REG(r0, 0x4010aeac, &(0x7f0000000180)={0x0, 0x6}) getsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000240), 0x10) ioctl$DRM_IOCTL_GET_CTX(r0, 0xc0086423, &(0x7f00000000c0)={r3, 0x1}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getdents64(r1, &(0x7f0000000100)=""/111, 0x18) getdents(r1, &(0x7f0000000380)=""/246, 0xffffffff00000018) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/vhost-vsock\x00', 0x2, 0x0) 10:19:19 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x5811, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 756.622924] binder: 27713:27714 unknown command 1077949184 [ 756.649846] binder: 27713:27714 ioctl c0306201 20000440 returned -22 10:19:19 executing program 5: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) preadv(0xffffffffffffffff, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x23fa0000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 756.683354] binder_alloc_mmap_handler: 2 callbacks suppressed [ 756.683371] binder_alloc: binder_alloc_mmap_handler: 27713 20001000-20004000 already mapped failed -16 10:19:19 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:19 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) sendto$inet(r0, &(0x7f0000fd0000), 0x0, 0x200007ff, &(0x7f0000deaff0)={0x2, 0x3, @local}, 0x10) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000080)=0xed8, 0x4) sendto$inet(r0, &(0x7f00000004c0)='&', 0x1, 0x0, 0x0, 0x0) [ 756.763696] binder: BINDER_SET_CONTEXT_MGR already set 10:19:20 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x8bba, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 756.826393] binder: 27713:27724 unknown command 1077949184 [ 756.865854] binder: 27713:27714 ioctl 40046207 0 returned -16 10:19:20 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000040)=""/11, 0xffffff3a) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) ioctl$TIOCGETD(r0, 0x545d, &(0x7f0000000000)) 10:19:20 executing program 5: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) preadv(0xffffffffffffffff, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x23fa0000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 756.914075] binder: 27713:27724 ioctl c0306201 20000440 returned -22 10:19:20 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0038404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:20 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80ffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:20 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x5e0b, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:20 executing program 5: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r1, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x23fa0000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 757.122737] binder: 27758:27760 unknown command 1077950464 [ 757.165917] binder: 27758:27760 ioctl c0306201 20000440 returned -22 [ 757.199709] binder_alloc: binder_alloc_mmap_handler: 27758 20001000-20004000 already mapped failed -16 [ 757.234369] binder: BINDER_SET_CONTEXT_MGR already set [ 757.241447] binder: 27758:27767 unknown command 1077950464 [ 757.275468] binder: 27758:27760 ioctl 40046207 0 returned -16 [ 757.290338] binder: 27758:27767 ioctl c0306201 20000440 returned -22 10:19:20 executing program 5: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r1, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x23fa0000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:20 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xe81c000000000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:20 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:20 executing program 4: getxattr(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)=@known='system.posix_acl_default\x00', &(0x7f0000000480)=""/15, 0xf) r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$KVM_GET_SREGS(r0, 0x8138ae83, &(0x7f00000004c0)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getdents64(r1, &(0x7f0000000100)=""/111, 0x18) getdents(r1, &(0x7f0000000380)=""/246, 0xffffffff00000018) ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000180)=ANY=[@ANYRES32=r0, @ANYRES32=r0, @ANYBLOB="2000a10000000000", @ANYPTR=&(0x7f0000000040)=ANY=[@ANYBLOB="5dca0886ea36f7facd0daacc39cb5a8d2f2ebcf6f962248803b31b29520bd8700506977964394eda5a741436df65c84727cbe91e0f39df78ba6aed13a2d2868fa7b8fe551ad567521ed4f09da4"], @ANYBLOB="400507000800030006000000d00200007831129ba33c56ed6ed8984b9ff777fab22d9e8f1037b6871040ecd5af45a6358148e5ce459757db0a5b1536870b794369daa330e0d5a68dc9070ad060c6bfa114bc5c51cddbfe11b8e821fce981c2b4cbceab7bcdc433282aa13580f60b170b3b7b7621e9bd592e0884cddf05b56e7aec2e5664d3"]) getsockopt$inet_sctp_SCTP_AUTO_ASCONF(r0, 0x84, 0x1e, &(0x7f00000000c0), &(0x7f0000000240)=0x4) write$FUSE_STATFS(r0, &(0x7f0000000280)={0x60, 0xffffffffffffffda, 0x4, {{0x6, 0x3, 0x7fffffff, 0x1, 0x1, 0x22767a63, 0x1, 0x4}}}, 0x60) 10:19:20 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1263404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) [ 757.516213] binder: 27779:27783 unknown command 1077961490 [ 757.542898] binder: 27779:27783 ioctl c0306201 20000440 returned -22 10:19:20 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x2000000000000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 757.583722] binder_alloc: binder_alloc_mmap_handler: 27779 20001000-20004000 already mapped failed -16 [ 757.636456] binder: BINDER_SET_CONTEXT_MGR already set [ 757.644524] binder: 27779:27792 unknown command 1077961490 [ 757.694325] binder: 27779:27783 ioctl 40046207 0 returned -16 [ 757.714496] binder: 27779:27792 ioctl c0306201 20000440 returned -22 10:19:21 executing program 0: openat(0xffffffffffffffff, &(0x7f00000000c0)='./file0\x00', 0x8, 0x15b) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x8, 0x800) 10:19:21 executing program 5: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r1, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x23fa0000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:21 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffdfd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:21 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xb9000000000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:21 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0963104000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) [ 757.934340] binder: 27815:27816 BC_ACQUIRE_DONE u0249000000000000 no match [ 757.979206] binder: 27815:27816 unknown command 0 10:19:21 executing program 5: r0 = socket(0x40000000002, 0x3, 0x67) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x23fa0000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:21 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xf8840000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:21 executing program 0: clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) lstat(&(0x7f0000000280)='./control/file0\x00', &(0x7f00000002c0)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = inotify_init1(0x800) inotify_add_watch(r0, &(0x7f0000001d40)='./file0\x00', 0x0) execveat(0xffffffffffffffff, &(0x7f0000000380)='./control\x00', &(0x7f0000000640)=[&(0x7f00000003c0)='bdev\x00', &(0x7f0000000400)='$@trusted&\x00', &(0x7f0000000440)='cpuset\x00', &(0x7f0000000540)='-[lo\x00', &(0x7f0000000600)='++cpuset.security\x00'], &(0x7f00000008c0)=[&(0x7f00000006c0)='++cpuset.security\x00', &(0x7f0000000700)='\\-\x00', &(0x7f0000000740)='{\x00', &(0x7f0000000780)='}GPL\\GPLem1mime_type\x00', &(0x7f00000007c0)='\x00', &(0x7f0000000800)="76626f786e657431ce656d3076626f786e65743000", &(0x7f0000000840)='++cpuset.security\x00', &(0x7f0000000880)='vboxnet1GPL\\em0lo\\\x00'], 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0x4) mkdir(&(0x7f0000000180)='./control\x00', 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000340)='./control/file0\x00', 0x2, 0x1) r1 = creat(&(0x7f0000000040)='./control/file0\x00', 0x3) clock_gettime(0x0, &(0x7f0000008700)={0x0, 0x0}) recvmmsg(r1, &(0x7f0000008500)=[{{&(0x7f0000000900)=@ll, 0x80, &(0x7f0000001a40)=[{&(0x7f0000000980)=""/106, 0x6a}, {&(0x7f0000000a00)}, {&(0x7f0000000a40)=""/4096, 0x1000}], 0x3, &(0x7f0000001a80)=""/196, 0xc4}, 0x10001}, {{&(0x7f0000001b80)=@ax25, 0x80, &(0x7f0000001f00)=[{&(0x7f0000001c00)=""/171, 0xab}, {&(0x7f0000001d80)=""/204, 0xcc}, {&(0x7f0000001e80)=""/102, 0x66}], 0x3}, 0x2}, {{&(0x7f0000001f40)=@pppoe, 0x80, &(0x7f0000003480)=[{&(0x7f0000001fc0)=""/43, 0x2b}, {&(0x7f0000002000)=""/4096, 0x1000}, {&(0x7f0000003000)=""/106, 0x6a}, {&(0x7f0000003080)=""/134, 0x86}, {&(0x7f0000003140)=""/186, 0xba}, {&(0x7f0000003200)=""/196, 0xc4}, {&(0x7f0000003300)=""/159, 0x9f}, {&(0x7f00000033c0)=""/143, 0x8f}], 0x8, &(0x7f0000003500)=""/158, 0x9e, 0x3}, 0x20}, {{&(0x7f00000057c0)=@hci, 0x80, &(0x7f0000006b80)=[{&(0x7f0000005840)=""/116, 0x74}, {&(0x7f0000005900)=""/141, 0x8d}, {&(0x7f0000005a00)=""/18, 0x12}, {&(0x7f0000005a40)=""/4096, 0x1000}, {&(0x7f0000006a40)=""/18, 0x12}, {&(0x7f0000006b40)=""/60, 0x3c}], 0x6, &(0x7f0000006c40)=""/94, 0x5e, 0x18000000}}, {{&(0x7f0000006cc0)=@ipx, 0x80, &(0x7f0000007e80)=[{&(0x7f0000006d40)=""/4096, 0x1000}, {&(0x7f0000007e40)=""/60, 0x3c}], 0x2, &(0x7f0000007ec0)=""/251, 0xfb, 0x3ba}}, {{0x0, 0x0, &(0x7f00000083c0)=[{&(0x7f0000008140)=""/150, 0x96}, {&(0x7f0000008200)=""/102, 0x66}, {&(0x7f0000008280)}, {&(0x7f00000082c0)=""/24, 0x18}, {&(0x7f0000008300)=""/153, 0x99}], 0x5, &(0x7f0000008440)=""/146, 0x92}, 0xffffffff}], 0x6, 0x40000040, &(0x7f0000008740)={r2, r3+30000000}) write$binfmt_script(r1, &(0x7f0000000000)=ANY=[@ANYRESOCT], 0x17) close(r1) unlink(&(0x7f0000000200)='./control/file0\x00') socket(0x0, 0x6, 0x0) r4 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x801, 0x0) ioctl$SNDRV_TIMER_IOCTL_INFO(r1, 0x80e85411, &(0x7f0000001cc0)=""/12) ioctl$UI_DEV_SETUP(r4, 0x5501, &(0x7f00000001c0)={{0x0, 0x0, 0x2, 0x3}, "73797a2a000000000000007ad300000000000000000000000022000000000000001000"}) r5 = syz_open_dev$rtc(&(0x7f0000000a00)='/dev/rtc#\x00', 0xfffffffffffeffff, 0x200) fcntl$notify(r5, 0x402, 0x0) [ 758.005584] binder: 27815:27816 ioctl c0306201 20000440 returned -22 [ 758.045683] binder_alloc: binder_alloc_mmap_handler: 27815 20001000-20004000 already mapped failed -16 10:19:21 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffdfd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 758.092816] binder: BINDER_SET_CONTEXT_MGR already set [ 758.111333] binder: 27815:27821 BC_ACQUIRE_DONE u0249000000000000 no match [ 758.174679] binder: 27815:27816 ioctl 40046207 0 returned -16 [ 758.227087] binder: 27815:27821 unknown command 0 [ 758.259997] binder: 27815:27821 ioctl c0306201 20000440 returned -22 10:19:21 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x3, 0x0) ioctl$TIOCGSID(r1, 0x5429, &(0x7f0000000040)=0x0) ptrace$setopts(0x4200, r2, 0x0, 0x100060) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getdents64(r0, &(0x7f0000000280)=""/111, 0x6f) 10:19:21 executing program 5: setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r1 = openat$cgroup_ro(r0, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r1, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(0xffffffffffffffff, &(0x7f0000000080), 0xffeb, 0x23fa0000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:21 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:21 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x9335, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:21 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0062404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:21 executing program 0: clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) lstat(&(0x7f0000000280)='./control/file0\x00', &(0x7f00000002c0)) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = inotify_init1(0x800) inotify_add_watch(r1, &(0x7f0000001d40)='./file0\x00', 0x4) execveat(0xffffffffffffffff, &(0x7f0000000380)='./control\x00', &(0x7f0000000640)=[&(0x7f00000003c0)='bdev\x00', &(0x7f0000000400)='$@trusted&\x00', &(0x7f0000000440)='cpuset\x00', &(0x7f0000000480)='++cpuset.security\x00', &(0x7f00000004c0)='em1\x00', &(0x7f0000000500)="bf7b00", &(0x7f0000000540)='-[lo\x00'], &(0x7f00000008c0)=[&(0x7f00000006c0)='++cpuset.security\x00', &(0x7f0000000700)='\\-\x00', &(0x7f0000000740)='{\x00', &(0x7f0000000780)='}GPL\\GPLem1mime_type\x00', &(0x7f00000007c0)='\x00', &(0x7f0000000800)="76626f786e657431ce656d3076626f786e65743000", &(0x7f0000000840)='++cpuset.security\x00', &(0x7f0000000880)='vboxnet1GPL\\em0lo\\\x00'], 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0x4) mkdir(&(0x7f0000000180)='./control\x00', 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000340)='./control/file0\x00', 0x2, 0x1) r2 = creat(&(0x7f0000000040)='./control/file0\x00', 0x3) clock_gettime(0x0, &(0x7f0000008700)={0x0, 0x0}) recvmmsg(r2, &(0x7f0000008500)=[{{&(0x7f0000000900)=@ll, 0x80, &(0x7f0000001a40)=[{&(0x7f0000000980)=""/106, 0x6a}, {&(0x7f0000000a00)}, {&(0x7f0000000a40)=""/4096, 0x1000}], 0x3, &(0x7f0000001a80)=""/196, 0xc4}, 0x10001}, {{&(0x7f0000001b80)=@ax25, 0x80, &(0x7f0000001f00)=[{&(0x7f0000001c00)=""/171, 0xab}, {&(0x7f0000001d80)=""/204, 0xcc}, {&(0x7f0000001e80)=""/102, 0x66}], 0x3}, 0x2}, {{&(0x7f0000001f40)=@pppoe, 0x80, &(0x7f0000003480)=[{&(0x7f0000001fc0)=""/43, 0x2b}, {&(0x7f0000002000)=""/4096, 0x1000}, {&(0x7f0000003000)=""/106, 0x6a}, {&(0x7f0000003080)=""/134, 0x86}, {&(0x7f0000003140)=""/186, 0xba}, {&(0x7f0000003200)=""/196, 0xc4}, {&(0x7f0000003300)=""/159, 0x9f}, {&(0x7f00000033c0)=""/143, 0x8f}], 0x8, &(0x7f0000003500)=""/158, 0x9e, 0x3}, 0x20}, {{&(0x7f00000035c0)=@nl, 0x80, &(0x7f0000005700)=[{&(0x7f0000003640)=""/4096, 0x1000}, {&(0x7f0000004640)=""/188, 0xbc}, {&(0x7f0000004700)=""/4096, 0x1000}], 0x3, &(0x7f0000005740)=""/87, 0x57, 0x1}, 0x9}, {{&(0x7f0000006cc0)=@ipx, 0x80, &(0x7f0000007e80)=[{&(0x7f0000006d40)=""/4096, 0x1000}, {&(0x7f0000007e40)=""/60, 0x3c}], 0x2, &(0x7f0000007ec0)=""/251, 0xfb}, 0x628}, {{&(0x7f0000007fc0)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @ipv4={[], [], @remote}}}}, 0x80, &(0x7f0000008080)=[{&(0x7f0000008040)=""/16, 0x10}], 0x1, &(0x7f00000080c0)=""/12, 0xc}, 0x1}, {{0x0, 0x0, &(0x7f00000083c0)=[{&(0x7f0000008100)=""/20, 0x14}, {&(0x7f0000008140)=""/150, 0x96}, {&(0x7f0000008200)=""/102, 0x66}, {&(0x7f0000008280)}, {&(0x7f00000082c0)=""/24, 0x18}, {&(0x7f0000008300)=""/153, 0x99}], 0x6, &(0x7f0000008440)=""/146, 0x92, 0x40}, 0xffffffff}], 0x7, 0x40000040, &(0x7f0000008740)={r3, r4+30000000}) write$binfmt_script(r2, &(0x7f0000000000)=ANY=[@ANYRESOCT=r0], 0x17) close(r2) execve(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000080), &(0x7f0000000240)=[&(0x7f0000000100)='{\x00', &(0x7f0000000140)='++cpuset.security\x00', &(0x7f00000001c0)='bdev\x00']) unlink(&(0x7f0000000200)='./control/file0\x00') socket(0x0, 0x6, 0x0) r5 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x801, 0x0) ioctl$SNDRV_TIMER_IOCTL_INFO(r2, 0x80e85411, &(0x7f0000001cc0)=""/12) ioctl$UI_DEV_SETUP(r5, 0x5501, &(0x7f00000001c0)={{0x0, 0x0, 0x2, 0x3}, "73797a2a000000000000007ad300000000000000000000000022000000000000001000"}) r6 = syz_open_dev$rtc(&(0x7f0000000a00)='/dev/rtc#\x00', 0xfffffffffffeffff, 0x200) fcntl$notify(r6, 0x402, 0x0) 10:19:21 executing program 5: r0 = socket(0x0, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x23fa0000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:21 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x5843, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 758.486048] binder: 27862:27867 unknown command 1077961216 [ 758.491839] binder: 27862:27867 ioctl c0306201 20000440 returned -22 10:19:21 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff8000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 758.551866] binder_alloc: binder_alloc_mmap_handler: 27862 20001000-20004000 already mapped failed -16 [ 758.596118] binder: 27862:27874 unknown command 1077961216 [ 758.601909] binder: 27862:27874 ioctl c0306201 20000440 returned -22 10:19:21 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x400000000000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:21 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_open_procfs(0x0, &(0x7f0000000100)='net/netfilter\x00') [ 758.648041] binder: BINDER_SET_CONTEXT_MGR already set 10:19:21 executing program 5: r0 = socket(0x40000000002, 0x0, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x23fa0000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 758.670555] binder: 27862:27867 ioctl 40046207 0 returned -16 10:19:22 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x284b000000000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:22 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="004a404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:22 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:22 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000140)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000040)={[], 0x0, 0x800009, 0x4}) ioctl$BLKFLSBUF(r0, 0x1261, &(0x7f0000000000)=0x6) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$TIOCPKT(r1, 0x5420, &(0x7f0000000240)=0xfffffffffffeffff) r2 = socket(0x68bf7020a0d2be0f, 0x0, 0x6) sendto$unix(r2, &(0x7f0000000180)="9707f24ca48497101787a60266a17a05b92127053fbf1b4f", 0x18, 0x800, &(0x7f00000001c0)=@file={0x0, './file0\x00'}, 0x6e) fcntl$setstatus(r2, 0x4, 0x42800) 10:19:22 executing program 5: r0 = socket(0x40000000002, 0x3, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x23fa0000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:22 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) rename(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='./file0\x00') r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getdents64(r1, &(0x7f0000000100)=""/111, 0x18) lstat(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TUNSETGROUP(r0, 0x400454ce, r2) getdents(r1, &(0x7f0000000380)=""/246, 0xffffffff00000018) munmap(&(0x7f00001c3000/0x2000)=nil, 0x2000) [ 759.023319] binder: 27909:27916 unknown command 1077955072 [ 759.045715] binder: 27909:27916 ioctl c0306201 20000440 returned -22 [ 759.066400] binder_alloc: binder_alloc_mmap_handler: 27909 20001000-20004000 already mapped failed -16 [ 759.086067] binder: BINDER_SET_CONTEXT_MGR already set [ 759.101472] binder: 27909:27925 unknown command 1077955072 [ 759.115245] binder: 27909:27916 ioctl 40046207 0 returned -16 10:19:22 executing program 0: 10:19:22 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x70ad, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 759.128541] binder: 27909:27925 ioctl c0306201 20000440 returned -22 10:19:22 executing program 5: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x23fa0000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:22 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:22 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="003c404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:22 executing program 0: 10:19:22 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xe178, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:22 executing program 5: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r1, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x23fa0000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 759.335172] binder: 27943:27944 unknown command 1077951488 10:19:22 executing program 0: [ 759.403720] binder: 27943:27944 ioctl c0306201 20000440 returned -22 10:19:22 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 759.445965] binder_alloc: binder_alloc_mmap_handler: 27943 20001000-20004000 already mapped failed -16 10:19:22 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xb338, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 759.544301] binder: BINDER_SET_CONTEXT_MGR already set [ 759.549446] binder: 27943:27949 unknown command 1077951488 [ 759.579999] binder: 27943:27944 ioctl 40046207 0 returned -16 [ 759.595448] binder: 27943:27949 ioctl c0306201 20000440 returned -22 10:19:22 executing program 4: ioctl$TIOCLINUX6(0xffffffffffffffff, 0x541c, &(0x7f0000000040)={0x6, 0x3}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xffffffffffffffff, 0x8031, 0xffffffffffffffff, 0x0) getsockopt$inet_mreqn(r0, 0x0, 0x24, &(0x7f0000000080)={@empty, @remote, 0x0}, &(0x7f00000000c0)=0xc) ioctl$sock_inet6_SIOCDIFADDR(0xffffffffffffffff, 0x8936, &(0x7f0000000180)={@empty, 0x6, r1}) getdents64(r0, &(0x7f0000000100)=""/111, 0x18) getdents(r0, &(0x7f0000000380)=""/246, 0xffffffff00000018) r2 = syz_open_dev$sndpcmc(&(0x7f00000001c0)='/dev/snd/pcmC#D#c\x00', 0x80000001, 0x200) ioctl$SNDRV_CTL_IOCTL_ELEM_LOCK(r2, 0x40405514, &(0x7f0000000200)={0x3, 0x6, 0x14, 0x0, 'syz0\x00', 0xffffffff}) 10:19:22 executing program 5: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r1, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x23fa0000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:22 executing program 0: 10:19:22 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x2b750000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:22 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0763044000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:22 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80ffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:22 executing program 0: [ 759.770015] binder_thread_write: 8 callbacks suppressed [ 759.770030] binder: 27976:27978 DecRefs 0 refcount change on invalid ref 0 ret -22 10:19:23 executing program 5: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r1, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x23fa0000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:23 executing program 0: [ 759.827071] binder: 27976:27978 unknown command 38338560 [ 759.861966] binder: 27976:27978 ioctl c0306201 20000440 returned -22 10:19:23 executing program 0: 10:19:23 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xca58, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 759.921383] binder_alloc: binder_alloc_mmap_handler: 27976 20001000-20004000 already mapped failed -16 10:19:23 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff00000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 759.968141] binder: BINDER_SET_CONTEXT_MGR already set [ 759.968168] binder: 27976:27988 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 759.968189] binder: 27976:27978 ioctl 40046207 0 returned -16 [ 759.986103] binder: 27976:27988 unknown command 38338560 [ 759.996170] binder: 27976:27988 ioctl c0306201 20000440 returned -22 10:19:23 executing program 0: 10:19:23 executing program 5: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(0xffffffffffffffff, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x23fa0000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:23 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x189c0000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:23 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="005b404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:23 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getdents64(r1, &(0x7f0000000100)=""/111, 0x18) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000000c0)={0xffffffffffffff9c, 0x50, &(0x7f0000000180)={0x0, 0x0}}, 0x10) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000200)=r2, 0x4) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f0000000240)={0x7, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, &(0x7f0000000280)=0x20) getdents(r1, &(0x7f0000000380)=""/246, 0xffffffff00000018) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000040)=0x0) ptrace$getenv(0x4201, r3, 0x790, &(0x7f0000000080)) 10:19:23 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80ffff00000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:23 executing program 0: [ 760.400299] binder: 28016:28017 unknown command 1077959424 [ 760.425338] binder: 28016:28017 ioctl c0306201 20000440 returned -22 10:19:23 executing program 5: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(0xffffffffffffffff, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x23fa0000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:23 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xe0a1, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 760.465410] binder_alloc: binder_alloc_mmap_handler: 28016 20001000-20004000 already mapped failed -16 [ 760.501523] binder: BINDER_SET_CONTEXT_MGR already set 10:19:23 executing program 0: [ 760.531039] binder: 28016:28017 ioctl 40046207 0 returned -16 [ 760.567586] binder: 28016:28027 unknown command 1077959424 10:19:23 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:23 executing program 5: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(0xffffffffffffffff, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x23fa0000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 760.602677] binder: 28016:28027 ioctl c0306201 20000440 returned -22 10:19:23 executing program 0: 10:19:23 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x20d0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:23 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="001f404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:23 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xfbae0000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 760.808290] binder: 28053:28054 unknown command 1077944064 [ 760.843943] binder: 28053:28054 ioctl c0306201 20000440 returned -22 [ 760.883039] binder_alloc: binder_alloc_mmap_handler: 28053 20001000-20004000 already mapped failed -16 [ 760.912522] binder: BINDER_SET_CONTEXT_MGR already set [ 760.928360] binder: 28053:28054 ioctl 40046207 0 returned -16 [ 760.940346] binder: 28053:28057 unknown command 1077944064 [ 760.947934] binder: 28053:28057 ioctl c0306201 20000440 returned -22 10:19:24 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000480)={0x0, 0xd8}, &(0x7f00000004c0)=0x8) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f0000000500)={r1, @in={{0x2, 0x4e20, @multicast2}}, 0x0, 0x1}, &(0x7f00000005c0)=0x90) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r0, 0x84, 0x73, &(0x7f0000000600)={r2, 0x7, 0x20, 0x80000000, 0x2}, &(0x7f0000000640)=0x18) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r0, 0x84, 0x73, &(0x7f0000000040)={0x0, 0x8, 0x30, 0x3ff, 0x8}, &(0x7f0000000080)=0x18) ioctl$TUNGETFEATURES(r0, 0x800454cf, &(0x7f00000002c0)) remap_file_pages(&(0x7f00007e5000/0x3000)=nil, 0x3000, 0x2, 0x9c, 0x3) ioctl$DRM_IOCTL_IRQ_BUSID(r0, 0xc0106403, &(0x7f0000000200)={0x4, 0xa84, 0x1, 0x3}) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x6d, &(0x7f0000000180)=ANY=[@ANYRES32=r4, @ANYBLOB="7f00000071b2cd7558b0e1b35c948796ced2b2254b07f7d42b4c4574aecc3c6a3dbf87a5d5a49b9dcc8a05b649b48aa0fa049c73d802e9c845bbd47be79cfbeca9680512d1d464a9f8b47f660c9172c2e8fe62fe09b154c2e885ab0a76aa621f2ce0489bc2a589ed1fbe9e2e939d8ff69efc7d12"], &(0x7f00000000c0)=0x87) getdents64(r3, &(0x7f0000000100)=""/111, 0x18) syz_mount_image$erofs(&(0x7f0000000240)='erofs\x00', &(0x7f0000000280)='./file0\x00', 0x2, 0x0, &(0x7f00000002c0), 0x800000, &(0x7f0000000300)={[{@user_xattr='user_xattr'}, {@acl='acl'}, {@noacl='noacl'}, {@noacl='noacl'}, {@user_xattr='user_xattr'}, {@acl='acl'}, {@acl='acl'}, {@fault_injection={'fault_injection', 0x3d, 0x3}}], [{@permit_directio='permit_directio'}]}) getdents(r3, &(0x7f0000000380)=""/246, 0xffffffff00000018) 10:19:24 executing program 0: 10:19:24 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:24 executing program 5: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}], 0x1, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x23fa0000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:24 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xfd000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:24 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0045404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:24 executing program 0: [ 761.186872] binder: 28071:28073 unknown command 1077953792 [ 761.214772] binder: 28071:28073 ioctl c0306201 20000440 returned -22 10:19:24 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x33a90000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:24 executing program 5: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}], 0x1, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x23fa0000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:24 executing program 0: [ 761.249863] binder: BINDER_SET_CONTEXT_MGR already set [ 761.255890] binder: 28071:28082 unknown command 1077953792 [ 761.275410] binder: 28071:28073 ioctl 40046207 0 returned -16 [ 761.281556] binder: 28071:28082 ioctl c0306201 20000440 returned -22 10:19:24 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="003f404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:24 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 761.453574] binder: 28095:28096 unknown command 1077952256 [ 761.485915] binder: 28095:28096 ioctl c0306201 20000440 returned -22 [ 761.532170] binder: BINDER_SET_CONTEXT_MGR already set [ 761.552564] binder: 28095:28103 unknown command 1077952256 [ 761.558509] binder: 28095:28096 ioctl 40046207 0 returned -16 [ 761.576888] binder: 28095:28103 ioctl c0306201 20000440 returned -22 [ 761.659882] erofs: read_super, device -> /dev/loop4 [ 761.665106] erofs: options -> user_xattr,acl,noacl,noacl,user_xattr,acl,acl,fault_injection=0x0000000000000003,permit_directio, [ 761.679842] erofs: cannot find valid erofs superblock 10:19:24 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/sys/net/ipv4/vs/snat_reroute\x00', 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) ioctl$TIOCSTI(r1, 0x5412, 0xff) getdents64(r1, &(0x7f0000000100)=""/111, 0x18) ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000040)={0xf080000000000000, 0x2000, 0x8, 0x4, 0x5}) getdents(r1, &(0x7f0000000380)=""/246, 0xffffffff00000018) 10:19:24 executing program 0: 10:19:24 executing program 5: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}], 0x1, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x23fa0000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:24 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xaefb, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:24 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:24 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="005e404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:25 executing program 0: [ 761.885480] binder: 28120:28124 unknown command 1077960192 [ 761.905423] binder: 28120:28124 ioctl c0306201 20000440 returned -22 [ 761.924206] binder_alloc_mmap_handler: 2 callbacks suppressed 10:19:25 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xa, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:25 executing program 5: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000080)=""/4, 0x4}], 0x1, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x23fa0000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 761.924227] binder_alloc: binder_alloc_mmap_handler: 28120 20001000-20004000 already mapped failed -16 10:19:25 executing program 0: [ 762.009926] binder: 28120:28128 unknown command 1077960192 [ 762.044302] binder: BINDER_SET_CONTEXT_MGR already set 10:19:25 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:25 executing program 5: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000080)=""/4, 0x4}], 0x1, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x23fa0000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 762.066756] binder: 28120:28128 ioctl c0306201 20000440 returned -22 [ 762.089896] binder: 28120:28124 ioctl 40046207 0 returned -16 10:19:25 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x3bdd000000000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:25 executing program 0: 10:19:25 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0051404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:25 executing program 5: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000080)=""/4, 0x4}], 0x1, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x23fa0000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:25 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x80000000000) write$P9_RVERSION(r0, &(0x7f0000000040)={0x15, 0x65, 0xffff, 0x101, 0x8, '9P2000.u'}, 0x15) getdents64(r1, &(0x7f0000000100)=""/111, 0x18) getdents(r1, &(0x7f0000000380)=""/246, 0xffffffff00000018) 10:19:25 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:25 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000640)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000140)={'team_slave_0\x00', 0x102}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f00000002c0)={'ip6_vti0\x00', 0x400}) [ 762.527031] binder: 28159:28162 unknown command 1077956864 [ 762.559974] binder: 28159:28162 ioctl c0306201 20000440 returned -22 10:19:25 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x8b01000000000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:25 executing program 5: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(0xffffffffffffffff, &(0x7f0000000080), 0xffeb, 0x23fa0000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 762.581004] binder_alloc: binder_alloc_mmap_handler: 28159 20001000-20004000 already mapped failed -16 [ 762.596451] binder: BINDER_SET_CONTEXT_MGR already set [ 762.602013] binder: 28159:28168 ioctl 40046207 0 returned -16 10:19:25 executing program 0: clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) lstat(&(0x7f0000000280)='./control/file0\x00', &(0x7f00000002c0)) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) inotify_init1(0x800) execveat(0xffffffffffffffff, &(0x7f0000000380)='./control\x00', &(0x7f0000000640)=[&(0x7f00000003c0)='bdev\x00', &(0x7f0000000400)='$@trusted&\x00', &(0x7f0000000440)='cpuset\x00', &(0x7f0000000480)='++cpuset.security\x00', &(0x7f00000004c0)='em1\x00', &(0x7f0000000500)="bf7b00", &(0x7f0000000540)='-[lo\x00', &(0x7f0000000600)='++cpuset.security\x00'], &(0x7f00000008c0)=[&(0x7f00000006c0)='++cpuset.security\x00', &(0x7f0000000700)='\\-\x00', &(0x7f0000000740)='{\x00', &(0x7f0000000780)='}GPL\\GPLem1mime_type\x00', &(0x7f00000007c0)='\x00', &(0x7f0000000800)="76626f786e657431ce656d3076626f786e65743000", &(0x7f0000000840)='++cpuset.security\x00', &(0x7f0000000880)='vboxnet1GPL\\em0lo\\\x00'], 0x0) mkdir(&(0x7f0000000180)='./control\x00', 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000340)='./control/file0\x00', 0x2, 0x1) r1 = creat(&(0x7f0000000040)='./control/file0\x00', 0x3) clock_gettime(0x0, &(0x7f0000008700)) write$binfmt_script(r1, &(0x7f0000000000)=ANY=[@ANYRESOCT=r0], 0x17) close(r1) execve(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000080), &(0x7f0000000240)=[&(0x7f0000000100)='{\x00', &(0x7f00000001c0)='bdev\x00']) unlink(&(0x7f0000000200)='./control/file0\x00') socket(0x0, 0x6, 0x0) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x801, 0x0) write$uinput_user_dev(r2, &(0x7f0000000400)={'syz1\x00', {}, 0xffffffffffffffff}, 0x45c) ioctl$SNDRV_TIMER_IOCTL_INFO(r1, 0x80e85411, &(0x7f0000001cc0)=""/12) ioctl$UI_DEV_SETUP(r2, 0x5501, &(0x7f00000001c0)={{0x0, 0x0, 0x2, 0x3}, "73797a2a000000000000007ad300000000000000000000000022000000000000001000"}) r3 = syz_open_dev$rtc(&(0x7f0000000a00)='/dev/rtc#\x00', 0xfffffffffffeffff, 0x200) fcntl$notify(r3, 0x402, 0x0) [ 762.655065] binder: 28159:28171 unknown command 1077956864 10:19:25 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff00000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 762.704265] binder: 28159:28171 ioctl c0306201 20000440 returned -22 10:19:25 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x1392000000000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:25 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0021404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:26 executing program 5: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:26 executing program 0: clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) lstat(&(0x7f0000000280)='./control/file0\x00', &(0x7f00000002c0)) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = inotify_init1(0x800) inotify_add_watch(r1, &(0x7f0000001d40)='./file0\x00', 0x4) execveat(0xffffffffffffffff, &(0x7f0000000380)='./control\x00', &(0x7f0000000640)=[&(0x7f00000003c0)='bdev\x00', &(0x7f0000000400)='$@trusted&\x00', &(0x7f0000000440)='cpuset\x00', &(0x7f0000000480)='++cpuset.security\x00', &(0x7f00000004c0)='em1\x00', &(0x7f0000000500)="bf7b00", &(0x7f0000000540)='-[lo\x00', &(0x7f0000000600)='++cpuset.security\x00'], &(0x7f00000008c0)=[&(0x7f00000006c0)='++cpuset.security\x00', &(0x7f0000000700)='\\-\x00', &(0x7f0000000740)='{\x00', &(0x7f0000000780)='}GPL\\GPLem1mime_type\x00', &(0x7f00000007c0)='\x00', &(0x7f0000000800)="76626f786e657431ce656d3076626f786e65743000", &(0x7f0000000840)='++cpuset.security\x00', &(0x7f0000000880)='vboxnet1GPL\\em0lo\\\x00'], 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0x4) mkdir(&(0x7f0000000180)='./control\x00', 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000340)='./control/file0\x00', 0x2, 0x1) r2 = creat(&(0x7f0000000040)='./control/file0\x00', 0x3) clock_gettime(0x0, &(0x7f0000008700)={0x0, 0x0}) recvmmsg(r2, &(0x7f0000008500)=[{{&(0x7f0000000900)=@ll, 0x80, &(0x7f0000001a40)=[{&(0x7f0000000980)=""/106, 0x6a}, {&(0x7f0000000a00)}, {&(0x7f0000000a40)=""/4096, 0x1000}], 0x3, &(0x7f0000001a80)=""/196, 0xc4}, 0x10001}, {{&(0x7f0000001b80)=@ax25, 0x80, &(0x7f0000001f00)=[{&(0x7f0000001c00)=""/171, 0xab}, {&(0x7f0000001d80)=""/204, 0xcc}, {&(0x7f0000001e80)=""/102, 0x66}], 0x3}, 0x2}, {{&(0x7f0000001f40)=@pppoe, 0x80, &(0x7f0000003480)=[{&(0x7f0000001fc0)=""/43, 0x2b}, {&(0x7f0000002000)=""/4096, 0x1000}, {&(0x7f0000003000)=""/106, 0x6a}, {&(0x7f0000003080)=""/134, 0x86}, {&(0x7f0000003140)=""/186, 0xba}, {&(0x7f0000003200)=""/196, 0xc4}, {&(0x7f0000003300)=""/159, 0x9f}, {&(0x7f00000033c0)=""/143, 0x8f}], 0x8, &(0x7f0000003500)=""/158, 0x9e, 0x3}, 0x20}, {{&(0x7f00000035c0)=@nl, 0x80, &(0x7f0000005700)=[{&(0x7f0000003640)=""/4096, 0x1000}, {&(0x7f0000004640)=""/188, 0xbc}, {&(0x7f0000004700)=""/4096, 0x1000}], 0x3, &(0x7f0000005740)=""/87, 0x57, 0x1}, 0x9}, {{&(0x7f00000057c0)=@hci, 0x80, &(0x7f0000006b80)=[{&(0x7f0000005840)=""/116, 0x74}, {&(0x7f00000058c0)=""/8, 0x8}, {&(0x7f0000005900)=""/141, 0x8d}, {&(0x7f00000059c0)=""/2, 0x2}, {&(0x7f0000005a00)=""/18, 0x12}, {&(0x7f0000005a40)=""/4096, 0x1000}, {&(0x7f0000006a40)=""/18, 0x12}, {&(0x7f0000006a80)=""/148, 0x94}, {&(0x7f0000006b40)=""/60, 0x3c}], 0x9, &(0x7f0000006c40)=""/94, 0x5e, 0x18000000}, 0xc5}, {{&(0x7f0000006cc0)=@ipx, 0x80, &(0x7f0000007e80)=[{&(0x7f0000006d40)=""/4096, 0x1000}, {&(0x7f0000007e40)=""/60, 0x3c}], 0x2, &(0x7f0000007ec0)=""/251, 0xfb, 0x3ba}, 0x628}, {{0x0, 0x0, &(0x7f00000083c0)=[{&(0x7f0000008100)=""/20, 0x14}, {&(0x7f0000008140)=""/150, 0x96}, {&(0x7f0000008200)=""/102, 0x66}, {&(0x7f0000008280)}, {&(0x7f00000082c0)=""/24, 0x18}, {&(0x7f0000008300)=""/153, 0x99}], 0x6, &(0x7f0000008440)=""/146, 0x92}, 0xffffffff}], 0x7, 0x40000040, &(0x7f0000008740)={r3, r4+30000000}) write$binfmt_script(r2, &(0x7f0000000000)=ANY=[@ANYRESOCT=r0], 0x17) close(r2) execve(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000080), &(0x7f0000000240)=[&(0x7f0000000100)='{\x00', &(0x7f0000000140)='++cpuset.security\x00', &(0x7f00000001c0)='bdev\x00']) unlink(&(0x7f0000000200)='./control/file0\x00') socket(0x0, 0x6, 0x0) r5 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x801, 0x0) write$uinput_user_dev(r5, &(0x7f0000000400)={'syz1\x00', {}, 0xffffffffffffffff}, 0x45c) ioctl$SNDRV_TIMER_IOCTL_INFO(r2, 0x80e85411, &(0x7f0000001cc0)=""/12) ioctl$UI_DEV_SETUP(r5, 0x5501, &(0x7f00000001c0)={{0x0, 0x0, 0x2, 0x3}, "73797a2a000000000000007ad300000000000000000000000022000000000000001000"}) r6 = syz_open_dev$rtc(&(0x7f0000000a00)='/dev/rtc#\x00', 0xfffffffffffeffff, 0x200) fcntl$notify(r6, 0x402, 0x0) 10:19:26 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xc61b, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 762.953284] binder: 28195:28201 unknown command 1077944576 [ 762.974615] binder: 28195:28201 ioctl c0306201 20000440 returned -22 [ 763.026751] binder_alloc: binder_alloc_mmap_handler: 28195 20001000-20004000 already mapped failed -16 [ 763.049177] binder: BINDER_SET_CONTEXT_MGR already set [ 763.082182] binder: 28195:28201 ioctl 40046207 0 returned -16 [ 763.099397] input input11: cannot allocate more than FF_MAX_EFFECTS effects [ 763.110084] binder: 28195:28206 unknown command 1077944576 [ 763.145215] binder: 28195:28206 ioctl c0306201 20000440 returned -22 10:19:26 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000af9000/0x2000)=nil, 0x2000, 0x8) setsockopt$bt_hci_HCI_DATA_DIR(r0, 0x0, 0x1, &(0x7f0000000040)=0x7, 0x4) ioctl$UI_SET_ABSBIT(r0, 0x40045567, 0x4) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f000089d000/0x3000)=nil, 0x3000, 0x3, 0x13, 0xffffffffffffffff, 0xffffffffffffffff) getdents64(r1, &(0x7f0000000100)=""/111, 0x18) getdents(r1, &(0x7f0000000380)=""/246, 0xffffffff00000018) 10:19:26 executing program 5: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x0, &(0x7f0000000d00)=@abs, 0x63) 10:19:26 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:26 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xcbe3, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:26 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0563404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:26 executing program 0: openat$pfkey(0xffffffffffffff9c, &(0x7f0000006400)='/proc/self/net/pfkey\x00', 0x0, 0x0) syz_open_dev$evdev(&(0x7f0000006540)='/dev/input/event#\x00', 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000006600)={{{@in6=@remote, @in6=@remote}}, {{@in=@multicast2}, 0x0, @in6=@loopback}}, &(0x7f0000006700)=0xe8) mkdir(&(0x7f0000000180)='./control\x00', 0x0) execve(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000080), &(0x7f0000000240)=[&(0x7f0000000140)='++cpuset.security\x00', &(0x7f00000001c0)='bdev\x00']) [ 763.302403] binder: 28228:28233 unknown command 1077961477 [ 763.319852] binder: 28228:28233 ioctl c0306201 20000440 returned -22 10:19:26 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x9b69000000000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:26 executing program 5: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x0, &(0x7f0000000d00)=@abs, 0x63) [ 763.353938] binder_alloc: binder_alloc_mmap_handler: 28228 20001000-20004000 already mapped failed -16 10:19:26 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 763.404544] binder: BINDER_SET_CONTEXT_MGR already set [ 763.424093] binder: 28228:28239 unknown command 1077961477 [ 763.430712] binder: 28228:28233 ioctl 40046207 0 returned -16 10:19:26 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2, 0x200000000000111, 0xffffffffffffffff, 0x0) getdents64(r1, &(0x7f0000000100)=""/111, 0x18) getdents(r1, &(0x7f0000000380)=""/246, 0xffffffff00000018) ioctl$sock_bt_hidp_HIDPGETCONNINFO(r0, 0x800448d3, &(0x7f0000000040)={{0x3, 0x3, 0x422b66a, 0xf11, 0x810, 0x5fbe}, 0x1, 0x7c9c8c01, 0x0, 0xfffffffffffffffd, 0x8, "eb0c2f73678255efdbcc9012572b742278b9e46e65d00692b8f81438233c9f4ba9ad1347a5aa1f6425eed834dadf0f4d29aa393a9bfff3ee89e3217f34c5426e12f91c9eddbad72b73a6dca68af20498155e7971aa97db1340fbe2602e14d55cac3b03bb7728142f77721261bf1cebb8bc1b174320828f7672c7d9a2ee496ff0"}) [ 763.464928] binder: 28228:28239 ioctl c0306201 20000440 returned -22 10:19:26 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0263044000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:26 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) connect$inet(r0, &(0x7f0000000040)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r0, &(0x7f0000004e00)=[{{0x0, 0x0, &(0x7f0000001f80), 0x1ab, &(0x7f0000001fc0)}}], 0x400000000000047, 0x0) 10:19:26 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xd86d000000000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:26 executing program 5: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x0, &(0x7f0000000d00)=@abs, 0x63) 10:19:26 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000000c0)={r0, 0x50, &(0x7f0000000040)}, 0x10) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getdents64(r1, &(0x7f0000000100)=""/111, 0x18) getdents(r1, &(0x7f0000000380)=""/246, 0xffffffff00000018) [ 763.627053] binder: BC_ACQUIRE_RESULT not supported [ 763.632299] binder: 28258:28261 ioctl c0306201 20000440 returned -22 10:19:26 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 763.694831] binder_alloc: binder_alloc_mmap_handler: 28258 20001000-20004000 already mapped failed -16 10:19:26 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x38b30000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:26 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(0xffffffffffffffff, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) 10:19:27 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x0, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) [ 763.782915] binder: BINDER_SET_CONTEXT_MGR already set [ 763.808653] binder: BC_ACQUIRE_RESULT not supported [ 763.840230] binder: 28258:28261 ioctl 40046207 0 returned -16 [ 763.860537] binder: 28258:28268 ioctl c0306201 20000440 returned -22 10:19:27 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1063084000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:27 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff8000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:27 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x53c0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 763.948372] net_ratelimit: 8 callbacks suppressed [ 763.948383] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 763.958855] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 764.089072] binder: 28297:28301 BC_DEAD_BINDER_DONE 0249000000000000 not found [ 764.131199] binder: 28297:28301 unknown command 6880847 [ 764.158689] binder: 28297:28301 ioctl c0306201 20000440 returned -22 10:19:27 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0xffff8000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:27 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xe3cb, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 764.196243] binder_alloc: binder_alloc_mmap_handler: 28297 20001000-20004000 already mapped failed -16 [ 764.216029] binder: BINDER_SET_CONTEXT_MGR already set [ 764.221330] binder: 28297:28301 ioctl 40046207 0 returned -16 [ 764.221401] binder: 28297:28306 BC_DEAD_BINDER_DONE 0249000000000000 not found [ 764.221420] binder: 28297:28306 unknown command 6880847 10:19:27 executing program 0: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x60fe000000000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:27 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffdfd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 764.261152] binder: 28297:28306 ioctl c0306201 20000440 returned -22 10:19:27 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r0, 0x10e, 0x3, &(0x7f0000000040)=0x80, 0x4) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getdents64(r1, &(0x7f0000000100)=""/111, 0x18) getdents(r1, &(0x7f0000000380)=""/246, 0xffffffff00000018) 10:19:27 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0050404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:27 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x3b24000000000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:27 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80ffff00000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:27 executing program 5: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/sys/net/ipv4/vs/nat_icmp_send\x00', 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x8000, 0x8000, 0x1, 0x20, r0, 0x7}, 0x2c) msync(&(0x7f00000e6000/0x2000)=nil, 0x2000, 0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x10, r1, 0x0) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000280)=0x0) sched_setscheduler(r2, 0x6, &(0x7f00000002c0)=0x6) getdents64(r0, &(0x7f0000000200)=""/111, 0xffffffffffffff8a) prctl$setmm(0x23, 0x4, &(0x7f0000464000/0x4000)=nil) setsockopt$IP_VS_SO_SET_EDITDEST(r0, 0x0, 0x489, &(0x7f0000000100)={{0x0, @local, 0x4e23, 0x2, 'fo\x00', 0xe, 0x2, 0x42}, {@remote, 0x4e21, 0x5, 0x4f, 0x1ff, 0x7f}}, 0x44) r3 = getpid() ioctl$sock_ifreq(r0, 0x8934, &(0x7f0000000300)={'gretap0\x00', @ifru_mtu=0x5}) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000080)={0x0, 0x0}, &(0x7f00000000c0)=0xc) r5 = getegid() setsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000001c0)={r3, r4, r5}, 0xc) getdents(r0, &(0x7f0000000380)=""/246, 0xf6) 10:19:27 executing program 0: semop(0x0, &(0x7f0000000080), 0x13) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000040)=""/11, 0xffffff3a) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)) r1 = socket$kcm(0x29, 0x200000000000000, 0x0) close(r1) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='pids.events\x00', 0x0, 0x0) r3 = openat$cgroup_ro(r2, &(0x7f0000000400)='io.stat\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TUNGETSNDBUF(r2, 0x800454d3, &(0x7f0000000480)) bpf$OBJ_GET_MAP(0x7, &(0x7f00000002c0)={&(0x7f0000000280)='./file0\x00', 0x0, 0x8}, 0x10) close(r4) sendmsg(r3, &(0x7f0000000300)={&(0x7f0000000500)=@in6={0xa, 0x4e24, 0x6c1, @mcast2, 0x3}, 0x80, &(0x7f0000000240)=[{&(0x7f0000000700)="e2545afb73450a53eb11f9dd1edaa20aadb9ea9553d2b73f8ff7fd24c81825d9c9c84b4d7a1a8c37b5edff1e8ecd44c6c84e029ee2b074a05b15364c7222298bc114c6dfb389608ab539380e", 0x4c}], 0x1, &(0x7f0000000780), 0x0, 0xc044}, 0x1) r5 = socket$kcm(0x2, 0x8000000003, 0x2) ioctl$PERF_EVENT_IOC_PERIOD(r4, 0x8981, &(0x7f0000000040)) sendmsg(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000380)=@pptp={0x18, 0x2, {0x0, @multicast1}}, 0x80, &(0x7f0000000980), 0x0, &(0x7f0000000400), 0x0, 0x20000001}, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x24000, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000080)={"000000000000000000e9dc00", 0x200082}) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cpuacct.usage_sys\x00', 0x0, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r5, 0x89e0, &(0x7f0000000440)={r3, r7}) socketpair(0x1, 0x1, 0x0, &(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r8, 0x89f1, &(0x7f0000000080)='ip6tnl0\x00') bpf$MAP_CREATE(0x0, &(0x7f0000346fd4)={0x0, 0x0, 0x0, 0x8d4, 0x20}, 0x2c) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0xd, 0x2, &(0x7f0000346fc8)=ANY=[@ANYBLOB="187000b9acfa0b60952875c40067e3ba5b2aff"], &(0x7f0000000000)='GPL\x00', 0x0, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) close(r9) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'yam0\x00', 0x200}) bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x4, 0x4, 0x4, 0x4, 0x0, 0x1}, 0x2c) socketpair(0x1, 0x1, 0x0, &(0x7f00000006c0)) [ 764.619506] binder: 28330:28337 unknown command 1077956608 [ 764.638455] binder: 28330:28337 ioctl c0306201 20000440 returned -22 10:19:27 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xe00000000000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:27 executing program 5: semop(0x0, &(0x7f0000000080), 0x13) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000040)=""/11, 0xffffff3a) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)) r1 = socket$kcm(0x29, 0x200000000000000, 0x0) close(r1) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='pids.events\x00', 0x0, 0x0) r3 = openat$cgroup_ro(r2, &(0x7f0000000400)='io.stat\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TUNGETSNDBUF(r2, 0x800454d3, &(0x7f0000000480)) bpf$OBJ_GET_MAP(0x7, &(0x7f00000002c0)={&(0x7f0000000280)='./file0\x00', 0x0, 0x8}, 0x10) close(r4) sendmsg(r3, &(0x7f0000000300)={&(0x7f0000000500)=@in6={0xa, 0x4e24, 0x6c1, @mcast2, 0x3}, 0x80, &(0x7f0000000240)=[{&(0x7f0000000700)="e2545afb73450a53eb11f9dd1edaa20aadb9ea9553d2b73f8ff7fd24c81825d9c9c84b4d7a1a8c37b5edff1e8ecd44c6c84e029ee2b074a05b15364c7222298bc114c6dfb389608ab539380e", 0x4c}], 0x1, &(0x7f0000000780), 0x0, 0xc044}, 0x1) r5 = socket$kcm(0x2, 0x8000000003, 0x2) ioctl$PERF_EVENT_IOC_PERIOD(r4, 0x8981, &(0x7f0000000040)) sendmsg(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000380)=@pptp={0x18, 0x2, {0x0, @multicast1}}, 0x80, &(0x7f0000000980), 0x0, &(0x7f0000000400), 0x0, 0x20000001}, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x24000, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000080)={"000000000000000000e9dc00", 0x200082}) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cpuacct.usage_sys\x00', 0x0, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r5, 0x89e0, &(0x7f0000000440)={r3, r7}) socketpair(0x1, 0x1, 0x0, &(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r8, 0x89f1, &(0x7f0000000080)='ip6tnl0\x00') bpf$MAP_CREATE(0x0, &(0x7f0000346fd4)={0x0, 0x0, 0x0, 0x8d4, 0x20}, 0x2c) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0xd, 0x2, &(0x7f0000346fc8)=ANY=[@ANYBLOB="187000b9acfa0b60952875c40067e3ba5b2aff"], &(0x7f0000000000)='GPL\x00', 0x0, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) close(r9) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'yam0\x00', 0x200}) bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x4, 0x4, 0x4, 0x4, 0x0, 0x1}, 0x2c) socketpair(0x1, 0x1, 0x0, &(0x7f00000006c0)) [ 764.663154] binder_alloc: binder_alloc_mmap_handler: 28330 20001000-20004000 already mapped failed -16 [ 764.700903] binder: BINDER_SET_CONTEXT_MGR already set [ 764.713292] binder: 28330:28337 ioctl 40046207 0 returned -16 [ 764.730059] binder: 28330:28342 unknown command 1077956608 [ 764.748080] binder: 28330:28342 ioctl c0306201 20000440 returned -22 10:19:27 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:28 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0015404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:28 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x1b0d000000000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 764.931859] binder: 28363:28365 unknown command 1077941504 [ 764.953480] binder: 28363:28365 ioctl c0306201 20000440 returned -22 [ 764.972600] binder_alloc: binder_alloc_mmap_handler: 28363 20001000-20004000 already mapped failed -16 10:19:28 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x4000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 764.993017] binder: BINDER_SET_CONTEXT_MGR already set [ 765.008418] binder: 28363:28365 ioctl 40046207 0 returned -16 [ 765.022301] binder: 28363:28370 unknown command 1077941504 [ 765.029817] binder: 28363:28370 ioctl c0306201 20000440 returned -22 10:19:28 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mount(&(0x7f0000000040)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='debugfs\x00', 0x90400, &(0x7f0000000180)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00") mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getdents64(r0, &(0x7f0000000100)=""/111, 0x18) getdents(r0, &(0x7f0000000380)=""/246, 0xffffffff00000018) 10:19:28 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80ffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:28 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="000c404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:28 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x7b52, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:28 executing program 0: semop(0x0, &(0x7f0000000080), 0x13) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000040)=""/11, 0xffffff3a) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)) r1 = socket$kcm(0x29, 0x200000000000000, 0x0) close(r1) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='pids.events\x00', 0x0, 0x0) r3 = openat$cgroup_ro(r2, &(0x7f0000000400)='io.stat\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TUNGETSNDBUF(r2, 0x800454d3, &(0x7f0000000480)) bpf$OBJ_GET_MAP(0x7, &(0x7f00000002c0)={&(0x7f0000000280)='./file0\x00', 0x0, 0x8}, 0x10) close(r4) sendmsg(r3, &(0x7f0000000300)={&(0x7f0000000500)=@in6={0xa, 0x4e24, 0x6c1, @mcast2, 0x3}, 0x80, &(0x7f0000000240)=[{&(0x7f0000000700)="e2545afb73450a53eb11f9dd1edaa20aadb9ea9553d2b73f8ff7fd24c81825d9c9c84b4d7a1a8c37b5edff1e8ecd44c6c84e029ee2b074a05b15364c7222298bc114c6dfb389608ab539380e", 0x4c}], 0x1, &(0x7f0000000780), 0x0, 0xc044}, 0x1) r5 = socket$kcm(0x2, 0x8000000003, 0x2) ioctl$PERF_EVENT_IOC_PERIOD(r4, 0x8981, &(0x7f0000000040)) sendmsg(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000380)=@pptp={0x18, 0x2, {0x0, @multicast1}}, 0x80, &(0x7f0000000980), 0x0, &(0x7f0000000400), 0x0, 0x20000001}, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x24000, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000080)={"000000000000000000e9dc00", 0x200082}) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cpuacct.usage_sys\x00', 0x0, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r5, 0x89e0, &(0x7f0000000440)={r3, r7}) socketpair(0x1, 0x1, 0x0, &(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r8, 0x89f1, &(0x7f0000000080)='ip6tnl0\x00') bpf$MAP_CREATE(0x0, &(0x7f0000346fd4)={0x0, 0x0, 0x0, 0x8d4, 0x20}, 0x2c) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0xd, 0x2, &(0x7f0000346fc8)=ANY=[@ANYBLOB="187000b9acfa0b60952875c40067e3ba5b2aff"], &(0x7f0000000000)='GPL\x00', 0x0, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) close(r9) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'yam0\x00', 0x200}) bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x4, 0x4, 0x4, 0x4, 0x0, 0x1}, 0x2c) socketpair(0x1, 0x1, 0x0, &(0x7f00000006c0)) [ 765.436624] binder: 28386:28392 unknown command 1077939200 [ 765.470692] binder: 28386:28392 ioctl c0306201 20000440 returned -22 10:19:28 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xd86d, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 765.508905] binder_alloc: binder_alloc_mmap_handler: 28386 20001000-20004000 already mapped failed -16 [ 765.545935] binder: BINDER_SET_CONTEXT_MGR already set 10:19:28 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 765.564043] binder: 28386:28392 ioctl 40046207 0 returned -16 [ 765.586793] binder: 28386:28397 unknown command 1077939200 [ 765.600253] binder: 28386:28397 ioctl c0306201 20000440 returned -22 10:19:28 executing program 5: semop(0x0, &(0x7f0000000080), 0x13) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000040)=""/11, 0xffffff3a) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)) r1 = socket$kcm(0x29, 0x200000000000000, 0x0) close(r1) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='pids.events\x00', 0x0, 0x0) r3 = openat$cgroup_ro(r2, &(0x7f0000000400)='io.stat\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TUNGETSNDBUF(r2, 0x800454d3, &(0x7f0000000480)) bpf$OBJ_GET_MAP(0x7, &(0x7f00000002c0)={&(0x7f0000000280)='./file0\x00', 0x0, 0x8}, 0x10) close(r4) sendmsg(r3, &(0x7f0000000300)={&(0x7f0000000500)=@in6={0xa, 0x4e24, 0x6c1, @mcast2, 0x3}, 0x80, &(0x7f0000000240)=[{&(0x7f0000000700)="e2545afb73450a53eb11f9dd1edaa20aadb9ea9553d2b73f8ff7fd24c81825d9c9c84b4d7a1a8c37b5edff1e8ecd44c6c84e029ee2b074a05b15364c7222298bc114c6dfb389608ab539380e", 0x4c}], 0x1, &(0x7f0000000780), 0x0, 0xc044}, 0x1) r5 = socket$kcm(0x2, 0x8000000003, 0x2) ioctl$PERF_EVENT_IOC_PERIOD(r4, 0x8981, &(0x7f0000000040)) sendmsg(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000380)=@pptp={0x18, 0x2, {0x0, @multicast1}}, 0x80, &(0x7f0000000980), 0x0, &(0x7f0000000400), 0x0, 0x20000001}, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x24000, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000080)={"000000000000000000e9dc00", 0x200082}) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cpuacct.usage_sys\x00', 0x0, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r5, 0x89e0, &(0x7f0000000440)={r3, r7}) socketpair(0x1, 0x1, 0x0, &(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r8, 0x89f1, &(0x7f0000000080)='ip6tnl0\x00') bpf$MAP_CREATE(0x0, &(0x7f0000346fd4)={0x0, 0x0, 0x0, 0x8d4, 0x20}, 0x2c) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0xd, 0x2, &(0x7f0000346fc8)=ANY=[@ANYBLOB="187000b9acfa0b60952875c40067e3ba5b2aff"], &(0x7f0000000000)='GPL\x00', 0x0, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) close(r9) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'yam0\x00', 0x200}) bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x4, 0x4, 0x4, 0x4, 0x0, 0x1}, 0x2c) socketpair(0x1, 0x1, 0x0, &(0x7f00000006c0)) 10:19:28 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0003404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) [ 765.862527] binder: 28414:28417 unknown command 1077936896 [ 765.891172] binder: 28414:28417 ioctl c0306201 20000440 returned -22 10:19:29 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x6ba30000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 765.913235] binder_alloc: binder_alloc_mmap_handler: 28414 20001000-20004000 already mapped failed -16 [ 765.929853] binder: BINDER_SET_CONTEXT_MGR already set [ 765.953069] binder: 28414:28417 ioctl 40046207 0 returned -16 10:19:29 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff00000000, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 765.973325] binder: 28414:28421 unknown command 1077936896 [ 766.019148] binder: 28414:28421 ioctl c0306201 20000440 returned -22 10:19:29 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x636f000000000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:29 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getdents64(r1, &(0x7f0000000180)=""/111, 0x649) ioctl$DRM_IOCTL_GEM_OPEN(r0, 0xc010640b, &(0x7f0000000080)={0x0, 0x0, 0x4}) ioctl$DRM_IOCTL_GEM_FLINK(r0, 0xc008640a, &(0x7f00000000c0)={0x0, 0x0}) ioctl$TIOCGSID(r1, 0x5429, &(0x7f0000000140)=0x0) ioctl$void(r1, 0x5450) fcntl$getownex(r1, 0x10, &(0x7f0000000200)={0x0, 0x0}) kcmp$KCMP_EPOLL_TFD(r4, r5, 0x7, r0, &(0x7f0000000240)={r0, r1}) ioctl$DRM_IOCTL_GEM_FLINK(r0, 0xc008640a, &(0x7f0000000100)={r2, r3}) getdents(r1, &(0x7f0000000280)=""/246, 0xf6) 10:19:29 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:29 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0054404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:29 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x97ffffff00000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:29 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff00000000, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 766.453082] binder: 28447:28452 unknown command 1077957632 [ 766.474844] binder: 28447:28452 ioctl c0306201 20000440 returned -22 10:19:29 executing program 0: semop(0x0, &(0x7f0000000080), 0x13) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000040)=""/11, 0xffffff3a) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)) r1 = socket$kcm(0x29, 0x200000000000000, 0x0) close(r1) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='pids.events\x00', 0x0, 0x0) r3 = openat$cgroup_ro(r2, &(0x7f0000000400)='io.stat\x00', 0x0, 0x0) r4 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TUNGETSNDBUF(r2, 0x800454d3, &(0x7f0000000480)) bpf$OBJ_GET_MAP(0x7, &(0x7f00000002c0)={&(0x7f0000000280)='./file0\x00', 0x0, 0x8}, 0x10) close(r4) sendmsg(r3, &(0x7f0000000300)={&(0x7f0000000500)=@in6={0xa, 0x4e24, 0x6c1, @mcast2, 0x3}, 0x80, &(0x7f0000000240)=[{&(0x7f0000000700)="e2545afb73450a53eb11f9dd1edaa20aadb9ea9553d2b73f8ff7fd24c81825d9c9c84b4d7a1a8c37b5edff1e8ecd44c6c84e029ee2b074a05b15364c7222298bc114c6dfb389608ab539380e", 0x4c}], 0x1, &(0x7f0000000780), 0x0, 0xc044}, 0x1) r5 = socket$kcm(0x2, 0x8000000003, 0x2) ioctl$PERF_EVENT_IOC_PERIOD(r4, 0x8981, &(0x7f0000000040)) sendmsg(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000380)=@pptp={0x18, 0x2, {0x0, @multicast1}}, 0x80, &(0x7f0000000980), 0x0, &(0x7f0000000400), 0x0, 0x20000001}, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x24000, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000080)={"000000000000000000e9dc00", 0x200082}) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cpuacct.usage_sys\x00', 0x0, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r5, 0x89e0, &(0x7f0000000440)={r3, r7}) socketpair(0x1, 0x1, 0x0, &(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r8, 0x89f1, &(0x7f0000000080)='ip6tnl0\x00') bpf$MAP_CREATE(0x0, &(0x7f0000346fd4)={0x0, 0x0, 0x0, 0x8d4, 0x20}, 0x2c) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0xd, 0x2, &(0x7f0000346fc8)=ANY=[@ANYBLOB="187000b9acfa0b60952875c40067e3ba5b2aff"], &(0x7f0000000000)='GPL\x00', 0x0, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) close(r9) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'yam0\x00', 0x200}) bpf$MAP_CREATE(0x0, &(0x7f0000011fd4)={0x4, 0x4, 0x4, 0x4, 0x0, 0x1}, 0x2c) socketpair(0x1, 0x1, 0x0, &(0x7f00000006c0)) 10:19:29 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xb90000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 766.498955] binder: BINDER_SET_CONTEXT_MGR already set [ 766.512460] binder: 28447:28457 unknown command 1077957632 [ 766.526230] binder: 28447:28452 ioctl 40046207 0 returned -16 [ 766.537589] binder: 28447:28457 ioctl c0306201 20000440 returned -22 10:19:29 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) 10:19:29 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0060404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:29 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:29 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x8ac0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 766.742958] binder: 28470:28475 unknown command 1077960704 [ 766.757850] binder: 28470:28475 ioctl c0306201 20000440 returned -22 [ 766.807620] binder: BINDER_SET_CONTEXT_MGR already set [ 766.825749] binder: 28470:28481 unknown command 1077960704 [ 766.834134] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 766.852541] binder: 28470:28475 ioctl 40046207 0 returned -16 [ 766.866539] binder: 28470:28481 ioctl c0306201 20000440 returned -22 10:19:30 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xa39d0000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:30 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getdents64(r1, &(0x7f0000000100)=""/111, 0x18) fcntl$getownex(r1, 0x10, &(0x7f0000000180)={0x0, 0x0}) process_vm_readv(r2, &(0x7f0000000240)=[{&(0x7f00000001c0)=""/81, 0x51}], 0x1, &(0x7f0000000640)=[{&(0x7f0000000280)}, {&(0x7f00000002c0)=""/16, 0x10}, {&(0x7f0000000300)=""/81, 0x51}, {&(0x7f0000000480)=""/226, 0xe2}, {&(0x7f0000000580)=""/59, 0x3b}, {&(0x7f00000005c0)=""/90, 0x5a}], 0x6, 0x0) getdents(r1, &(0x7f0000000380)=""/246, 0xffffffff00000018) ioctl$KDSKBSENT(r0, 0x4b49, &(0x7f0000000040)="ef43d90a514bf1f9887d4481dff6d67a2a16062c6524e6a201461f6cfb6e70b47b5c3885fdea184c30b59233a31aeda063bafb788cccf77938408940c8c12925fe500ffc193ff8f58f33e3fc865fee91691f075de227d304873e11d8824d165bd0987dfdb7b7fe46ef65b1f6b4a560728ae569a7e42e3654e98b67b9b905fd6b5ce5b6bc712673e68679f9ea660391b745f9caf45e98b9b8be4a773c645ac288ea8476f0b7bf4487e243d5dcb7ad0dfe1a388880") 10:19:30 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="000e404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:30 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80ffff, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:30 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x8400ae8e, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:30 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x12e3, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 767.205165] binder: 28503:28508 unknown command 1077939712 [ 767.225148] binder: 28503:28508 ioctl c0306201 20000440 returned -22 [ 767.259732] binder_alloc_mmap_handler: 2 callbacks suppressed [ 767.259750] binder_alloc: binder_alloc_mmap_handler: 28503 20001000-20004000 already mapped failed -16 [ 767.283069] binder: BINDER_SET_CONTEXT_MGR already set [ 767.303512] binder: 28503:28508 ioctl 40046207 0 returned -16 [ 767.316319] binder: 28503:28514 unknown command 1077939712 [ 767.322307] binder: 28503:28514 ioctl c0306201 20000440 returned -22 10:19:30 executing program 0 (fault-call:5 fault-nth:0): r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:30 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x307f0000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:30 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:30 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0035404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:30 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x8400ae8e, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 767.569811] binder: 28523:28527 unknown command 1077949696 [ 767.599294] binder: 28523:28527 ioctl c0306201 20000440 returned -22 [ 767.608284] FAULT_INJECTION: forcing a failure. [ 767.608284] name failslab, interval 1, probability 0, space 0, times 0 10:19:30 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x90c4, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 767.619859] binder_alloc: binder_alloc_mmap_handler: 28523 20001000-20004000 already mapped failed -16 [ 767.673520] binder: BINDER_SET_CONTEXT_MGR already set [ 767.690878] binder: 28523:28532 unknown command 1077949696 [ 767.698922] CPU: 1 PID: 28531 Comm: syz-executor0 Not tainted 4.19.0-rc8+ #70 [ 767.706225] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 767.715604] Call Trace: [ 767.718227] dump_stack+0x1c4/0x2b4 [ 767.721886] ? dump_stack_print_info.cold.2+0x52/0x52 [ 767.723095] binder: 28523:28527 ioctl 40046207 0 returned -16 [ 767.727112] should_fail.cold.4+0xa/0x17 [ 767.727148] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 767.727172] ? arch_local_save_flags+0x40/0x40 [ 767.727191] ? rcu_bh_qs+0xc0/0xc0 [ 767.727213] ? rcu_bh_qs+0xc0/0xc0 [ 767.741510] binder: 28523:28532 ioctl c0306201 20000440 returned -22 [ 767.742313] ? unwind_dump+0x190/0x190 [ 767.764338] ? graph_lock+0x170/0x170 [ 767.768164] ? __lock_acquire+0x7ec/0x4ec0 [ 767.772431] ? __lock_acquire+0x7ec/0x4ec0 [ 767.776699] ? __mutex_lock+0x85e/0x1700 [ 767.780773] ? print_usage_bug+0xc0/0xc0 [ 767.784855] ? find_held_lock+0x36/0x1c0 [ 767.788930] ? graph_lock+0x170/0x170 [ 767.792742] ? inet_select_addr+0x7d6/0xdf0 [ 767.797075] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 767.802806] ? check_preemption_disabled+0x48/0x200 [ 767.807831] ? check_preemption_disabled+0x48/0x200 [ 767.812861] ? __lock_is_held+0xb5/0x140 [ 767.816935] __should_failslab+0x124/0x180 [ 767.821178] should_failslab+0x9/0x14 [ 767.824984] kmem_cache_alloc+0x47/0x730 [ 767.829051] ? ip_mc_drop_socket+0x270/0x270 [ 767.833477] dst_alloc+0xbb/0x1d0 [ 767.836941] rt_dst_alloc+0x105/0x540 [ 767.840746] ? fnhe_flush_routes+0x480/0x480 [ 767.845164] ? __lock_is_held+0xb5/0x140 [ 767.849249] ip_route_output_key_hash_rcu+0xa57/0x3490 [ 767.854546] ? ip_route_input_noref+0x260/0x260 [ 767.859217] ? print_usage_bug+0xc0/0xc0 [ 767.863281] ? print_usage_bug+0xc0/0xc0 [ 767.867367] ? lock_acquire+0x1ed/0x520 [ 767.871345] ? ip_route_output_key_hash+0x1ab/0x3b0 [ 767.876365] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 767.881908] ? check_preemption_disabled+0x48/0x200 [ 767.886931] ? kasan_check_read+0x11/0x20 [ 767.891085] ? rcu_dynticks_curr_cpu_in_eqs+0x9f/0x160 [ 767.896365] ? rcu_bh_qs+0xc0/0xc0 [ 767.899922] ip_route_output_key_hash+0x240/0x3b0 [ 767.904776] ? ip_route_output_key_hash_rcu+0x3490/0x3490 [ 767.910323] ? rcu_bh_qs+0xc0/0xc0 [ 767.913872] ip_route_output_flow+0x28/0xc0 [ 767.918204] raw_sendmsg+0xf53/0x4380 [ 767.922009] ? graph_lock+0x100/0x170 [ 767.925829] ? raw_getsockopt+0x100/0x100 [ 767.929983] ? find_held_lock+0x36/0x1c0 [ 767.934060] ? __local_bh_enable_ip+0x160/0x260 [ 767.938734] ? __local_bh_enable_ip+0x160/0x260 [ 767.943414] ? trace_hardirqs_on+0xbd/0x310 [ 767.947744] ? smack_netlabel+0xfd/0x180 [ 767.951814] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 767.957269] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 767.962813] ? check_preemption_disabled+0x48/0x200 [ 767.967846] ? smack_netlabel+0xda/0x180 [ 767.971910] ? smack_netlabel+0xda/0x180 [ 767.975986] ? smack_netlabel+0xfd/0x180 [ 767.980053] ? smack_netlabel_send+0x453/0x980 [ 767.984643] ? lock_release+0x970/0x970 [ 767.988636] ? arch_local_save_flags+0x40/0x40 [ 767.993231] ? smack_task_kill+0x580/0x580 [ 767.997475] ? find_held_lock+0x36/0x1c0 [ 768.001551] ? __might_fault+0x12b/0x1e0 [ 768.005620] ? lock_downgrade+0x900/0x900 [ 768.009787] ? lock_release+0x970/0x970 [ 768.013763] ? arch_local_save_flags+0x40/0x40 [ 768.018359] inet_sendmsg+0x1a1/0x690 [ 768.022165] ? raw_getsockopt+0x100/0x100 [ 768.026317] ? inet_sendmsg+0x1a1/0x690 [ 768.030307] ? ipip_gro_receive+0x100/0x100 [ 768.034641] ? smack_socket_sendmsg+0x150/0x190 [ 768.039316] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 768.044872] ? security_socket_sendmsg+0x94/0xc0 [ 768.049645] ? ipip_gro_receive+0x100/0x100 [ 768.053977] sock_sendmsg+0xd5/0x120 [ 768.057723] __sys_sendto+0x3d7/0x670 [ 768.061542] ? __ia32_sys_getpeername+0xb0/0xb0 [ 768.066220] ? wait_for_completion+0x8a0/0x8a0 [ 768.070810] ? __lock_is_held+0xb5/0x140 [ 768.074881] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 768.080430] ? __sb_end_write+0xd9/0x110 [ 768.084504] ? 0xffffffff81000000 [ 768.087974] ? trace_hardirqs_on+0xbd/0x310 [ 768.092301] ? __ia32_sys_read+0xb0/0xb0 [ 768.096371] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 768.101741] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 768.107204] __x64_sys_sendto+0xe1/0x1a0 [ 768.111280] do_syscall_64+0x1b9/0x820 [ 768.115172] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 768.120988] ? syscall_return_slowpath+0x5e0/0x5e0 [ 768.125920] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 768.130772] ? trace_hardirqs_on_caller+0x310/0x310 [ 768.135794] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 768.140818] ? prepare_exit_to_usermode+0x291/0x3b0 [ 768.145847] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 768.150711] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 768.155901] RIP: 0033:0x457569 [ 768.159099] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 768.178001] RSP: 002b:00007f2b56d9dc78 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 768.185719] RAX: ffffffffffffffda RBX: 00007f2b56d9dc90 RCX: 0000000000457569 [ 768.193004] RDX: 000000000000ffeb RSI: 0000000020000080 RDI: 0000000000000003 [ 768.200278] RBP: 000000000072bf00 R08: 0000000020000d00 R09: 0000000000000063 [ 768.207565] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f2b56d9e6d4 [ 768.214834] R13: 00000000004c3952 R14: 00000000004d5838 R15: 0000000000000006 10:19:31 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x8400ae8e, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:31 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000480)="2ffffffffffffffff82f6e651c742f697076342f767310456f6e8174727a636b00d680e56258a18dfbd6ce5b513fe99ac09589c8804e74ff74c6041e70cd534aade08b1eeb8d006f6fb8d08d98f9c34657f91cceb3e47fd8ac37cbeb621015bf2f495cb7eee5547b1160ee45fc7758f6b416ecf86cc0578260d6b63ce722179cd7e1b43def99f7a75e03edd5b11ea8e95f596af15ed2f4237f60c8be57a6cfe28d", 0x2, 0x0) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000000540)=ANY=[@ANYBLOB="ffff0000000000000a0000060008000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000009653f14db531cbf7a30000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000010000000a004e2000000100fe8000000000000000000000000000aa0000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x110) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) getdents64(r1, &(0x7f0000000100)=""/111, 0x18) getdents(r1, &(0x7f0000000380)=""/246, 0xffffffff00000018) 10:19:31 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0163404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:31 executing program 0 (fault-call:5 fault-nth:1): r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:31 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x402e, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:31 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:31 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x8400ae8e, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:31 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x5dc, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 768.499417] binder: 28552:28561 got reply transaction with no transaction stack [ 768.518094] binder: 28552:28561 transaction failed 29201/-71, size 26388279066624-0 line 2762 10:19:31 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) fcntl$F_GET_RW_HINT(r0, 0x40b, &(0x7f0000000080)) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) ioctl$VHOST_SET_VRING_ENDIAN(r0, 0x4008af13, &(0x7f0000000040)={0x2, 0x1}) getdents64(r1, &(0x7f0000000100)=""/111, 0x18) getdents(r1, &(0x7f0000000380)=""/246, 0xffffffff00000018) 10:19:31 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_VCPU_EVENTS(0xffffffffffffffff, 0x8400ae8e, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 768.542141] binder_alloc: binder_alloc_mmap_handler: 28552 20001000-20004000 already mapped failed -16 [ 768.559162] binder: BINDER_SET_CONTEXT_MGR already set [ 768.570326] binder: 28552:28561 ioctl 40046207 0 returned -16 10:19:31 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x1bc6000000000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 768.592972] binder: 28552:28566 got reply transaction with no transaction stack [ 768.619805] binder: undelivered TRANSACTION_ERROR: 29201 [ 768.626518] binder: 28552:28566 transaction failed 29201/-71, size 26388279066624-0 line 2762 10:19:31 executing program 0: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:31 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_VCPU_EVENTS(0xffffffffffffffff, 0x8400ae8e, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 768.695878] binder: undelivered TRANSACTION_ERROR: 29201 10:19:31 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0057404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:32 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff8000, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:32 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x1b0d0000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:32 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_VCPU_EVENTS(0xffffffffffffffff, 0x8400ae8e, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 768.883499] binder: 28591:28593 unknown command 1077958400 [ 768.904559] binder: 28591:28593 ioctl c0306201 20000440 returned -22 [ 768.942596] binder_alloc: binder_alloc_mmap_handler: 28591 20001000-20004000 already mapped failed -16 10:19:32 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x527b, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 768.997057] binder: BINDER_SET_CONTEXT_MGR already set [ 768.997866] binder: 28591:28597 unknown command 1077958400 [ 769.031562] binder: 28591:28597 ioctl c0306201 20000440 returned -22 [ 769.041068] binder: 28591:28593 ioctl 40046207 0 returned -16 10:19:32 executing program 5: openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r0, 0x8400ae8e, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:32 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xc3b4, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:32 executing program 5: openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r0, 0x8400ae8e, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:32 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="004c404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:32 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xb34c0000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:32 executing program 0: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0x22b0, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:32 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffdfd, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:32 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) ioctl$KVM_GET_MSR_INDEX_LIST(r0, 0xc004ae02, &(0x7f0000000080)={0x4000000000000230, [0x0, 0x0, 0x0]}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) mprotect(&(0x7f000022f000/0x1000)=nil, 0x1000, 0x8) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getdents64(r1, &(0x7f0000000100)=""/111, 0x18) getdents(r1, &(0x7f0000000380)=""/246, 0xffffffff00000018) 10:19:32 executing program 5: openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r0, 0x8400ae8e, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:32 executing program 0: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0x56b8, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 769.427728] binder: 28627:28629 unknown command 1077955584 [ 769.433508] binder: 28627:28629 ioctl c0306201 20000440 returned -22 [ 769.466960] binder_alloc: binder_alloc_mmap_handler: 28627 20001000-20004000 already mapped failed -16 10:19:32 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xe, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 769.509902] binder: BINDER_SET_CONTEXT_MGR already set 10:19:32 executing program 0: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0x4b28, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:32 executing program 5: r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r1, 0x8400ae8e, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 769.548344] binder: 28627:28639 unknown command 1077955584 [ 769.568172] binder: 28627:28629 ioctl 40046207 0 returned -16 [ 769.586261] binder: 28627:28639 ioctl c0306201 20000440 returned -22 10:19:32 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xa00000000000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:32 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="003a404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:32 executing program 0: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xc490, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:32 executing program 5: r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r1, 0x8400ae8e, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 769.778927] binder: 28663:28664 unknown command 1077950976 10:19:33 executing program 5: r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r1, 0x8400ae8e, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 769.820413] binder: 28663:28664 ioctl c0306201 20000440 returned -22 [ 769.850881] binder_alloc: binder_alloc_mmap_handler: 28663 20001000-20004000 already mapped failed -16 [ 769.876989] binder: BINDER_SET_CONTEXT_MGR already set [ 769.882638] binder: 28663:28664 ioctl 40046207 0 returned -16 [ 769.888975] binder: 28663:28672 unknown command 1077950976 [ 769.894985] binder: 28663:28672 ioctl c0306201 20000440 returned -22 10:19:33 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:33 executing program 0: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0x39d0, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:33 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xfbae000000000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:33 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0400404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:33 executing program 5: openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r1, 0x8400ae8e, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:33 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) getsockname(r0, &(0x7f0000000040)=@pppoe={0x18, 0x0, {0x0, @broadcast}}, &(0x7f00000000c0)=0x80) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getdents64(r1, &(0x7f0000000100)=""/111, 0x18) getdents(r1, &(0x7f0000000380)=""/246, 0xffffffff00000018) 10:19:33 executing program 5: openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r1, 0x8400ae8e, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 770.088541] binder: 28682:28683 unknown command 1077936132 [ 770.118128] binder: 28682:28683 ioctl c0306201 20000440 returned -22 10:19:33 executing program 0: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xe178, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:33 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x731e0000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 770.148895] binder_alloc: binder_alloc_mmap_handler: 28682 20001000-20004000 already mapped failed -16 [ 770.200226] binder: BINDER_SET_CONTEXT_MGR already set 10:19:33 executing program 5: openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r1, 0x8400ae8e, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 770.234565] binder: 28682:28696 unknown command 1077936132 [ 770.242267] binder: 28682:28683 ioctl 40046207 0 returned -16 [ 770.265469] binder: 28682:28696 ioctl c0306201 20000440 returned -22 10:19:33 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:33 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="002a404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:33 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x3408, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:33 executing program 0: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0x9c18, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:33 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r1, 0x8400ae8e, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 770.462838] binder: 28720:28723 unknown command 1077946880 10:19:33 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80ffff00000000, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:33 executing program 0: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xa1e0, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 770.505063] binder: 28720:28723 ioctl c0306201 20000440 returned -22 [ 770.542873] binder_alloc: binder_alloc_mmap_handler: 28720 20001000-20004000 already mapped failed -16 [ 770.615682] binder: BINDER_SET_CONTEXT_MGR already set [ 770.637193] binder: 28720:28723 ioctl 40046207 0 returned -16 [ 770.659539] binder: 28720:28732 unknown command 1077946880 [ 770.676044] binder: 28720:28732 ioctl c0306201 20000440 returned -22 10:19:34 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) getdents64(r0, &(0x7f0000000100)=""/111, 0x18) getdents(r0, &(0x7f0000000380)=""/246, 0xffffffff00000018) 10:19:34 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x3f000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:34 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r1, 0x8400ae8e, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:34 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0028404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:34 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x9}) 10:19:34 executing program 0: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0x5c80, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 770.978113] binder: 28751:28757 unknown command 1077946368 [ 771.005022] binder: 28751:28757 ioctl c0306201 20000440 returned -22 10:19:34 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r1, 0x8400ae8e, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:34 executing program 0: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0x73a0, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:34 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x53c00000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 771.031031] binder_alloc: binder_alloc_mmap_handler: 28751 20001000-20004000 already mapped failed -16 [ 771.102422] binder: BINDER_SET_CONTEXT_MGR already set [ 771.111930] binder: 28751:28764 unknown command 1077946368 10:19:34 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(0xffffffffffffffff, 0x8400ae8e, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 771.146070] binder: 28751:28757 ioctl 40046207 0 returned -16 [ 771.169726] binder: 28751:28764 ioctl c0306201 20000440 returned -22 10:19:34 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xf050, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:34 executing program 0: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xfffffdef, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:34 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0044404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:34 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0x9}) 10:19:34 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(0xffffffffffffffff, 0x8400ae8e, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 10:19:34 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xe00, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:34 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r0, 0x4048ae9b, &(0x7f0000000040)={0x1, 0x0, [0x7ff, 0x9, 0x20000000, 0x9, 0x6, 0x5e3c, 0x7f, 0x8]}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) ioctl$TIOCSCTTY(r0, 0x540e, 0x1) getdents64(r1, &(0x7f0000000100)=""/111, 0x18) getdents(r1, &(0x7f0000000380)=""/246, 0xffffffff00000018) dup3(r0, r1, 0x80000) 10:19:34 executing program 0: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0x7f30, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 771.642556] binder: 28796:28797 unknown command 1077953536 [ 771.663152] binder: 28796:28797 ioctl c0306201 20000440 returned -22 [ 771.694674] binder_alloc: binder_alloc_mmap_handler: 28796 20001000-20004000 already mapped failed -16 10:19:34 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x4000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:34 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00, 0x0, 0x0, 0x0, 0x9}) 10:19:34 executing program 0: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xad70, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 771.751167] binder: BINDER_SET_CONTEXT_MGR already set 10:19:34 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(0xffffffffffffffff, 0x8400ae8e, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 771.774257] binder: 28796:28797 ioctl 40046207 0 returned -16 [ 771.821104] binder: 28796:28809 unknown command 1077953536 [ 771.860650] binder: 28796:28809 ioctl c0306201 20000440 returned -22 10:19:35 executing program 0: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xf2d0, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:35 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0a63084000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:35 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xa933, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:35 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x9}) 10:19:35 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x8400ae8e, &(0x7f0000000080)) [ 772.100532] binder: BC_ATTEMPT_ACQUIRE not supported [ 772.106858] binder: 28833:28835 ioctl c0306201 20000440 returned -22 10:19:35 executing program 0: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0x9650, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 772.172828] binder: BC_ATTEMPT_ACQUIRE not supported [ 772.172855] binder: BINDER_SET_CONTEXT_MGR already set [ 772.203843] binder: 28833:28843 ioctl c0306201 20000440 returned -22 [ 772.223498] binder: 28833:28835 ioctl 40046207 0 returned -16 10:19:35 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x9}) 10:19:35 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xe8cb, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:35 executing program 5: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xad70, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:35 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="003d404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:35 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000705000/0x1000)=nil, 0x1000, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f00006e6000/0x1000)=nil, 0x1000, 0x1000001, 0x8031, r0, 0x0) getdents64(r1, &(0x7f0000000100)=""/111, 0x18) getdents(r1, &(0x7f0000000180)=""/246, 0x4a5bcaa1093729dc) mincore(&(0x7f00006e6000/0x1000)=nil, 0x1000, &(0x7f0000000480)=""/4096) 10:19:35 executing program 0: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0x8ac0, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:35 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x4000000000000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 772.543102] binder: 28866:28869 unknown command 1077951744 [ 772.569339] binder: 28866:28869 ioctl c0306201 20000440 returned -22 10:19:35 executing program 5 (fault-call:3 fault-nth:0): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x8400ae8e, &(0x7f0000000080)) 10:19:35 executing program 0: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0x50f0, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 772.610781] binder_alloc_mmap_handler: 1 callbacks suppressed [ 772.610800] binder_alloc: binder_alloc_mmap_handler: 28866 20001000-20004000 already mapped failed -16 [ 772.640290] binder: BINDER_SET_CONTEXT_MGR already set 10:19:35 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff8000, 0x0, 0x0, 0x0, 0x9}) [ 772.662061] binder: 28866:28877 unknown command 1077951744 10:19:35 executing program 4: openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getdents64(r0, &(0x7f0000000100)=""/111, 0x18) fcntl$getownex(r0, 0x10, &(0x7f0000000040)) getdents(r0, &(0x7f0000000380)=""/246, 0xffffffff00000018) msync(&(0x7f0000346000/0x2000)=nil, 0x2000, 0x3) [ 772.704718] binder: 28866:28875 ioctl 40046207 0 returned -16 [ 772.734890] binder: 28866:28877 ioctl c0306201 20000440 returned -22 10:19:35 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xfe60, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:36 executing program 0: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0x4560, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:36 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0022404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:36 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x8400ae8e, &(0x7f0000000080)) 10:19:36 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80ffff00000000, 0x0, 0x0, 0x0, 0x9}) 10:19:36 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x2000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 772.943363] binder: 28905:28908 unknown command 1077944832 [ 772.972957] binder: 28905:28908 ioctl c0306201 20000440 returned -22 10:19:36 executing program 0: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0x5c8, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 773.016906] binder_alloc: binder_alloc_mmap_handler: 28905 20001000-20004000 already mapped failed -16 10:19:36 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040ae9e, &(0x7f0000000080)) 10:19:36 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xf401, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 773.073454] binder: 28905:28917 unknown command 1077944832 [ 773.073472] binder: BINDER_SET_CONTEXT_MGR already set [ 773.073488] binder: 28905:28908 ioctl 40046207 0 returned -16 [ 773.102296] binder: 28905:28917 ioctl c0306201 20000440 returned -22 10:19:36 executing program 0: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0x9088, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:36 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff00000000, 0x0, 0x0, 0x0, 0x9}) 10:19:36 executing program 4: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f7379732f0000000e000000000000072f6578706972655f6e6f646573745f636f6e6e00", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x4, @mcast2, 0xfffffffffffffffa}, 0x1c) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getdents64(r1, &(0x7f0000000100)=""/111, 0x18) getdents(r1, &(0x7f0000000380)=""/246, 0xffffffff00000018) 10:19:36 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x60, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:36 executing program 0: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xd5e8, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:36 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="7a63404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:36 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0xc008ae91, &(0x7f0000000080)) 10:19:36 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80ffff, 0x0, 0x0, 0x0, 0x9}) [ 773.538879] binder: 28949:28955 unknown command 1077961594 10:19:36 executing program 0: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0x7968, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 773.579544] binder: 28949:28955 ioctl c0306201 20000440 returned -22 10:19:36 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xabd10000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:36 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000, 0x0, 0x0, 0x0, 0x9}) [ 773.630269] binder_alloc: binder_alloc_mmap_handler: 28949 20001000-20004000 already mapped failed -16 10:19:36 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0xc080aebe, &(0x7f0000000080)) 10:19:36 executing program 0: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0x1ce8, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:36 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xe81c, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 773.721716] binder: BINDER_SET_CONTEXT_MGR already set [ 773.734484] binder: 28949:28965 unknown command 1077961594 [ 773.782101] binder: 28949:28955 ioctl 40046207 0 returned -16 [ 773.823307] binder: 28949:28965 ioctl c0306201 20000440 returned -22 10:19:37 executing program 0: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0x3f98, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:37 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff, 0x0, 0x0, 0x0, 0x9}) 10:19:37 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xb4c3, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:37 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0048404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:37 executing program 4 (fault-call:12 fault-nth:0): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) 10:19:37 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x9000aea4, &(0x7f0000000080)) [ 774.151417] binder: 29003:29005 unknown command 1077954560 [ 774.184435] binder: 29003:29005 ioctl c0306201 20000440 returned -22 10:19:37 executing program 0: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0x1720, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:37 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xbec8, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:37 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffdfd, 0x0, 0x0, 0x0, 0x9}) [ 774.227616] binder_alloc: binder_alloc_mmap_handler: 29003 20001000-20004000 already mapped failed -16 [ 774.238904] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 774.263310] FAULT_INJECTION: forcing a failure. [ 774.263310] name fail_page_alloc, interval 1, probability 0, space 0, times 0 10:19:37 executing program 0: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xe740, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 774.306476] CPU: 0 PID: 29015 Comm: syz-executor4 Not tainted 4.19.0-rc8+ #70 [ 774.313815] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 774.323182] Call Trace: [ 774.325800] dump_stack+0x1c4/0x2b4 [ 774.329455] ? dump_stack_print_info.cold.2+0x52/0x52 [ 774.334693] ? check_noncircular+0x20/0x20 [ 774.338959] should_fail.cold.4+0xa/0x17 [ 774.343041] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 774.348161] ? print_usage_bug+0xc0/0xc0 [ 774.352238] ? print_usage_bug+0xc0/0xc0 10:19:37 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x1f4, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 774.356314] ? kasan_check_read+0x11/0x20 [ 774.360473] ? rcu_dynticks_curr_cpu_in_eqs+0x9f/0x160 [ 774.365762] ? print_usage_bug+0xc0/0xc0 [ 774.369848] ? __lock_acquire+0x7ec/0x4ec0 [ 774.374118] ? print_usage_bug+0xc0/0xc0 [ 774.378201] ? print_usage_bug+0xc0/0xc0 [ 774.382282] ? print_usage_bug+0xc0/0xc0 [ 774.386368] ? mark_held_locks+0x130/0x130 [ 774.386422] ? print_usage_bug+0xc0/0xc0 [ 774.386464] __alloc_pages_nodemask+0x34b/0xde0 [ 774.386479] ? __lock_acquire+0x7ec/0x4ec0 [ 774.386494] ? print_usage_bug+0xc0/0xc0 [ 774.386515] ? __alloc_pages_slowpath+0x2d80/0x2d80 [ 774.386539] ? mark_held_locks+0x130/0x130 [ 774.391674] binder: BINDER_SET_CONTEXT_MGR already set [ 774.394842] ? print_usage_bug+0xc0/0xc0 [ 774.394859] ? print_usage_bug+0xc0/0xc0 [ 774.394875] ? __lock_acquire+0x7ec/0x4ec0 [ 774.394903] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 774.394925] alloc_pages_current+0x10c/0x210 [ 774.394949] skb_page_frag_refill+0x45f/0x6a0 [ 774.394968] ? __lock_acquire+0x7ec/0x4ec0 [ 774.403872] ? graph_lock+0x170/0x170 [ 774.403893] ? sock_kzfree_s+0x60/0x60 [ 774.403909] ? print_usage_bug+0xc0/0xc0 [ 774.403935] ? mark_held_locks+0x130/0x130 [ 774.403962] sk_page_frag_refill+0x55/0x1f0 [ 774.421299] binder: 29003:29016 unknown command 1077954560 [ 774.422533] sk_alloc_sg+0x1e9/0xa00 [ 774.422564] ? sk_page_frag_refill+0x1f0/0x1f0 [ 774.422586] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 774.456311] binder: 29003:29016 ioctl c0306201 20000440 returned -22 [ 774.457376] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 774.457398] ? check_preemption_disabled+0x48/0x200 [ 774.457419] ? lock_sock_nested+0x9a/0x120 [ 774.457439] ? lock_sock_nested+0x9a/0x120 [ 774.465250] binder: 29003:29005 ioctl 40046207 0 returned -16 [ 774.469682] alloc_encrypted_sg+0x8b/0x110 [ 774.469704] tls_sw_sendmsg+0xaba/0x1310 [ 774.469722] ? lock_release+0x970/0x970 [ 774.469762] ? decrypt_skb_update+0x6a0/0x6a0 [ 774.469789] ? smack_socket_getpeersec_stream+0x1d0/0x1d0 [ 774.547007] ? usercopy_warn+0x110/0x110 [ 774.551095] inet_sendmsg+0x1a1/0x690 [ 774.554902] ? ipip_gro_receive+0x100/0x100 [ 774.559231] ? smack_socket_sendmsg+0xb0/0x190 [ 774.563819] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 774.569365] ? security_socket_sendmsg+0x94/0xc0 [ 774.574122] ? ipip_gro_receive+0x100/0x100 [ 774.578449] sock_sendmsg+0xd5/0x120 [ 774.582169] __sys_sendto+0x3d7/0x670 [ 774.585981] ? __ia32_sys_getpeername+0xb0/0xb0 [ 774.590670] ? wait_for_completion+0x8a0/0x8a0 [ 774.595263] ? __lock_is_held+0xb5/0x140 [ 774.599354] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 774.604902] ? __sb_end_write+0xd9/0x110 [ 774.608972] ? fput+0x130/0x1a0 [ 774.612255] ? do_syscall_64+0x9a/0x820 [ 774.616237] ? do_syscall_64+0x9a/0x820 [ 774.620220] ? lockdep_hardirqs_on+0x421/0x5c0 [ 774.624826] ? trace_hardirqs_on+0xbd/0x310 [ 774.629164] ? __ia32_sys_read+0xb0/0xb0 [ 774.633248] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 774.638623] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 774.644100] __x64_sys_sendto+0xe1/0x1a0 [ 774.648173] do_syscall_64+0x1b9/0x820 [ 774.652068] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 774.657438] ? syscall_return_slowpath+0x5e0/0x5e0 [ 774.662386] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 774.667237] ? trace_hardirqs_on_caller+0x310/0x310 [ 774.672257] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 774.677283] ? prepare_exit_to_usermode+0x291/0x3b0 [ 774.682307] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 774.687162] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 774.692357] RIP: 0033:0x457569 10:19:37 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4008ae9c, &(0x7f0000000080)) 10:19:37 executing program 0: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0x6248, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 774.695562] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 774.714481] RSP: 002b:00007fdab73bfc78 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 774.722201] RAX: ffffffffffffffda RBX: 00007fdab73bfc90 RCX: 0000000000457569 [ 774.729474] RDX: 000000000039a191 RSI: 00000000200005c0 RDI: 0000000000000003 [ 774.736744] RBP: 000000000072bf00 R08: 0000000020000000 R09: 000000000000001c [ 774.744012] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fdab73c06d4 [ 774.751284] R13: 00000000004c3921 R14: 00000000004d57d8 R15: 0000000000000006 10:19:37 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x40000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:37 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="004f404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) [ 774.855869] binder: 29043:29047 unknown command 1077956352 [ 774.861693] binder: 29043:29047 ioctl c0306201 20000440 returned -22 10:19:38 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x50960000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 774.922448] binder_alloc: binder_alloc_mmap_handler: 29043 20001000-20004000 already mapped failed -16 [ 774.966884] binder: BINDER_SET_CONTEXT_MGR already set [ 774.977951] binder: 29043:29047 ioctl 40046207 0 returned -16 [ 775.004577] binder: 29043:29047 unknown command 1077956352 10:19:38 executing program 4 (fault-call:12 fault-nth:1): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) 10:19:38 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4090ae82, &(0x7f0000000080)) 10:19:38 executing program 0: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0x2e40, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:38 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xc805, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:38 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80ffff, 0x0, 0x0, 0x9}) 10:19:38 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0009404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) [ 775.020334] binder: 29043:29047 ioctl c0306201 20000440 returned -22 [ 775.149870] binder: 29070:29076 unknown command 1077938432 [ 775.162792] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 775.183270] FAULT_INJECTION: forcing a failure. [ 775.183270] name fail_page_alloc, interval 1, probability 0, space 0, times 0 10:19:38 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xe303, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:38 executing program 0: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xbec8, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 775.196891] binder: 29070:29076 ioctl c0306201 20000440 returned -22 [ 775.225566] CPU: 1 PID: 29075 Comm: syz-executor4 Not tainted 4.19.0-rc8+ #70 [ 775.232888] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 775.242261] Call Trace: [ 775.244861] dump_stack+0x1c4/0x2b4 [ 775.248510] ? dump_stack_print_info.cold.2+0x52/0x52 [ 775.253721] should_fail.cold.4+0xa/0x17 [ 775.257792] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 775.262902] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 775.268447] ? check_preemption_disabled+0x48/0x200 [ 775.273474] ? try_charge+0xc2d/0x1690 [ 775.277367] ? get_user_pages_unlocked+0xfd/0x5d0 [ 775.282221] ? mem_cgroup_count_precharge_pte_range+0x760/0x760 [ 775.288283] ? graph_lock+0x170/0x170 [ 775.292094] ? up_read+0x1a/0x110 [ 775.295550] ? get_user_pages_unlocked+0x3b1/0x5d0 [ 775.300491] ? mark_held_locks+0xc7/0x130 [ 775.304651] ? mem_cgroup_charge_skmem+0x1cf/0x390 [ 775.309585] ? mem_cgroup_charge_skmem+0x1cf/0x390 [ 775.314523] ? mem_cgroup_charge_skmem+0x1cf/0x390 [ 775.319455] ? lockdep_hardirqs_on+0x421/0x5c0 [ 775.324045] __alloc_pages_nodemask+0x34b/0xde0 [ 775.328729] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 775.334186] ? __alloc_pages_slowpath+0x2d80/0x2d80 [ 775.339208] ? mem_cgroup_charge_skmem+0x1e4/0x390 [ 775.344148] ? mem_cgroup_sk_free+0x90/0x90 [ 775.348481] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 775.354021] ? tcp_leave_memory_pressure+0x2a/0x110 [ 775.359037] ? tcp_enter_memory_pressure+0x120/0x120 [ 775.364153] ? __sk_mem_raise_allocated+0x721/0x1800 [ 775.369270] ? sk_busy_loop_end+0x1c0/0x1c0 [ 775.373598] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 775.378624] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 775.384183] alloc_pages_current+0x10c/0x210 [ 775.388604] skb_page_frag_refill+0x45f/0x6a0 [ 775.393118] ? sock_kzfree_s+0x60/0x60 [ 775.397023] ? zerocopy_from_iter+0x4dd/0x770 [ 775.401535] sk_page_frag_refill+0x55/0x1f0 [ 775.405865] sk_alloc_sg+0x1e9/0xa00 [ 775.409595] ? sk_page_frag_refill+0x1f0/0x1f0 [ 775.414186] ? tls_sw_push_pending_record+0x30/0x30 [ 775.419208] ? lock_sock_nested+0x9a/0x120 [ 775.423446] ? lock_sock_nested+0x9a/0x120 [ 775.427700] tls_sw_sendmsg+0x714/0x1310 [ 775.431772] ? lock_release+0x970/0x970 [ 775.435773] ? decrypt_skb_update+0x6a0/0x6a0 [ 775.440280] ? smack_socket_getpeersec_stream+0x1d0/0x1d0 [ 775.445823] ? usercopy_warn+0x110/0x110 [ 775.449897] inet_sendmsg+0x1a1/0x690 [ 775.453708] ? ipip_gro_receive+0x100/0x100 [ 775.458034] ? smack_socket_sendmsg+0xb0/0x190 [ 775.462623] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 775.468176] ? security_socket_sendmsg+0x94/0xc0 [ 775.472939] ? ipip_gro_receive+0x100/0x100 [ 775.477266] sock_sendmsg+0xd5/0x120 [ 775.480997] __sys_sendto+0x3d7/0x670 [ 775.484805] ? __ia32_sys_getpeername+0xb0/0xb0 [ 775.489485] ? wait_for_completion+0x8a0/0x8a0 [ 775.494073] ? __lock_is_held+0xb5/0x140 [ 775.498149] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 775.503716] ? __sb_end_write+0xd9/0x110 [ 775.507788] ? fput+0x130/0x1a0 [ 775.511074] ? do_syscall_64+0x9a/0x820 [ 775.515052] ? do_syscall_64+0x9a/0x820 [ 775.519035] ? lockdep_hardirqs_on+0x421/0x5c0 [ 775.523624] ? trace_hardirqs_on+0xbd/0x310 [ 775.527956] ? __ia32_sys_read+0xb0/0xb0 [ 775.532023] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 775.537390] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 775.542847] __x64_sys_sendto+0xe1/0x1a0 [ 775.546938] do_syscall_64+0x1b9/0x820 [ 775.550833] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 775.556200] ? syscall_return_slowpath+0x5e0/0x5e0 [ 775.561135] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 775.565988] ? trace_hardirqs_on_caller+0x310/0x310 [ 775.571010] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 775.576029] ? prepare_exit_to_usermode+0x291/0x3b0 [ 775.581053] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 775.585906] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 775.591095] RIP: 0033:0x457569 [ 775.594291] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 775.613190] RSP: 002b:00007fdab73bfc78 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 775.620902] RAX: ffffffffffffffda RBX: 00007fdab73bfc90 RCX: 0000000000457569 [ 775.628175] RDX: 000000000039a191 RSI: 00000000200005c0 RDI: 0000000000000003 [ 775.635447] RBP: 000000000072bf00 R08: 0000000020000000 R09: 000000000000001c [ 775.642721] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fdab73c06d4 [ 775.649991] R13: 00000000004c3921 R14: 00000000004d57d8 R15: 0000000000000006 10:19:38 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4188aea7, &(0x7f0000000080)) [ 775.690343] binder_alloc: binder_alloc_mmap_handler: 29070 20001000-20004000 already mapped failed -16 [ 775.717875] binder: BINDER_SET_CONTEXT_MGR already set [ 775.733574] binder: 29070:29079 unknown command 1077938432 10:19:38 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xa0730000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:38 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000, 0x0, 0x0, 0x9}) [ 775.749178] binder: 29070:29076 ioctl 40046207 0 returned -16 [ 775.778982] binder: 29070:29079 ioctl c0306201 20000440 returned -22 10:19:39 executing program 0: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xed08, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:39 executing program 4 (fault-call:12 fault-nth:2): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) 10:19:39 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0029404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:39 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x48620000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:39 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x5000aea5, &(0x7f0000000080)) [ 775.982753] binder: 29109:29111 unknown command 1077946624 [ 776.014405] binder: 29109:29111 ioctl c0306201 20000440 returned -22 10:19:39 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x9}) 10:19:39 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0xb0220000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:39 executing program 0: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0x6dd8, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 776.037749] binder_alloc: binder_alloc_mmap_handler: 29109 20001000-20004000 already mapped failed -16 [ 776.070205] binder: BINDER_SET_CONTEXT_MGR already set [ 776.101520] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 776.115475] binder: 29109:29111 ioctl 40046207 0 returned -16 [ 776.134460] FAULT_INJECTION: forcing a failure. [ 776.134460] name failslab, interval 1, probability 0, space 0, times 0 [ 776.136481] binder: 29109:29117 unknown command 1077946624 10:19:39 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0049404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) [ 776.160824] binder: 29109:29117 ioctl c0306201 20000440 returned -22 [ 776.211395] CPU: 1 PID: 29121 Comm: syz-executor4 Not tainted 4.19.0-rc8+ #70 [ 776.218715] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 776.218722] Call Trace: [ 776.218751] dump_stack+0x1c4/0x2b4 [ 776.218777] ? dump_stack_print_info.cold.2+0x52/0x52 [ 776.239533] should_fail.cold.4+0xa/0x17 [ 776.243613] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 776.248738] ? mm_fault_error+0x380/0x380 [ 776.248760] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 10:19:39 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x4b28, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 776.248779] ? graph_lock+0x170/0x170 [ 776.248796] ? graph_lock+0x170/0x170 [ 776.248812] ? graph_lock+0x170/0x170 [ 776.248825] ? graph_lock+0x170/0x170 [ 776.248849] ? lockdep_hardirqs_on+0x421/0x5c0 [ 776.278282] ? retint_kernel+0x2d/0x2d [ 776.278305] ? find_held_lock+0x36/0x1c0 [ 776.278326] ? __lock_is_held+0xb5/0x140 [ 776.278356] ? ___might_sleep+0x1ed/0x300 [ 776.278374] ? arch_local_save_flags+0x40/0x40 [ 776.278394] ? arch_local_save_flags+0x40/0x40 [ 776.290402] __should_failslab+0x124/0x180 [ 776.290425] should_failslab+0x9/0x14 [ 776.290442] __kmalloc+0x2d4/0x760 [ 776.290462] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 776.290477] ? _copy_from_iter+0x39d/0x1090 [ 776.290498] ? tls_push_record+0x107/0x1480 [ 776.328988] ? usercopy_warn+0x110/0x110 [ 776.333071] tls_push_record+0x107/0x1480 [ 776.337238] ? _copy_from_iter_nocache+0x1050/0x1050 [ 776.342365] tls_sw_sendmsg+0xe4b/0x1310 [ 776.346465] ? decrypt_skb_update+0x6a0/0x6a0 [ 776.350986] ? smack_socket_getpeersec_stream+0x1d0/0x1d0 [ 776.356532] ? usercopy_warn+0x110/0x110 [ 776.360607] inet_sendmsg+0x1a1/0x690 [ 776.364425] ? ipip_gro_receive+0x100/0x100 [ 776.368757] ? smack_socket_sendmsg+0xb0/0x190 [ 776.373344] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 776.378886] ? security_socket_sendmsg+0x94/0xc0 [ 776.383650] ? ipip_gro_receive+0x100/0x100 [ 776.387980] sock_sendmsg+0xd5/0x120 [ 776.391700] __sys_sendto+0x3d7/0x670 [ 776.395512] ? __ia32_sys_getpeername+0xb0/0xb0 [ 776.400191] ? wait_for_completion+0x8a0/0x8a0 [ 776.404785] ? __lock_is_held+0xb5/0x140 [ 776.408856] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 776.414409] ? __sb_end_write+0xd9/0x110 [ 776.418479] ? fput+0x130/0x1a0 [ 776.421763] ? do_syscall_64+0x9a/0x820 [ 776.425741] ? do_syscall_64+0x9a/0x820 [ 776.429720] ? lockdep_hardirqs_on+0x421/0x5c0 [ 776.434309] ? trace_hardirqs_on+0xbd/0x310 [ 776.438644] ? __ia32_sys_read+0xb0/0xb0 [ 776.442712] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 776.448079] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 776.453536] __x64_sys_sendto+0xe1/0x1a0 [ 776.457613] do_syscall_64+0x1b9/0x820 [ 776.461510] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 776.466880] ? syscall_return_slowpath+0x5e0/0x5e0 [ 776.471815] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 776.476676] ? trace_hardirqs_on_caller+0x310/0x310 [ 776.481712] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 776.486733] ? prepare_exit_to_usermode+0x291/0x3b0 [ 776.491762] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 776.496619] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 776.501820] RIP: 0033:0x457569 [ 776.505019] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 776.523925] RSP: 002b:00007fdab73bfc78 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 776.531653] RAX: ffffffffffffffda RBX: 00007fdab73bfc90 RCX: 0000000000457569 [ 776.538926] RDX: 000000000039a191 RSI: 00000000200005c0 RDI: 0000000000000003 [ 776.546197] RBP: 000000000072bf00 R08: 0000000020000000 R09: 000000000000001c [ 776.553467] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fdab73c06d4 10:19:39 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x19f, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:39 executing program 0: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xfe60, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 776.560741] R13: 00000000004c3921 R14: 00000000004d57d8 R15: 0000000000000006 10:19:39 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x81a0ae8c, &(0x7f0000000080)) [ 776.600464] binder: 29134:29140 unknown command 1077954816 [ 776.606315] binder: 29134:29140 ioctl c0306201 20000440 returned -22 [ 776.625484] binder_alloc: binder_alloc_mmap_handler: 29134 20001000-20004000 already mapped failed -16 [ 776.636083] binder: BINDER_SET_CONTEXT_MGR already set [ 776.655359] binder: 29134:29140 ioctl 40046207 0 returned -16 [ 776.681012] binder: 29134:29142 unknown command 1077954816 [ 776.718746] binder: 29134:29142 ioctl c0306201 20000440 returned -22 10:19:40 executing program 4 (fault-call:12 fault-nth:3): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x80003, 0x840000000000006) ioctl(r1, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x100000004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) mmap(&(0x7f00000be000/0x3000)=nil, 0x3000, 0x2, 0x100132, 0xffffffffffffffff, 0x0) io_setup(0x0, &(0x7f0000000140)) sendto$inet6(r0, &(0x7f00000005c0), 0x39a191, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) 10:19:40 executing program 0: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xa7a8, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:40 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x56b8, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:40 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff8000, 0x0, 0x0, 0x9}) 10:19:40 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x8138ae83, &(0x7f0000000080)) 10:19:40 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="005c404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) [ 776.912505] binder: 29161:29169 unknown command 1077959680 [ 776.945124] binder: 29161:29169 ioctl c0306201 20000440 returned -22 10:19:40 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x4b8c000000000000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) 10:19:40 executing program 0: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xb900, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 776.969392] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 776.981753] binder_alloc: binder_alloc_mmap_handler: 29161 20001000-20004000 already mapped failed -16 10:19:40 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4004ae99, &(0x7f0000000080)) [ 777.028205] binder: BINDER_SET_CONTEXT_MGR already set [ 777.028214] binder: 29161:29178 unknown command 1077959680 [ 777.028231] binder: 29161:29178 ioctl c0306201 20000440 returned -22 [ 777.051166] FAULT_INJECTION: forcing a failure. [ 777.051166] name failslab, interval 1, probability 0, space 0, times 0 [ 777.057889] binder: 29161:29169 ioctl 40046207 0 returned -16 [ 777.105087] CPU: 0 PID: 29176 Comm: syz-executor4 Not tainted 4.19.0-rc8+ #70 [ 777.112418] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 777.122046] Call Trace: [ 777.124673] dump_stack+0x1c4/0x2b4 [ 777.128326] ? dump_stack_print_info.cold.2+0x52/0x52 [ 777.133540] ? _raw_spin_unlock+0x2c/0x50 [ 777.137714] should_fail.cold.4+0xa/0x17 [ 777.141792] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 777.146912] ? graph_lock+0x170/0x170 [ 777.150731] ? graph_lock+0x170/0x170 10:19:40 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r2, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2a, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="004d404000000000000049024ffe68000000000000000000000000000000000000000000000000000018"], 0x0, 0x0, &(0x7f00000003c0)}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000001400)='/dev/ptmx\x00', 0x0, 0x0) read(0xffffffffffffffff, &(0x7f0000000040)=""/11, 0xffffff3a) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x0, 0x0) 10:19:40 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffdfd, 0x0, 0x0, 0x9}) [ 777.154540] ? graph_lock+0x170/0x170 [ 777.154555] ? graph_lock+0x170/0x170 [ 777.154583] ? find_held_lock+0x36/0x1c0 [ 777.154609] ? is_bpf_text_address+0xac/0x170 [ 777.170764] ? lock_downgrade+0x900/0x900 [ 777.174942] ? check_preemption_disabled+0x48/0x200 [ 777.178719] binder: 29188:29189 unknown command 1077955840 [ 777.179981] ? rcu_read_unlock_special.part.39+0x11f0/0x11f0 [ 777.179996] ? kasan_check_read+0x11/0x20 [ 777.180014] ? rcu_dynticks_curr_cpu_in_eqs+0x9f/0x160 [ 777.180032] ? rcu_bh_qs+0xc0/0xc0 [ 777.180050] ? rcu_bh_qs+0xc0/0xc0 [ 777.180064] ? unwind_dump+0x190/0x190 [ 777.180087] __should_failslab+0x124/0x180 [ 777.186126] binder: 29188:29189 ioctl c0306201 20000440 returned -22 [ 777.191528] should_failslab+0x9/0x14 [ 777.191545] __kmalloc+0x63/0x760 [ 777.191561] ? __kernel_text_address+0xd/0x40 [ 777.191579] ? unwind_get_return_address+0x61/0xa0 [ 777.191599] ? gcmaes_encrypt.constprop.15+0x886/0x1190 [ 777.191622] gcmaes_encrypt.constprop.15+0x886/0x1190 [ 777.191669] ? generic_gcmaes_decrypt+0x190/0x190 [ 777.208155] ? tls_push_record+0x107/0x1480 [ 777.208171] ? tls_sw_sendmsg+0xe4b/0x1310 [ 777.208187] ? inet_sendmsg+0x1a1/0x690 [ 777.208202] ? sock_sendmsg+0xd5/0x120 [ 777.208216] ? __sys_sendto+0x3d7/0x670 [ 777.208235] ? __x64_sys_sendto+0xe1/0x1a0 [ 777.216358] ? do_syscall_64+0x1b9/0x820 [ 777.216376] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 777.216393] ? retint_kernel+0x2d/0x2d [ 777.216414] ? find_held_lock+0x36/0x1c0 [ 777.216432] ? graph_lock+0x170/0x170 [ 777.216453] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 777.216472] ? check_preemption_disabled+0x48/0x200 [ 777.216488] ? check_preemption_disabled+0x48/0x200 [ 777.216521] generic_gcmaes_encrypt+0x12d/0x186 [ 777.245829] binder_alloc: binder_alloc_mmap_handler: 29188 20001000-20004000 already mapped failed -16 [ 777.250201] ? generic_gcmaes_encrypt+0x12d/0x186 [ 777.250220] ? helper_rfc4106_encrypt+0x4a0/0x4a0 [ 777.250240] ? rcu_read_lock_sched_held+0x108/0x120 [ 777.250259] ? __kmalloc+0x5de/0x760 [ 777.250281] gcmaes_wrapper_encrypt+0x162/0x200 [ 777.250305] tls_push_record+0x9ca/0x1480 [ 777.357579] tls_sw_sendmsg+0xe4b/0x1310 [ 777.361680] ? decrypt_skb_update+0x6a0/0x6a0 [ 777.366190] ? smack_socket_getpeersec_stream+0x1d0/0x1d0 [ 777.371731] ? usercopy_warn+0x110/0x110 [ 777.375807] inet_sendmsg+0x1a1/0x690 [ 777.379649] ? ipip_gro_receive+0x100/0x100 [ 777.383978] ? smack_socket_sendmsg+0xb0/0x190 [ 777.388567] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 777.394113] ? security_socket_sendmsg+0x94/0xc0 [ 777.398873] ? ipip_gro_receive+0x100/0x100 [ 777.403201] sock_sendmsg+0xd5/0x120 [ 777.406920] __sys_sendto+0x3d7/0x670 [ 777.410732] ? __ia32_sys_getpeername+0xb0/0xb0 [ 777.415407] ? wait_for_completion+0x8a0/0x8a0 [ 777.420002] ? __lock_is_held+0xb5/0x140 [ 777.424072] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 777.429622] ? __sb_end_write+0xd9/0x110 [ 777.433705] ? fput+0x130/0x1a0 [ 777.436988] ? do_syscall_64+0x9a/0x820 [ 777.440968] ? do_syscall_64+0x9a/0x820 [ 777.444952] ? lockdep_hardirqs_on+0x421/0x5c0 [ 777.449554] ? trace_hardirqs_on+0xbd/0x310 [ 777.453878] ? __ia32_sys_read+0xb0/0xb0 [ 777.457947] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 777.463339] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 777.468805] __x64_sys_sendto+0xe1/0x1a0 [ 777.472878] do_syscall_64+0x1b9/0x820 [ 777.476768] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 777.482141] ? syscall_return_slowpath+0x5e0/0x5e0 [ 777.487075] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 777.491928] ? trace_hardirqs_on_caller+0x310/0x310 [ 777.496949] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 777.501973] ? prepare_exit_to_usermode+0x291/0x3b0 [ 777.507001] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 777.511862] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 777.517050] RIP: 0033:0x457569 [ 777.520249] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 777.539424] RSP: 002b:00007fdab73bfc78 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 777.547147] RAX: ffffffffffffffda RBX: 00007fdab73bfc90 RCX: 0000000000457569 10:19:40 executing program 2: r0 = socket(0x40000000002, 0x3, 0x67) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000300)='bridge0\x00', 0x10) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f00000000c0)='cgroup.controllers\x00', 0x0, 0x0) preadv(r2, &(0x7f00000024c0)=[{&(0x7f0000000040)=""/18, 0x12}, {&(0x7f0000000080)=""/4, 0x4}], 0x2, 0x0) sendto$unix(r0, &(0x7f0000000080), 0xffeb, 0x78280000, &(0x7f0000000d00)=@abs={0x0, 0x0, 0xd0000e0}, 0x63) [ 777.554423] RDX: 000000000039a191 RSI: 00000000200005c0 RDI: 0000000000000003 [ 777.561702] RBP: 000000000072bf00 R08: 0000000020000000 R09: 000000000000001c [ 777.568973] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fdab73c06d4 [ 777.576246] R13: 00000000004c3921 R14: 00000000004d57d8 R15: 0000000000000006 [ 777.684370] binder: BINDER_SET_CONTEXT_MGR already set [ 777.708042] binder: 29188:29205 unknown command 1077955840 [ 777.728947] binder: 29188:29189 ioctl 40046207 0 returned -16 [ 777.745935] binder: 29188:29205 ioctl c0306201 20000440 returned -22 [ 777.747737] ================================================================== [ 777.760118] BUG: KASAN: use-after-free in tls_push_record+0x10b9/0x1480 [ 777.766884] Write of size 1 at addr ffff880188538000 by task syz-executor4/29176 [ 777.774409] [ 777.774429] CPU: 1 PID: 29176 Comm: syz-executor4 Not tainted 4.19.0-rc8+ #70 [ 777.783315] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 777.783326] Call Trace: [ 777.795266] dump_stack+0x1c4/0x2b4 [ 777.798914] ? dump_stack_print_info.cold.2+0x52/0x52 [ 777.804108] ? printk+0xa7/0xcf [ 777.807402] ? kmsg_dump_rewind_nolock+0xe4/0xe4 [ 777.812171] print_address_description.cold.8+0x9/0x1ff [ 777.817542] kasan_report.cold.9+0x242/0x309 [ 777.821954] ? tls_push_record+0x10b9/0x1480 [ 777.826370] __asan_report_store1_noabort+0x17/0x20 [ 777.831391] tls_push_record+0x10b9/0x1480 [ 777.835646] ? trace_hardirqs_on+0xbd/0x310 [ 777.839981] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 777.845529] tls_sw_push_pending_record+0x22/0x30 [ 777.850378] tls_push_pending_closed_record+0x10c/0x150 [ 777.855747] ? lock_sock_nested+0xe2/0x120 [ 777.859990] tls_sk_proto_close+0x7c2/0xbb0 [ 777.864312] ? lock_acquire+0x1ed/0x520 [ 777.868290] ? tcp_check_oom+0x530/0x530 [ 777.872372] ? tls_write_space+0x390/0x390 [ 777.876610] ? arch_local_save_flags+0x40/0x40 [ 777.881211] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 777.886749] ? ipv6_sock_ac_close+0x34f/0x470 [ 777.891249] ? ipv6_sock_mc_close+0x162/0x1d0 [ 777.895745] ? ip_mc_drop_socket+0x20b/0x270 [ 777.900163] ? down_write+0x8a/0x130 [ 777.903886] inet_release+0x104/0x1f0 [ 777.907693] inet6_release+0x50/0x70 [ 777.911407] __sock_release+0xd7/0x250 [ 777.915295] ? __sock_release+0x250/0x250 [ 777.919444] sock_close+0x19/0x20 [ 777.922897] __fput+0x385/0xa30 [ 777.926185] ? get_max_files+0x20/0x20 [ 777.930073] ? trace_hardirqs_on+0xbd/0x310 [ 777.934395] ? kasan_check_read+0x11/0x20 [ 777.938547] ? task_work_run+0x1af/0x2a0 [ 777.942612] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 777.948075] ? kasan_check_write+0x14/0x20 [ 777.952315] ? do_raw_spin_lock+0xc1/0x200 [ 777.956554] ____fput+0x15/0x20 [ 777.959838] task_work_run+0x1e8/0x2a0 [ 777.963730] ? task_work_cancel+0x240/0x240 [ 777.968067] get_signal+0x155e/0x1980 [ 777.971881] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 777.977426] ? check_preemption_disabled+0x48/0x200 [ 777.982447] ? ptrace_notify+0x130/0x130 [ 777.986524] ? kick_process+0xed/0x170 [ 777.990419] ? task_work_add+0x123/0x1f0 [ 777.994484] ? cpumask_weight.constprop.5+0x3f/0x3f [ 777.999507] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 778.005049] ? security_socket_sendmsg+0x94/0xc0 [ 778.009812] do_signal+0x9c/0x21e0 [ 778.013369] ? __sys_sendto+0x475/0x670 [ 778.017351] ? __ia32_sys_getpeername+0xb0/0xb0 [ 778.022025] ? setup_sigcontext+0x7d0/0x7d0 [ 778.026353] ? __lock_is_held+0xb5/0x140 [ 778.030423] ? exit_to_usermode_loop+0x8c/0x380 [ 778.035095] ? exit_to_usermode_loop+0x8c/0x380 [ 778.039767] ? lockdep_hardirqs_on+0x421/0x5c0 [ 778.044357] ? trace_hardirqs_on+0xbd/0x310 [ 778.048678] ? __sb_end_write+0xd9/0x110 [ 778.052744] ? do_syscall_64+0x6be/0x820 [ 778.056809] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 778.062259] ? fput+0x130/0x1a0 [ 778.065545] ? do_syscall_64+0x9a/0x820 [ 778.069521] ? do_syscall_64+0x9a/0x820 [ 778.073501] exit_to_usermode_loop+0x2e5/0x380 [ 778.078088] ? syscall_slow_exit_work+0x520/0x520 [ 778.082938] ? __x64_sys_sendto+0xe1/0x1a0 [ 778.087185] do_syscall_64+0x6be/0x820 [ 778.091078] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 778.096449] ? syscall_return_slowpath+0x5e0/0x5e0 [ 778.101379] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 778.106224] ? trace_hardirqs_on_caller+0x310/0x310 [ 778.111244] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 778.116265] ? prepare_exit_to_usermode+0x291/0x3b0 [ 778.121772] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 778.126635] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 778.131829] RIP: 0033:0x457569 [ 778.135029] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 778.153934] RSP: 002b:00007fdab73bfc78 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 778.161654] RAX: 0000000000004000 RBX: 00007fdab73bfc90 RCX: 0000000000457569 [ 778.168936] RDX: 000000000039a191 RSI: 00000000200005c0 RDI: 0000000000000003 [ 778.176203] RBP: 000000000072bf00 R08: 0000000020000000 R09: 000000000000001c [ 778.183481] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fdab73c06d4 [ 778.190756] R13: 00000000004c3921 R14: 00000000004d57d8 R15: 0000000000000006 [ 778.198041] [ 778.199668] The buggy address belongs to the page: [ 778.204601] page:ffffea0006214e00 count:0 mapcount:-128 mapping:0000000000000000 index:0x0 [ 778.213065] flags: 0x2fffc0000000000() [ 778.216959] raw: 02fffc0000000000 ffffea0006281208 ffffea000627d408 0000000000000000 [ 778.224844] raw: 0000000000000000 0000000000000003 00000000ffffff7f 0000000000000000 [ 778.232720] page dumped because: kasan: bad access detected [ 778.238435] [ 778.240079] Memory state around the buggy address: [ 778.245012] ffff880188537f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 778.252376] ffff880188537f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 778.259740] >ffff880188538000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 778.267093] ^ [ 778.270460] ffff880188538080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 778.277822] ffff880188538100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 778.285186] ================================================================== [ 778.292549] Disabling lock debugging due to kernel taint [ 778.335876] Kernel panic - not syncing: panic_on_warn set ... [ 778.335876] [ 778.343310] CPU: 1 PID: 29176 Comm: syz-executor4 Tainted: G B 4.19.0-rc8+ #70 [ 778.351979] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 778.361329] Call Trace: [ 778.363910] dump_stack+0x1c4/0x2b4 [ 778.367527] ? dump_stack_print_info.cold.2+0x52/0x52 [ 778.372709] panic+0x238/0x4e7 [ 778.375885] ? add_taint.cold.5+0x16/0x16 [ 778.380020] ? preempt_schedule+0x4d/0x60 [ 778.384158] ? ___preempt_schedule+0x16/0x18 [ 778.388571] ? trace_hardirqs_on+0xb4/0x310 [ 778.392884] kasan_end_report+0x47/0x4f [ 778.396846] kasan_report.cold.9+0x76/0x309 [ 778.401157] ? tls_push_record+0x10b9/0x1480 [ 778.405554] __asan_report_store1_noabort+0x17/0x20 [ 778.410557] tls_push_record+0x10b9/0x1480 [ 778.414777] ? trace_hardirqs_on+0xbd/0x310 [ 778.419088] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 778.424614] tls_sw_push_pending_record+0x22/0x30 [ 778.429451] tls_push_pending_closed_record+0x10c/0x150 [ 778.434802] ? lock_sock_nested+0xe2/0x120 [ 778.439023] tls_sk_proto_close+0x7c2/0xbb0 [ 778.443330] ? lock_acquire+0x1ed/0x520 [ 778.447290] ? tcp_check_oom+0x530/0x530 [ 778.451349] ? tls_write_space+0x390/0x390 [ 778.455569] ? arch_local_save_flags+0x40/0x40 [ 778.460161] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 778.465682] ? ipv6_sock_ac_close+0x34f/0x470 [ 778.470166] ? ipv6_sock_mc_close+0x162/0x1d0 [ 778.474650] ? ip_mc_drop_socket+0x20b/0x270 [ 778.479043] ? down_write+0x8a/0x130 [ 778.482742] inet_release+0x104/0x1f0 [ 778.486530] inet6_release+0x50/0x70 [ 778.490229] __sock_release+0xd7/0x250 [ 778.494113] ? __sock_release+0x250/0x250 [ 778.498246] sock_close+0x19/0x20 [ 778.501682] __fput+0x385/0xa30 [ 778.504963] ? get_max_files+0x20/0x20 [ 778.508841] ? trace_hardirqs_on+0xbd/0x310 [ 778.513148] ? kasan_check_read+0x11/0x20 [ 778.517281] ? task_work_run+0x1af/0x2a0 [ 778.521326] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 778.526793] ? kasan_check_write+0x14/0x20 [ 778.531015] ? do_raw_spin_lock+0xc1/0x200 [ 778.535235] ____fput+0x15/0x20 [ 778.538511] task_work_run+0x1e8/0x2a0 [ 778.542413] ? task_work_cancel+0x240/0x240 [ 778.546724] get_signal+0x155e/0x1980 [ 778.550511] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 778.556034] ? check_preemption_disabled+0x48/0x200 [ 778.561035] ? ptrace_notify+0x130/0x130 [ 778.565082] ? kick_process+0xed/0x170 [ 778.568953] ? task_work_add+0x123/0x1f0 [ 778.572996] ? cpumask_weight.constprop.5+0x3f/0x3f [ 778.577998] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 778.583525] ? security_socket_sendmsg+0x94/0xc0 [ 778.588271] do_signal+0x9c/0x21e0 [ 778.591798] ? __sys_sendto+0x475/0x670 [ 778.595756] ? __ia32_sys_getpeername+0xb0/0xb0 [ 778.600406] ? setup_sigcontext+0x7d0/0x7d0 [ 778.604714] ? __lock_is_held+0xb5/0x140 [ 778.608763] ? exit_to_usermode_loop+0x8c/0x380 [ 778.613417] ? exit_to_usermode_loop+0x8c/0x380 [ 778.618072] ? lockdep_hardirqs_on+0x421/0x5c0 [ 778.622650] ? trace_hardirqs_on+0xbd/0x310 [ 778.626959] ? __sb_end_write+0xd9/0x110 [ 778.631002] ? do_syscall_64+0x6be/0x820 [ 778.635048] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 778.640480] ? fput+0x130/0x1a0 [ 778.643741] ? do_syscall_64+0x9a/0x820 [ 778.647700] ? do_syscall_64+0x9a/0x820 [ 778.651662] exit_to_usermode_loop+0x2e5/0x380 [ 778.656230] ? syscall_slow_exit_work+0x520/0x520 [ 778.661059] ? __x64_sys_sendto+0xe1/0x1a0 [ 778.665286] do_syscall_64+0x6be/0x820 [ 778.669161] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 778.674507] ? syscall_return_slowpath+0x5e0/0x5e0 [ 778.679418] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 778.684245] ? trace_hardirqs_on_caller+0x310/0x310 [ 778.689248] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 778.694249] ? prepare_exit_to_usermode+0x291/0x3b0 [ 778.699252] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 778.704081] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 778.709255] RIP: 0033:0x457569 [ 778.712435] Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 778.731328] RSP: 002b:00007fdab73bfc78 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 778.739029] RAX: 0000000000004000 RBX: 00007fdab73bfc90 RCX: 0000000000457569 [ 778.746298] RDX: 000000000039a191 RSI: 00000000200005c0 RDI: 0000000000000003 [ 778.753569] RBP: 000000000072bf00 R08: 0000000020000000 R09: 000000000000001c [ 778.760821] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fdab73c06d4 [ 778.768076] R13: 00000000004c3921 R14: 00000000004d57d8 R15: 0000000000000006 [ 778.776345] Kernel Offset: disabled [ 778.779971] Rebooting in 86400 seconds..