ss owning it [ 786.629168] binder: 341:342 transaction failed 29201/-22, size 0-0 line 2843 [ 786.649532] binder: 344:353 BC_FREE_BUFFER u0000000000000000 no match 22:55:36 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x3a000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:55:36 executing program 7: syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x0, 0x0, 0x0, 0xe0]}) 22:55:36 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000007}}}}}}, &(0x7f0000ea3000)) [ 786.672609] binder: undelivered TRANSACTION_ERROR: 29201 [ 786.678845] binder: 344:353 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 786.685813] binder: 344:353 got reply transaction with no transaction stack [ 786.693241] binder: 344:353 transaction failed 29201/-71, size 0-8 line 2759 22:55:36 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$sock_SIOCSIFBR(r0, 0x8941, &(0x7f0000000140)=@get={0x1, &(0x7f00000000c0)=""/85, 0x3}) pipe(&(0x7f0000000040)={0xffffffffffffffff}) getsockopt$bt_BT_SECURITY(r1, 0x112, 0x4, &(0x7f0000000080), 0x2) sendmsg$nl_xfrm(r0, &(0x7f0000000200)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000240)={&(0x7f0000000740)=@newsa={0x138, 0x10, 0x309, 0x0, 0x0, {{@in6=@loopback={0x0, 0x1}, @in6=@mcast1={0xff, 0x1, [], 0x1}}, {@in6=@ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}, 0x0, 0x33}, @in6=@ipv4={[], [0xff, 0xff], @loopback=0x7f000001}, {}, {}, {}, 0x0, 0x0, 0xa}, [@algo_crypt={0x48, 0x2, {{'cbc-blowfish-asm\x00'}}}]}, 0x138}, 0x1}, 0x0) [ 786.746959] binder: 344:359 BC_FREE_BUFFER u0000000000000000 no match [ 786.794263] binder: 344:359 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 786.801159] binder: 344:359 got reply transaction with no transaction stack [ 786.808349] binder: 344:359 transaction failed 29201/-71, size 0-8 line 2759 22:55:37 executing program 7: syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x0, 0x0, 0x0, 0x700000000000000]}) 22:55:37 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0xf5ffffff00000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:55:37 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000008}}}}}}, &(0x7f0000ea3000)) 22:55:37 executing program 4: r0 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) getsockopt$EBT_SO_GET_INIT_ENTRIES(r0, 0x0, 0x83, &(0x7f0000000180)={'filter\x00', 0x0, 0x4, 0x70, [], 0x5, &(0x7f0000000080)=[{}, {}, {}, {}, {}], &(0x7f0000000100)=""/112}, &(0x7f0000000200)=0x78) ioctl$int_out(r0, 0xc0884113, &(0x7f0000000040)) [ 786.975867] binder: undelivered TRANSACTION_ERROR: 29201 [ 786.981492] binder: undelivered TRANSACTION_ERROR: 29201 22:55:37 executing program 7: syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x0, 0x0, 0x0, 0xe000]}) 22:55:37 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) 22:55:37 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x2f000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:55:37 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8000000000008912, &(0x7f0000000000)="025cc83d6d345f8f760070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00003b9fdc)) r2 = syz_open_pts(r1, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(r1, 0x540e, 0x0) r3 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1000000000016) 22:55:37 executing program 4: r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x40, 0x0) timerfd_create(0x7, 0x80800) ioctl$sock_inet_SIOCGIFDSTADDR(r0, 0x8917, &(0x7f0000000040)={'bcsh0\x00', {0x2, 0x4e20, @remote={0xac, 0x14, 0x14, 0xbb}}}) alarm(0x6) 22:55:37 executing program 6: r0 = socket$kcm(0xa, 0x6, 0x0) openat$cuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cuse\x00', 0x0, 0x0) r1 = memfd_create(&(0x7f0000000040)='\x00', 0x2) setsockopt$sock_attach_bpf(r1, 0x10d, 0x12, &(0x7f0000000080)=r1, 0x4) fcntl$F_SET_FILE_RW_HINT(r1, 0x40e, &(0x7f00000000c0)) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000100)=0x0) tkill(r2, 0x2b) 22:55:37 executing program 0: r0 = syz_open_dev$sndseq(&(0x7f0000001540)='/dev/snd/seq\x00', 0x0, 0x0) readv(r0, &(0x7f0000000080)=[{&(0x7f0000001340)=""/150, 0x96}], 0x1) r1 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x12}, &(0x7f0000044000)) close(r0) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) r2 = socket$inet6(0xa, 0x200000000000802, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x2, 0x32, 0xffffffffffffffff, 0x0) timer_create(0x7, &(0x7f00000000c0)={0x0, 0x11, 0x4, @tid=r1}, &(0x7f0000000140)) tkill(r1, 0x1000000000016) 22:55:37 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000006}}}}}}, &(0x7f0000ea3000)) 22:55:37 executing program 6: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000009000/0x18000)=nil, &(0x7f0000000280)=[@textreal={0x8, &(0x7f00000002c0)="366536f26f660f22c066b871e5ee230f23c80f21f86635040030000f23f80f38f0b7cedb66b9ab0a000066b80300000066ba000000000f300f01cf66b8b4c800000f23d00f21f866353000000f0f23f8ba410066ed66b9be09000066b80000000066ba008000000f30f30f001e0000", 0x6f}], 0x1, 0x24, &(0x7f00000001c0), 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = socket$inet6(0xa, 0x1, 0x0) ioctl(r3, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") timer_create(0x7, &(0x7f0000000140)={0x0, 0xc, 0x2, @thr={&(0x7f0000000000)="33695888b485d916b123b145c4971f0e1199015bf519284dc2d71dafb6544e0347e0b1e345b8bc1cbf85500571395eeab7cd5dc85bca89fa1e5775894159e9cdfbefc8e9d64dcc347fa1b1f7f9261a9d99b25d3e47b008328216086b9bc3a7f675038d02f855e92f9ec00e1c2f8a6db132431241262e4abb669711329c819b246e9dff8f9a5cd83f5665a2f18def70db797a8132d13a8761fa55e566f1a35a31c0c4e291592e69ae5def33d4869183504fb99375ea7911cb153dbe1596e0d3d702345739bb3704ea847741baa8df76da6ddb155b04c760e54e46a0", &(0x7f00000001c0)="8f14e9a38078f66d7d5fa9faeb3743c7563afccb9ce8208268442aa5d3a3cdb90d948bd41d874406ed9aea5b6132440991734664a50f259c033b6c6b9397b1aac5a130b585332caa29d65baec395a10e"}}, &(0x7f0000000240)=0x0) timer_delete(r4) ioctl$KVM_RUN(r2, 0xae80, 0x0) 22:55:37 executing program 4: sendmsg$alg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001340)=[{&(0x7f0000000340)="d2d2b7bf3c547ca55b450a644a37857b2f9bff4e396c33167db2d8bf001a851c6e16b60c822e4198df9c6c648c52c87c6fa0a3f1040e1a1737263d96938142152040ececd644274603d1ab4f7097267aa1db8803d6eccb5780b4f28986dd9fce416007dd58736289d698a35aaf37f515e3c52f77b6d6dda5a41ec9d5a594465e984a7d40251b74c78b01bc9a69946e3f69b27b6655ee980e440d0306d0edcdc9d99f93229b62f4ec56826b43a331b1fe3d29c68f458761c0527610a00b12a2b8ec4e26f63745038436d3817e8590250170d46bdf7196fe94c1c862d8f68ff3f096e2e8a86d506a3c5719ab9f665ed30530d3c08b6c4966f77fe13c51aa640a4a4ac6109424b72ee2280b8eaf000e18c67b6fdf479800b6f0b79707a7f49ae0a2c9867ad155b314b3a771752284b3c46dc0eed6af666a1f48c212b0acef45ca6fb4fd4e2121ab7fd4cf5179fea647f01b395b13b6e15ba547bd8a0d50f93cf2b3104a84a4783da0a96156b8f70559a50eccf33302706af387a408db5660c934c6398ed7463dfd1f218294f3798e499092a8837d25a243b29a9c2fc7ef1c51e956075b9d2e7c0bbbd9dcf6e1e79164472367fa5252cfcad312b9cfe2cdfab319a5cc9c794338ad8f8cbac04c627129990fdb2670ede015de9808d06188af8967398a55804ce019131bcbdebc30647c526a0e7cc3c45360a0cf793815a9a34af98901a6bf1500af7f7de7fc0e567bade21ac1d74f26da08584a0f7d77b1ec5d74808253ecfba43222abe84e4b5a24aa162d150a75ccc5c16949f09602e09e6d01cbdedfcade5776ce87d313d5d1811a1a362b2f4847fd676c91bf539259209bd8c3eef11b500a5d00018cc8ee58877fb7214e0f98be10ac541d5c3a15b8118b7614248300b530b103d324106d68a92946a467dc80dc5558145647bf2b87fbd15fb0d3946f5469ca89b66b477f378743cb8a31905f731a48633c8dcf7f68c4313288836fd8aac63254aaaa5d2a9105efc9fd6afc142f1a165333ab8395f1f6b78831595967960955dd6999c46bca1c1ec9d0ec06bbd53a78275728cee58c1e31452b09a29f5e26484cf752e47cb9db554837b3c835049d626fd2f3f79d1a691e66cf68e7cd876bde8c8e1d91fbfd41125fe455ed335e91a2c7e4734b2742ea189bac10feb3e21c2ffdc1639b36693e7273319e9f6a3628be6e4e6810647f368c6565fc3bc36dff2c49959d4e03926739625332cd38b450c14eb8989470e3f2672281a8c9e1ed71255ffb8fd15c9a6cd6f83602fb33661f4ff9c5e6d4bd5cad7398faa1b5fea188d42ce3a8c1bed1ceecec990ce64a51af0f114740799779747af6dcd4b534d7b1bbf1c49246c685c16a3fff7cb6724815bab9f8b386b48b5a39b6028b4243522d3937d5c89ffd243b864a30b4d77e0adabbef799960b4881b0574d02c8a3438e1f651044e09b676f06654ad265bf56e29fa5a06c634b1776cf4fb15d32c0b6eb22cee2a9240590e44032d42f6d9d5ae9d4976945f7e19ab86a84ce939d63a1377a5be92c2307b8bbe3c83a929d3c20742bdff76f97944d9b438fc75d75db46be5a73c554a7767df2d19a7273c4c629e755776591215fff0f0dbbae5a71fc9dce7736c3706e4ef958e0995388b1e96a6aedb6f4f9292b1fb076da1d715cdd98addeed6cdd9bba63f77c8aac429eafdfc09f466eb373a1ade6da6b0db8a283755afb0109e102fd21ff82c9c45ec6d74458305d94dffa8ffd810377e64827d6ca2fa188ddd0920ef5db4a0dd1ddf0c1f98aa42907f95f326f8f69a371dc5242be8d464725bc118983ccbe790a6618bfd4f804432dfd3cd727aa723efd81dfe06bba17da40563f0c5b66636f26612e85c268405609aad283150c6cc34879b5d70df037ab20f59ca4935c94f7939f0f5ac748b9ffce661a7bc9abd04678c4cc832e94f8fb4515a7632202efd70af3d0d6151cd55792f4ce792d0fe93e80f0f0ad4cd7c01e594ea0e1241024fc00fd2da7e5b7fae57e0822e26d9ae29b5a6363f00b3d6ac9cd2ebc8fcf06e7b9f40767f0302484b3c3fdd3d3bddccdd2da700ed57fc29528903393bcd8218d0fae2a8c2dc8816fd68a9338112c5861bae450ecd5be56be201681f5b426bae096d815fb5e38cf2f3de73b2c77d9dd14d9b7fd3ddada76cd626384153c4f4e4e33343030f75dbf7e6abb3d458910cb6c2c4655c9662af0a7209c4259a5333e5e7236b8f8f471c755b76578c187c20f01d387ea9563a8a5fbcda2839ab4d6cd710fce95e19674a9bf3f44b700d52653b3e20a5c3252d8d6adda34af0171ead0011b18de841375be3a9957b850ced9e152a1244dc497c137dbc7f0c6fa5f5d6d32bd5dfe9e5b97116f396441304b999ea4e39f9e60cedf6003e411910feb9e51531d2df7af9464370d522964b2fa1b0286af0779d2beae9a984a086b7441d68f673046af4628bcd54a0ac9c18392bbd5ed2b5a102729fc4fb83356f8d2216a0ce1c533a63a5740ac0da3293fad0574ad94fe1834e393fc17ac9c1b72f5907f5667c11c46ad1dab69cd2c25d735b32329b94bebe6b3b65248b0885bce2a6778a395307b0d2d0dbe6b5e3c0086c2472636b634ba5e9fb32413503397f787b7530c1ce3b178ac8eee4ccf03b701b5fa343075bdb3a95708c24cb880e2dc10d8a013cae0d4eb564084a1e4dcce48130c174aed19dbc76186292c6d1efeacf8ceffdd9d988aef86b4bc354d50790252c396f0119de562c35a1f5bba208b3703c59c4bdecc903ef0f5c3a83e9638829ee92817995fc24a2c1cd9876e97dbe1ea8ace395d224267d0c7d50d0ad991a2e85ff7cb83e23b4ec6e49151bfcdf831375c82f08ce393497ab2b7a2d0d1ee2887c81cd1f735264b79db4fcc5c984c28a7963584ab65dac1d5bf6c0c5c5788f5702523b880cb6099ef56a36d3d2942412b2c2cd030926d6fc9841de4b029677678148c37b22f3b2b83ef56bfea6e798167d2db547c8b64cdf64af90206dd8e5ab5acc8724351377eb47f619477e5c4d0ff537705abbf2297cc3e05488273b5230d18365f9225ac0220ef51501e11131401893707f20da62e2116b9677adf45b795fd40b73344fdf3b11e86cb3720e86397b66c3cfbdf30690d7820ecccb9ff1128aa4a35fb0e01573fd62c275c109094b4e1c1fec56384715badf7b99889b0ba660e008c63f67a0ac8afa1c65fac0ddf7780113fa74bd302492631fe847d1be6cf82e3a46fb657e479b64c4647c4617c9956a77cd5db46c74b5579912f69c633d84bfa7c81fd9f3f84dfda7e930b6f02d82ed3be50cac3dc0e313d32d47d7ff18743d8f21a3b6c3ee35c4ff3c1eb7387ad9210cbeff58623fda5496391bfa21fbbcf2377621fb4a47b0bbf969704e5c34e49a8e02eef6cba6454eeb7fc38f21b8e0cfee0d2d7d4f9dd8f612f01de5f9be6b36a8f101a717a3c986804f54e9c10411f3792563e0e2cf0783cf01dbf8994475911640766dce58b787182d81ad2510026a4b8fbff96322f07bc616dbf861ff9c8ce0526cfe96797c48800f41a68b3a0cc3caf18913af60784ca54c89726a97965db9e24fee600bf74d4ff16d8ae60a31e7022cd8cbea65c5881fc2f1fa42fbc6bdeb2610fe558da4d6e8adc80470065b17e30dca82572d424ecd838fb4bb0cea67557aed465600759dcd55824ae4752dffa67908c099ab0af82ecf0ccaeb74e1a4455e5bd84d6e19aff10c5b0040b4fba6407f10630ffff4d71a5fbede849b5e143ceed4ce18a53e7181bee200a65e8620229ab8f795c0107b22be14e8a2d47aaed3f833037ae8deb7411486944d7a062fb2cbe5b360559835852636ec003f31c73b42dcafc0477e97a43cdac0a3f411fcb64c54ed59164ed0ce968acfbc1b4872c40682e97627034504ed512d293282028503ac2d21a56f9249622173e7a3cd7d42eacbebf6c1cb0ec35240e4ecca6ca1d0ee312f2971f36400c1fff3c36270f4b7bf20df5cc2e7d455eb61e20dcda0691c9c07257252ef674caab6d14fbf227b033a461298110cbde7561e9a5b1cecf32e94e28df2e1fb9202c71560425d7640fa1b3738e52b0f29e176a1cb37e4a31beb41c3d920e9d3de136e5273cad51e73749e347cd8c4578ee911fc211b085b06dd5cc7c8c765a2e55ab175d22e284cc2052e46f6b879d3e4a96995130016110ad077aef6f2afacdef45fccbe0f269b13edb12347f33aaa2e6fa12058e7bc31693d5d3d26f670027701158b36f5888e9ffea4421f949e643a509226ac879deb377ff284d2864e1d163421d24bec95692bf487abc3d1eb2cefe19d4be377f89747a3a5cbaebafd449b109f4bda29615b82e1475b0087e0f80c91826e2503c5ccbc8477b983024c3dadea30e4c2e2aa5981bc899b9d9fee9a70778e51420b5c82ec6c8d4ef672105eb10a70c98932f179a6d57d824299ea2e4a846f52fc6a7345786dd3e6219eaab42eecd270e3c7fda18f41fb3f1867c4bfbb8bdc72c37925ec01803e218ba91a13241179c5b82e0570b080cba31ec93d026f3addfc5a475b28f23c0eefe0a1c27102b3b5348187e1bb57682b4ffb640c5f9eea4f600d720bcddc92fe143247e812c48e", 0xcc4}], 0x1}, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_SIGNAL_MASK(0xffffffffffffffff, 0x4004ae8b, &(0x7f0000001000)=ANY=[@ANYBLOB='\x00\x00\x00']) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000000), 0x1000000000000040) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000001000/0x2000)=nil}) ioctl$KVM_RUN(r2, 0xae80, 0x0) lstat(&(0x7f0000000040)='./file0\x00', &(0x7f0000000140)) 22:55:37 executing program 7: syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x0, 0x0, 0x0, 0x700]}) 22:55:37 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000004}}}}}}, &(0x7f0000ea3000)) 22:55:37 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0xffff0000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) [ 787.662863] binder: 403:405 BC_FREE_BUFFER u0000000000000000 no match [ 787.690563] binder: 403:405 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 787.697586] binder: 403:405 got reply transaction with no transaction stack [ 787.704862] binder: 403:405 transaction failed 29201/-71, size 0-8 line 2759 22:55:38 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8000000000008912, &(0x7f0000000000)="025cc83d6d345f8f760070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00003b9fdc)) r2 = syz_open_pts(r1, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(r1, 0x540e, 0x0) r3 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1000000000016) [ 787.808565] binder: 403:431 BC_FREE_BUFFER u0000000000000000 no match [ 787.847698] binder: 403:431 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 22:55:38 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe000fc00}}}}}}, &(0x7f0000ea3000)) 22:55:38 executing program 7: syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x0, 0x0, 0x0, 0x3]}) [ 787.854709] binder: 403:431 got reply transaction with no transaction stack [ 787.861912] binder: 403:431 transaction failed 29201/-71, size 0-8 line 2759 22:55:38 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x400000000000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:55:38 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000000000, 0x0, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) 22:55:38 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8000000000008912, &(0x7f0000000000)="025cc83d6d345f8f760070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00003b9fdc)) r2 = syz_open_pts(r1, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(r1, 0x540e, 0x0) r3 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1000000000016) 22:55:38 executing program 4: r0 = socket$inet6(0xa, 0x2, 0x0) ioctl(r0, 0x4000008911, &(0x7f0000000200)="295ee1311f16f477671070") mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x1, &(0x7f0000527ff8), 0x2, 0x0) mlock(&(0x7f00005e5000/0x4000)=nil, 0x4000) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000000040)={0x0, 0x1, 0x30}, &(0x7f0000000080)=0xc) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f00000000c0)={r1, 0x3}, 0x8) r2 = creat(&(0x7f0000000140)='./file0\x00', 0x100) ioctl$SIOCSIFHWADDR(r2, 0x8924, &(0x7f0000000180)={'vcan0\x00', @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}}) mlock(&(0x7f00001c0000/0x4000)=nil, 0x4000) ioctl$sock_inet_SIOCGIFDSTADDR(r0, 0x8917, &(0x7f0000000000)={'veth1\x00', {0x2, 0x4e22, @rand_addr=0x20}}) munlockall() setsockopt$inet_sctp_SCTP_DELAYED_SACK(r2, 0x84, 0x10, &(0x7f00000001c0)=@sack_info={r1, 0x6e, 0xfd5f}, 0xc) 22:55:38 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000002}}}}}}, &(0x7f0000ea3000)) 22:55:38 executing program 7: syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x0, 0x0, 0x0, 0xe0000000]}) 22:55:38 executing program 6: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup\x00', 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000000)='io.max\x00', 0x2, 0x0) r2 = socket$inet6(0xa, 0x4, 0xfffffffffffffffb) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r2, 0x84, 0x22, &(0x7f0000000040)={0x1, 0x8000, 0x2, 0x1627, 0x0}, &(0x7f00000000c0)=0x10) setsockopt$inet_sctp6_SCTP_RTOINFO(r2, 0x84, 0x0, &(0x7f0000000140)={r3, 0x4, 0xffffffffffffc6e3, 0x9}, 0x10) ioctl(r2, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") write$cgroup_int(r1, &(0x7f0000000080)=ANY=[@ANYPTR=&(0x7f0000000180)=ANY=[@ANYPTR64, @ANYBLOB="0b9e1cd0de37c621c071dd377cd13bb38baed6ed64e4710154893d0e6f9ad3b80c3ee8aa5699428ac6e66770fb11dfc17a57f8446a51fdaae1ecd9a1dae477d358f2076f8b12023e4282c60dd34ff79ef835ac3ef094fd778909c14edbd01d9f0f0ddf", @ANYRES64=0x0, @ANYRES32=r3, @ANYBLOB="92805a2704d08984315c4833b67c81e6e5cbc2ae0051a93b854837bb549a03d2deaaaaa993e9ca1e370f2d7a9f006f236d9a02875d2abeedf83349ecd4d26450fa823412104306454281aea2ee20f843a4ac445f8989", @ANYBLOB="c191c5f4db3bfb409d", @ANYRES64=r0]], 0x8) [ 788.077921] binder: undelivered TRANSACTION_ERROR: 29201 [ 788.083533] binder: undelivered TRANSACTION_ERROR: 29201 [ 788.138224] binder: 463:467 BC_FREE_BUFFER u0000000000000000 no match [ 788.164280] binder: 463:467 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 788.171226] binder: 463:467 got reply transaction with no transaction stack [ 788.178420] binder: 463:467 transaction failed 29201/-71, size 0-8 line 2759 [ 788.218745] binder: 463:470 BC_FREE_BUFFER u0000000000000000 no match [ 788.226778] binder: 463:470 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 788.233735] binder: 463:470 got reply transaction with no transaction stack [ 788.241009] binder: 463:470 transaction failed 29201/-71, size 0-8 line 2759 [ 788.283844] binder: undelivered TRANSACTION_ERROR: 29201 [ 788.289482] binder: undelivered TRANSACTION_ERROR: 29201 22:55:38 executing program 0: r0 = socket$inet6(0xa, 0x3, 0x400000000000) ioctl(r0, 0x800005, &(0x7f0000000080)="2957e1311f16f477671070") r1 = socket$inet6(0xa, 0x2, 0x0) r2 = dup2(r1, r1) r3 = fcntl$getown(r2, 0x9) ptrace(0x10, r3) setsockopt$EBT_SO_SET_COUNTERS(r2, 0x0, 0x81, &(0x7f0000000000)=ANY=[@ANYBLOB="66696c7465720000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000001c000000000000000000000000000000000000000000000000000000"], 0x58) socket$inet6(0xa, 0x80005, 0x8) connect$inet6(r1, &(0x7f0000000400)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}, 0x5}, 0x1c) sendmsg(r1, &(0x7f0000014fc8)={&(0x7f0000006ff0)=@in={0x2, 0x4e23, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x80, &(0x7f0000000000), 0x0, &(0x7f000001ef80)=[{0x20, 0x0, 0x80007, "4410070300ef000097"}], 0x20}, 0x0) 22:55:38 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x44000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:55:38 executing program 7: syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x0, 0x0, 0x0, 0x400000000000000]}) 22:55:38 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8000000000008912, &(0x7f0000000000)="025cc83d6d345f8f760070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00003b9fdc)) read(0xffffffffffffffff, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(r1, 0x540e, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000016) 22:55:38 executing program 4: ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000080)={0xffffffffffffffff}) bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22, 0x8000, @ipv4={[], [0xff, 0xff], @multicast1=0xe0000001}, 0x1}, 0x1c) r1 = accept4$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, @loopback}, &(0x7f0000000100)=0x1c, 0x80800) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4e24, 0x7, @dev={0xfe, 0x80, [], 0xe}, 0x3f}, 0xffffff8c) bind(r0, &(0x7f0000000200)=@in={0x2, 0x4e23, @rand_addr=0x7f}, 0x80) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$sock_void(r0, 0x1, 0x24, 0x0, 0x0) syz_emit_ethernet(0x0, &(0x7f0000000200)=ANY=[], 0x0) 22:55:38 executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000080)={&(0x7f0000000480)={0x10}, 0xc, &(0x7f00000000c0)={&(0x7f0000000680)={0x1c, 0x18, 0x1, 0x0, 0x0, {0x1}, [@nested={0x8, 0x3, [@generic="9c"]}]}, 0x1c}, 0x1}, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$EVIOCGKEYCODE_V2(r1, 0x80284504, &(0x7f0000000100)=""/250) getsockopt(r0, 0x0, 0x27, &(0x7f00000006c0)=""/4096, &(0x7f0000000000)=0x1000) 22:55:38 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x8}) 22:55:38 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x6800000000000000, 0x0, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) [ 788.506385] binder: 483:484 BC_FREE_BUFFER u0000000000000000 no match [ 788.545794] binder: 483:484 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 22:55:38 executing program 7: syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x0, 0x0, 0x0, 0xffff000000000000]}) 22:55:38 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0xf5ffffff], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:55:38 executing program 6: r0 = gettid() exit(0x0) r1 = perf_event_open$cgroup(&(0x7f0000000000)={0x7, 0x70, 0x7ac5, 0x7fff, 0x80000001, 0x2, 0x0, 0xfffffffffffff7cc, 0x40108, 0x1, 0x401, 0x823, 0x7fff, 0x7fffffff, 0x100000000, 0x1, 0x4, 0x2, 0xff, 0x3f, 0x7fffffff, 0x5, 0x5, 0x0, 0x8000, 0x401, 0x1000, 0x81, 0x3f, 0x7, 0x80, 0xfff, 0x4, 0x956f, 0x9, 0x6, 0x1, 0x4f2, 0x0, 0x9, 0x5, @perf_config_ext={0x3, 0x8}, 0x880, 0x1, 0x3, 0x4, 0x0, 0xecf, 0x1935}, 0xffffffffffffff9c, 0x9, 0xffffffffffffff9c, 0x1) ioctl$PERF_EVENT_IOC_DISABLE(r1, 0x2401, 0x0) ioctl$PERF_EVENT_IOC_DISABLE(r1, 0x2401, 0x40) ioprio_set$pid(0x1, r0, 0x4) [ 788.552722] binder: 483:484 got reply transaction with no transaction stack [ 788.559904] binder: 483:484 transaction failed 29201/-71, size 0-8 line 2759 22:55:38 executing program 4: msgget(0x2, 0x8) r0 = socket$inet(0x2, 0xa, 0x0) getsockname$inet(r0, &(0x7f0000000000)={0x0, 0x0, @rand_addr}, &(0x7f0000000180)=0x10) [ 788.610349] binder: 483:502 BC_FREE_BUFFER u0000000000000000 no match [ 788.637436] binder: 483:502 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 788.644353] binder: 483:502 got reply transaction with no transaction stack [ 788.651611] binder: 483:502 transaction failed 29201/-71, size 0-8 line 2759 22:55:38 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8000000000008912, &(0x7f0000000000)="025cc83d6d345f8f760070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00003b9fdc)) read(0xffffffffffffffff, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(r1, 0x540e, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000016) 22:55:38 executing program 7: syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x0, 0x0, 0x0, 0x1c]}) 22:55:38 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0xffff000000000000}) 22:55:39 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x6c000000, 0x0, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) [ 788.775849] binder: undelivered TRANSACTION_ERROR: 29201 [ 788.781544] binder: undelivered TRANSACTION_ERROR: 29201 22:55:39 executing program 4: clock_nanosleep(0x2, 0x0, &(0x7f0000000040)={0x0, 0x1c9c380}, &(0x7f0000000180)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = openat$urandom(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/urandom\x00', 0x4000, 0x0) ioctl$VT_RELDISP(r0, 0x5605) openat$uinput(0xffffffffffffff9c, &(0x7f0000000100)='/dev/uinput\x00', 0x8000, 0x0) munmap(&(0x7f000071a000/0x2000)=nil, 0x2000) mremap(&(0x7f0000160000/0x4000)=nil, 0x4000, 0x4000, 0x0, &(0x7f0000b23000/0x4000)=nil) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='memory.events\x00', 0x0, 0x0) setsockopt$IP_VS_SO_SET_DEL(r1, 0x0, 0x484, &(0x7f0000000080)={0x2c, @multicast2=0xe0000002, 0x4e23, 0x2, 'sed\x00', 0x2, 0x8, 0x1e}, 0x2c) 22:55:39 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000040)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000140)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r2, 0x84, 0x8, &(0x7f0000013e95), 0x4) getsockopt$IP_VS_SO_GET_DAEMON(r2, 0x0, 0x487, &(0x7f0000000080), &(0x7f00000000c0)=0x332) close(r2) close(r1) r3 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x8000, 0x2000) ioctl$sock_SIOCGPGRP(r2, 0x8904, &(0x7f0000000180)=0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r3, 0xc1105511, &(0x7f0000000200)={{0x1, 0x5, 0x8, 0x7ff, '\x00', 0x7fff}, 0x2, 0x203, 0x80000000, r4, 0x8, 0x0, 'syz1\x00', &(0x7f00000001c0)=['em0-\x00', 'vmnet0em0\x00', '{\x00', 'system)-:\x00', '}keyringem1ppp1\x00', '&\x00', 'eth1@\x00', '\x00'], 0x34, [], [0x6, 0x1, 0x9, 0x4]}) 22:55:39 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0xffffffff00000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:55:39 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8000000000008912, &(0x7f0000000000)="025cc83d6d345f8f760070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00003b9fdc)) read(0xffffffffffffffff, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(r1, 0x540e, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000016) 22:55:39 executing program 7: syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x0, 0x0, 0x0, 0x300000000000000]}) [ 788.860421] binder: 533:534 BC_FREE_BUFFER u0000000000000000 no match 22:55:39 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0xe000000000000000}) 22:55:39 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x2b00000000000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) [ 788.923886] binder: 533:534 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 788.930944] binder: 533:534 got reply transaction with no transaction stack [ 788.938219] binder: 533:534 transaction failed 29201/-71, size 0-8 line 2759 22:55:39 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8000000000008912, &(0x7f0000000000)="025cc83d6d345f8f760070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) r2 = syz_open_pts(r1, 0x0) read(r2, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(r1, 0x540e, 0x0) r3 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1000000000016) 22:55:39 executing program 7: syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x0, 0x0, 0x0, 0xffffffffffffffff]}) 22:55:39 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0xe000}) [ 789.039481] binder: 533:554 BC_FREE_BUFFER u0000000000000000 no match [ 789.057674] binder: 533:554 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 789.064664] binder: 533:554 got reply transaction with no transaction stack [ 789.071865] binder: 533:554 transaction failed 29201/-71, size 0-8 line 2759 [ 789.200552] binder: undelivered TRANSACTION_ERROR: 29201 [ 789.206266] binder: undelivered TRANSACTION_ERROR: 29201 22:55:39 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8000000000008912, &(0x7f0000000000)="025cc83d6d345f8f760070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) r2 = syz_open_pts(r1, 0x0) read(r2, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(r1, 0x540e, 0x0) r3 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1000000000016) 22:55:39 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x8], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:55:39 executing program 6: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f760070") pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) ioctl$KVM_SET_GUEST_DEBUG(r1, 0x4048ae9b, &(0x7f0000000140)={0x60000, 0x0, [0x6, 0x8, 0x2, 0x4, 0x9, 0xfffffffffffffff9, 0x0, 0x4]}) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) socket$rds(0x15, 0x5, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r3, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000080)=[@text64={0x40, &(0x7f00000000c0)="c4824da82b66ba2100b801000000efb9270900000f323640a7650f30c4e2899c8e02000000f02046452ef3440f6fb800f0ff7fc42101dbc40f2047", 0x3b}], 0xaaaaaaaaaaaabea, 0x44, &(0x7f00000001c0), 0x0) ioctl$KVM_ENABLE_CAP_CPU(r4, 0x4008ae89, &(0x7f0000000380)={0x7b, 0xbff, [0x4b564d03, 0x1, 0xd90]}) 22:55:39 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0xffffffff00000000}) 22:55:39 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x74000000, 0x0, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) 22:55:39 executing program 7: syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x0, 0x0, 0x0, 0x800000000000000]}) [ 789.648364] binder: 572:575 BC_FREE_BUFFER u0000000000000000 no match [ 789.674871] binder: 572:575 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 789.682000] binder: 572:575 got reply transaction with no transaction stack [ 789.689264] binder: 572:575 transaction failed 29201/-71, size 0-8 line 2759 [ 789.796712] binder: 572:594 BC_FREE_BUFFER u0000000000000000 no match [ 789.814167] binder: 572:594 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 789.821108] binder: 572:594 got reply transaction with no transaction stack [ 789.828276] binder: 572:594 transaction failed 29201/-71, size 0-8 line 2759 22:55:40 executing program 4: r0 = syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0xffffffffffffff80, 0x141240) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000001200)='/dev/vcs\x00', 0x501080, 0x0) io_cancel(0x0, &(0x7f0000001240)={0x0, 0x0, 0x0, 0x2, 0x6, r0, &(0x7f0000000200)="05b08d590ee001bde080f985ebc88c8f952b9d55efb343b8c87720111a8f5f9338339900613cb06850fb97be5113e63aa8ff205d20d562297ddc18eaa39bf3076f3a7de2e27963c159ef134476ff4ca431660676f540d94541426f19c077648acb4cde2b94a92c81a2453e0456f7c5bc413a6bc9886b1c853c304cce5807191643e25f2770f1359b31b615efdda43568e05afca8239d284e8a62bfc3ad952c2928c22a22782a5d3223ff979565a83b34c6ac654af5fac11a948668157e1fb97b577cdd6bfbdb96134f800778d9b50db745599bafdcea3ae02dc978dfad9c56c814edd9270906e2ce52759d21b29cf517b45f2f665a5c8f6cb49224e5ed0bae965484a12c59b2d81ee436752e7689b20137811d1d5847ed3b4d3bcc6afaf0316db440ae705e3d4d1d61c62b5f58592c3ae5057f4aa3f29cad7fd1f131b9a517403afc46f99027ee61c507efd2ba99d5c7d482fa68cd6c5d42e12e504c0c0653301aa01f045725019d860b71cd98360a9c64f8f52ed627aa2a78ed0579c40ba8b6ad1214bcac8c9173b02d5df04e063253aa2b2565fa593a4bd480127a21b736fc6dccbb1069f25da293e5c2a2635a3f4b2267fa1b76e3c3fe328afe6d50836b759a31a1485115565275f0a539d79b9fdf7bc7aec23c5ad02d93d601466508b13f7164c6ec8c00aaa0a33897446b84c0d6d0b674712fc8b6f65961e66deac8f14224b56758d9852b30699a96b723158978ee5a281b5684d6338b002f64c5f7e82b47683d241ec5a5aac3b4f517e744707d9c95b349c15f64ace5db0f54f2c3af17b308170e15cdf1f60fe98199b929cade986d82502c4f88a14333ccd95a48a3da7761db0948ce293dc2dbb43b159896e85bb7f60fb79addca14a71c8c5cf8c943d0fef8566a8790fb260fab578dab4550b5cd7035910eb50e50c918018b410da28d270d07de5d1a933be8c4897a6e5c68637442b05143389ee402fe821ac7e40b9801928fc4a2646544718f5565163facb005fa2ab46d9b9382c2befe41f1b1e2c1daee1fb372f501e3a9c6dfea9a7092996d0cea89b54e350263fb45d997ade998fad9ed9b8cfbd9f6f1f74b1626fcb7ee8aff5d529aa0bfb7d1af14d7dd91e0f4cbc523f6ec9826b39278091ad3af2e85e318190e59a6d2743c93a2b43d0d846a75bcbc50a32eb62283fcc2f1e8db6476e36e716aa53aa68933cf6fa468bf1e633a9adc03056e6cd7b96142630c4ada5b957f3450360977788f45ae2b46054a280a28544c05b83f913f0774e58832ae4850489c48073410cc184165fca5eb804dfbc6005c80707a153f9bd39a6009e124888fdb743ba0fcc28b34d090cd9e770883799ad653e0bea956d097b8256449038d2f68b76fcddc534aeb54600eccecbfc4c1a7b645e14cc1e0b30c0473445b0ee740e979eebdc982f623e8972197de5e547e76dce757e21bc5055ea019e3d05093154fd05e8a2e64f45f47ce819b96e98fd35173a9ec16af5c0b87b076bc0ca8a38e027ec6192bfdb5d8de11cb1220924bcfa41ab9f9490a0c80ff267414dd3bdfe6eb85079a881808f1e68be22a0019de3b47f795d6a3411febf2852ee0ae798b55f061d938f96d061e273a4b38924398b99ef9f5e1cd2b6da62df29cc4a2dfdb54e9b4b0b19e1aa094f938949fe5b6605e5e693afd43fa4eb1fa8ec78484edcf4cf350e521b4aee119f61c3d3b80430091d8aa9e7863d776c6496926b6f92eff923034b31df566c6e22d8f82683447fce399ef486af4ecffa178ffa65e82ba2ff953b66c543115d9e13e4e1116d2821cef1e479482f8b1467f9e57f489fa53a105d0b914853ce519481f2685247bd1e223daf234c4cf9ff44ac45e0e2e4b9ce3b987bf0e3c6fd86e5a4c7861597ee796c3427473c8fcd4c395c378825eab8d9f36595969effbac05515a97d35dadd714cc827881e190790f53070c889a188a193b8ee197548d75f134c3cf160fd57a3eaf4cdcf9ffec8be60f38fae979bd755bb2c8f79fc85509bf0f5a6a00212e189c98a48de366d321176385e114f916c825d1c804a3e18677c9bd56624ee6e7bf88ac4ff8be51f86d0f247c0366189716c234e20fb415f1f21d24f2906f70df045653de35edf3ae356d3bc7b5c231b08490982ca12458370c2d649e1eeb26ac7d803056d326e76a71b1ac7c9f58f33b5a12f7635ae7904484e617106bf56b927dcc3bdb239ad32f93b5b101448ace2808004bdb49bf1117198a48abd22afaed105e8b70cda05bfd508b7b5ebfbdbd6765277f3d31323d4af2f8ac2ce41060bd000b151340b14b0ac1b164f1737ba4ae40ed649ce102af4585d8572289a81f83a85d6aae37cead04e98079e4398b23b77808412d12f624fca264c420040d090c0945ffcc81f0e8d3618abf35cf7edd5c0dff881eac276b7edb12feef670b1413f5046dc95dda4622a562bb428443fd607314780d2931b8bfff8c365fc83bf85b30cf612ed8f082405e984a178e541150bb5840088ee78b0d4fc966745c55a7e810e3ee02669e675286be28f366a26f137cca74803bf5db954c8ba8c9b9dad8363beceba102d34a68bb4a30803621ef9a910ffd708f418f3af675e24183adbf1625ec9a3b23b4b3fd16bb03475131adb51c0ab241dc21d271d632cac970d68f40835446c6d1b32bee91729603216e0bb45e06dbcf28c5ee302409d18a7698f6759064c856d1a6d14f3acf9db530b7f4bc6762e529bd743d867244ccf24693090b4d3c4bb5a1daf2f9c037273da362b897ab409e593571ec95d9b3e557092d2cb571da81009f8db8e48e2f1a0a7702249f2c30924e61b267bb14da258b599318779e22605507291e43a50fc4314841f96eb6e29858cea0458c006ef3b518af832aed53fdcdebf5baac25b34e4788556c700ee2abf3a54825de1b43148b414d892e9c28196c3f8dee49a47007ab2fd271eff970cefa5617c43c85e03dc1f0a700f3f0e5ee335d82f0c4a7313d9803b55d44a7be183b5f7cecc02a7a59213277dd2a354c618668c38b442283ae69216311ea537bb8a0ad62f8afd5a98201f98c00888199e1ff6afcf581e6d50a161445c1ff75dc3f1215e2bdebda827a6fe02ba4051af2d2b2ca18718e12eda38caf03fa6f32cd797ce7de25e5f26c640c4d041fb9a3c153de0b817bad473da459d2addc6da3d57663034ed33ebde551a3b39685cdfd97dfc91d0fb6513b8dbe5f167c4b917fe050734b2b26c0a86a30c83e524d03b3b6ae1949b773a716bfa4c334f50c91297572a9f5577496bf23a2b6539d6862747bac09cdec6acb41d78699ce3eadfc431436439ef74ceed5dbd0cfe7282da1be5a9fa6ead85822d5cff8cc1501f7bb4c31ed7d1be8903f8e0da699eeab9e6e2796c07edac6cf727e526ec0c4a28b59f4aacd9d7b4458d7cfcb4c6844fa9a4cd63e1dba73f8cab3fa062ab823e82691987f0a7141fa36ebf6c9178dc3d45ce7eb101763c7c9dfd4a6decacca18de0c10fcd34afd39c8948c0ddb714623f447ec479934a2f13cdb7578870857a58b87ebf7f917ba4f9b29fb618c81bf2c9236dd16b2b4709d59e0d0e5a9b825aa852ec2fe2c09d3d5b962896087f04f2208798ceca96f24e3e25e6f8d0a7d32af7e9f943510fe48b354c4c5afb17adf160ab7d6bab761136ae3c02c5da2e1ab8783c959207ca0dbb34a77fa56662e02de7b64c1fa46a3d6cbc3bf2fd990d1811e196e38457b36d4630645891c985107b982be50f49ffd972d595b5f3dd552fef5b1bac50d28966c7ffa5ebb693ddb00d4dd127820e160c2a6a8dfd48d6767c3ab6e993bda43873d237344f9437c71a5f24dc177787b367f431bfdd1c34621a43201803a5034c77dfb3890a4efffffd437fb8160d70539d725fe1accc6e46d977732997fa7d1a41ac28c2a360da8a69127ae13a18a17efb78997a9875c02edd60b4c89949117e4129c7c0798f89ca7cadffad6dde02958bb6afe9a81639942f08ed90ba6647477dd0732317535dddf4d74ab08dbb97301a6506e3938aff54e95bcdcd4e53e10e796009ecf9e8177de1b03d46392c72d1e71d7186e30c63c6795d7878352c7017b569927de35c2e624b6b5fe44a993371fc24bad87a18358cb9058829545a81f2f430e66c54d99593a9cc58bd9027fcdb565232cae6c23c2caceeba4a143bb951b503775862d918a65ea56758a8ee5c4a234b2a5a0a1f8c03dc1b57df28486404ce4f84704debc3cd50c6e18e3f996682263eaf25075cbdbfc3a0ced9adc0da0dcfe1cb36b07719d78ad312c0ffd517378d3a77dcbca98a93ad52380c7ab92212bff6ae8470628c4ef2b1bc9bb4a96174450a099b66575a556c098dc0bd3a13b169283ff8a985cd4df76e4d6c5434fa9276909e2a7ba0c3e3574d90c8700c4c12d51317a59aac521a46b27e3a9eba7e29184efe16fa548399d88a032a761ced0f0e42b39a1cec8c68b999e4114600c26265f48e7976b403018c435558279ca917fc32700732762fe27d19b1069500d19229a36ce9322e07af4c2109ed5097f10a978bfab16f4d251d5a93a5066ab9a5f6bd713e6a55fce631b83f3b4bdcffa2c99154af83ebd3a49c7f75473cef72473e76a3e43a642a40f2bdace28ddf1222cc4926e39adb9b3a6dcd1171f55bbbd7e738396ec97f87ee951140bda57da30e8a0ac56ec770f470a4f3d12f5083016d8906f1b58ba1a5c4a79213c9bf41b7f5d854f89413ea66575798ebc1a4ce2e8eb024c809ecc418cca7c56a97e466d14e3b3f9f53418b562a2df5d22ecae0118b488b6e8eb01b5bdb2f7bfa7b1783af38c053df0f77a6831fff47d737710878b178c5be2c5cb15680bb71a62a9f778e474033d918a6ccd391f8d9d7f4e213beccc47d0215039132cb193e4be6ff59760e4bf2338f66d149ace9608968421ac368d9270911ddbdd3139e7ad30cda33dad05b5f50ef21c6835e329c172386e50f709eed4b2c2a9c215f5ea2079f9c9770653c6e5d103914fabee9be156a72b5dced781e7bf0c95d18c8e75c875c8631140d8ceab091d1a2982d4c3b79996694daee31d6342078e6fcf74cc04ab15898e8053bd98b6202766473156d73a20859a73a1c17031d9c70a7261bf766c56f64a93b5d91f0ffb964ddef577bd72b96ba7e09db76b67b0fea15e9d87f2edfa88402234a3e39f3ff12a7aacde138962fc1e5247dcb5c7a75cf01d98b09d598f4ac1b2a1aa105b6d5e17ea47829be137ed37120bed1d104944690b6e845699f64ee60d1a1d895a8b0afe44c12ccbd8585bad8a0279af1498aba55e3847364b3de5f07d3771bdaa32eca4a3ccc385fe553dbf53d3650eec965d6ca85eb75f26f4b228e276cd15e535fa1cc03dd77530d349c68038edfdb4642681ba90a0bc703bb09a6e68404182d60178235227a018ec63fd70bcbfe281ae7cd88c9e58b76c4756636a47f8586b80c4b8b9977c20787a0cae0267cdfbec6c62db75730c14f01811a7b738442fa9df937aa14f32c695c202a3b907496ffb97e4053730198387da83ac80913a1e47deb035abadcaaaf7e62aaf18c2a3cf3c594a4d64f3ce0aaf8d7e7b7be78755f7064dc26597177cb7966233acc4fe3aaf27aeeae266ae2c0a37a5021ad5f5d241390ea70bdacbb7434807679a85c106645c30b8a14c80d47d40934f298f406a969f00eda552a5cabd6bc5611809835483655854a05ad7362fe5ce1233671106895953967c35fc26ad4830aef53a56fe761e5916ce542285d5367ababb4f6c16f41178c15040a94730a1e7e", 0x1000, 0x3781, 0x0, 0x1, r1}, &(0x7f0000001280)) getsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, &(0x7f0000001300), &(0x7f0000001340)=0x4) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r2 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r1, &(0x7f0000000000)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, 0x100) r3 = socket(0xa, 0xa, 0xfffffffffffffffc) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(r1, 0x28, 0x1, &(0x7f0000000180)=0x5, 0xfffffd72) setsockopt$inet_MCAST_JOIN_GROUP(r3, 0x0, 0x2a, &(0x7f0000000040)={0x2, {{0x2, 0x0, @multicast2=0xe0000002}}}, 0x88) setsockopt$IP_VS_SO_SET_EDIT(r2, 0x0, 0x483, &(0x7f0000000140)={0x0, @multicast1=0xe0000001, 0x0, 0x0, 'rr\x00'}, 0x2c) r4 = openat$urandom(0xffffffffffffff9c, &(0x7f00000012c0)='/dev/urandom\x00', 0x400, 0x0) r5 = syz_genetlink_get_family_id$fou(&(0x7f00000013c0)='fou\x00') sendmsg$FOU_CMD_GET(r0, &(0x7f0000001480)={&(0x7f0000001380)={0x10, 0x0, 0x0, 0xd}, 0xc, &(0x7f0000001440)={&(0x7f0000001400)={0x34, r5, 0x10, 0x70bd25, 0x25dfdbfc, {0x3}, [@FOU_ATTR_PORT={0x8, 0x1, 0x4e21}, @FOU_ATTR_AF={0x8, 0x2, 0xa}, @FOU_ATTR_IPPROTO={0x8, 0x3}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e24}]}, 0x34}, 0x1, 0x0, 0x0, 0x4008800}, 0x20040080) setsockopt$inet_MCAST_JOIN_GROUP(r4, 0x0, 0x2a, &(0x7f00000014c0)={0x4, {{0x2, 0x4e22, @multicast2=0xe0000002}}}, 0x88) 22:55:40 executing program 7: syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x0, 0x0, 0x0, 0xe000000000000000]}) 22:55:40 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8000000000008912, &(0x7f0000000000)="025cc83d6d345f8f760070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) r2 = syz_open_pts(r1, 0x0) read(r2, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(r1, 0x540e, 0x0) r3 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r3, 0x1000000000016) 22:55:40 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x7000000}) 22:55:40 executing program 0: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x10, 0x3, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_DEVICE(r2, 0xc00caee0, &(0x7f0000000040)={0x4}) ioctl$KVM_CREATE_DEVICE(r2, 0xc00caee0, &(0x7f00000000c0)={0x4}) write$binfmt_script(r0, &(0x7f0000001300)=ANY=[@ANYBLOB="2321202e2f66696c653020207b73656c696e7578200acd65d4eb50ed5cd429079bda4528dd8f4169283a9d345942312e7ab9522465ccdc0e96f12e80dcaf10d6adbd6ec70c8465b091dfe5a02854197e0c18bc652057d25c70cdf30fa47fc9d420c8347df4890034f451513b4bae98fcc4863ada58580bad685dfb2fa9603f4e9c3b7e1d9fb505b94d543be71e29e53bc78a04d20d9c8764c0a43b9958c3d2a2e4a46e9cdd23936c493389112889365668dc17fbc01bf15f7135a4a5a60610df1235ae5d865cdac99dc67894ca367edfd7943c678792d8c048fb4ff314999495d83438d024aeb4f301a05eaefd129a82fa7994e83f764df827105a4c5d48e69e0b319ff468df81ce1918845d21f0e389c33551903dc5e897e98f15cfadbfd7c138f1fa51237bc2e46ab5259836a111bd372f81af563ff2e78959609775e1577b954fe5861ce9924e11ab52c5dca8afaaf09f6c9ae9f21f921bee21dff08c1bb1eaad0327f796584e5e1269adf8f638bf7b9d0fe2aaaef2222703d0c610f12e9de69bc039f6990eb7c694c7fa0201ad70a01c98f037747bc41e40d34040d113d3c3b13b8460c5df13b68edd9461cefa841a1ce2eaa15c5ff9807451e62cc194f1783f32e76a461df50afb0ba88e36b7cc1040817426d931f896d506d9b1f7db77a22ff8e376c5e3054755fee4d8fe77c5d6c9238b2597fb83b751331f620915161b0ba32072ee58c73141854e2fb42a96d88a9f0fda6bfdd1bc5ff5111a5f91570ab94018dc5cc0427a5e243fde6343992389e09df608eafbb17548694cde75e34fe2d6fafe0810bac4e575bc98eed4c62facac1ccd18fa15e1d64f913db55d09fe8e58f9f0ca99b79f0a80d71cd67b535c42f4fb3dc5fc2c39aeffc58122fed499c0c5ed71eb181a5cc5372a094120a95739bf2505d2a7a5a9f414a3a913d75b2e0fe4a5759c250da404e0fb95595020ec80165bdc33214fe0a99e81142aa21a4d4f9ad674a190534ad2b09d94c5bd5977b31a8b4075f38653062ab508ce8453078f5d20292c927f4cd2bc25039633a202a6010680fe29a3aa82ef57a7aaa05c6a456500aeb90345b641625ba898607df33307633c634ecafdd6e72c5540943dcb87e7266bb4359a9834f3c047993f68ec4621c7aab51c093dc92b94d973f81cce5b5a044baafcec9c1024457ce6606f5ce4cb15714b0138cb1e31d2057f8ce0f7cea115fc4fe7142e66337182203e203f4f1e95bfd8618246b5d92d96f498b44456931777ffaa66e25e47356793e035031b6f1c2c63d3a174bd5cac0b61bdb5f93dbfdc0e9721b950fcbaf14c59bdc8fb9baacd97942f40fbc6e3d088b10a3bcdf0a80ef235818062495796784ce91db85c31448466c3b8561b99c18fc362a4f438ed10244e2cba1b1a002db6b53f2570a0809495a5f1b0bf2012fcf7166af6533d2b62cc5f11df3288175025a12ebb794c30065c0eb284ba08278f1d3d8ad9bd261a71a95a5958c5097e75620d0da57d4dfb0eff9dadcb6f9f0da5b82310e198e42a978c8dba635e3cad29375039cfe5f1e7809c472eb43dd02f864f91fd7c7b00043d04c9133379506d61873015656a97de7b80f921a47424774ed1137848da7f67faf17f1bdce06af5b890d98dbb3d25f4892061fb5cdc2ac89313dc763018d9166d253d1d9786ea7af59be027ec61a5598df509ad028f9f8ef7a6aa62bc5653949a97304bcf4a7b9d00a70304677dc1ebe5d4ee62bb2f610fd8b9762183de7d4aa2309d80207e8e45a203af6dbaddb45df3e3ccf3d6ae2fbea9418e116d355445f531bab295b4a01ca856483757766a990895eeaff189d00a2b7bc8bc7c0a1322a4a8ed62fd576aa5bc54db96028dd7b15ae69de0ad5ff0be8644e7611434da6e243b911cfa9d2cc4103bebc513889aebaa95b63165e54e9355d4d8ada3144bf19639a08ce5f59f2bd81faf0ff0af826341a152941009607cc2a21c6de1ec52bd4930b693b9d968e4bee7107c648ffb4711af0e8959a532a4ce2b89f65c17972a40341c4d986c0070457a744cd314e3ef88b92675e9b6b8bd7f7427c01fbb03bb56dddc1ddc68c3101018e5caa10b75e95373f9b3918424a933f43fb749bd11d963e47f54441a7697766c9aab249f4d9a7706043ef5ddda3b5103c06466f79d906c8a048544d269210b02ff560c09df22dc8a61fbad5b9870a459618405471e798b3d176e113be067827865e674d93b57a70a6ca5b919f02b3480b77f8b3a7ae7d6a91357fbc75f1e743c830dd1b4b46f04c92c42dc1ab029bc27a6e11951b3fcb709a69564edfd9eb9f6039326ef44514ea5ec2546ed1d2f4915a989cc17caf40d9bfbab591a88d5dfd0afc2ea2fe761bde6dd810358e60d9de1f8f21449b993d49f6a71e795535cdc1f6459db4dfe17c68763d18a689c87bfd778f0c7d31921f352cc5aee39231a44af8a8d2bb7997f3b4ffe819100df11e223912da5217270dad38ed594fc7add3a0d82fbf56eb19bfac4e0db306fe20aaa52e3cac4feb6bbbfb4249bc5df57d0d6322bacc60c512b8575380715e46060c7b565bbad609d79ba0dd5304629f99918a85ec802c733034e799fd29e724ab921f899e9c4f223de88458b8c23475f922fe4ee715d3f976dcba39dea062b86095f024df14226faaaa1be7cc2f67c37587f045efd5884eabb92a5b8981f34f7281981b37f9e3912e9fa3b07e97cb193d98324acac16a3c925dbab7ca80a4ad80e1ac631c3f6c59d0c9c4e03d71e2f1df74988a70b7aae3463288ad1cf573628a830b4cc076d263f9551661448c62a9474a66fe669a04a375ac346e6dd644eb6e6bc611c6c797e75e3aff2e3b85af9e59ef8f2a0f6bda0688420e95ce77bc6a04908c403de128c99f1d01712784831e028851e9fb6dfa7ed3e74e62a0d527e9cd644fdf34b68cac7a70962931470d8f57179ac8007c62249f1edb3c067b56ad32c8d585fa88613a096e8cdcee4ed140ac125bba4be88128d9be48c83816afe82b196ef485568facf04f8d029e1bc6f4c920c5e595afa2148d63402ba2a1d8feddbb2e188634576fe76f8a914cad3009c79a07f672858da91baf366e1c0036cddc85a3aa437e6918b9fceef0377706a684d4b9dd30378ab35a2d6c990dff2ce59d91fef6ac15c2daaec6dcf2035bd54d4e19f3348f3f7b2788d3a3d8c5b36e359dd8a50f8b3806b3e45f6bef23ff7ec2495b76b23079b61e032ca8d73e61041078280f0e5b44076333c238a5a447ccf237d686d1ddf2c11a45f7933e89de1e5b89ffffd0f668af8c9e190414118477598e186cf8b1f02024903f607e324154fead7950ada2528389324c47c8954642f470d3a1053551738af9a5bc8a9ff54cf1fb414098568bc3fcd4c4f09284860c2ce58e3c29c0f61ba26557930d73ec61dd01448711906bb989b02e3093300531628068410aa8a2a787a4cef977cb23d1eb9bd7239682c1b7cb91aff7ff3050762ff0cac48ac02777efe56426cd90aa3f773c84f998e16297255d760528b875c2927d8dd7eedc24647e83d9126683f6ab47dee6253b2e62c0a9b73c94126080ccabddd0236fc0f5649901af07267fd8acffb3e5ce82f1acd396e7d81cd6592162d39500b28fc5f6275da5cc6f55ab27aa578533135758a066ba6f5c68d7caec875595f0ee567b0b1c1538c27761ea567fd5c5542a33b049d77e5f8f5d9c03e1efaeee2ca350197c690bcb30d2164051b057950d13def65e2b02a80b26d41f23034f7a5d3b3bf6510aa7d42337a167ac6fc991356d60d05d929612fb70c454717bb8e4ac0c978e029048989b6a471e86b2743b65ee3b9309ecb0f621abe7c69c747dfdf7916f8f03ea8179ea682005d048a1396fcf59d15fc4782f6276c4e967af0897f27a9f48837714989da1b7ca9174905d9ba66e1323944bde1e6a5f03b3f072e1d6dca7c0bc1bec48fd9aa022a75ea921718a76ee3a0e2e95e09f4ead867f31c46dc30eca8c503db454612ad57616f07584075ea588d0d61472ce72b17074f86188779286c3d7ff9e03252e8b3922253e4b00798e81bf0074a4b1ab616918c9313c166aad7667ea9af8668c0d080257c6fd3afe9410df9cde03e6865e1d43e82e1bdee1d1b768610a4b49a0a22d7e8d3f7a3e31a4a5eda8b0e8374935df05fde1fe2e1f61007232c58379b315a97019223559aefa018bc284e053ff8d518b3347dc6b139d0694e666a2bc3bdd039e6fbf3e8ff7fb4300cf567a7cfcb611fd3e2f7599805ffcf239cfc27feaa14b34a04d2f140b0af20d2742d930d1bd0c03f4f89ea64f00caab390ad7963582d5af9c5a057d5f697877ad8c40fccb0098d75f63f5fc4a9e5619e392ccae2fe8ecfdabb6cdf6a46151b1ada3c98d29a0a818848e4d72d3830a0764af36d942696cb843de96b3a605576d9f2c222595bf57d4fff561bac16ef31ab0af8bcb21741e58ccbf0fcf0807810d4fb2b7debfbd6feb9768898cf0f4bb6e75694d5981be0864c92b317337923871d7cd6323049d2983148e2dc0a94cb0bb266b385a219fa5b4db421c21ee69388ec1b2232f7da505586e45d585632b531d570366f694414da910306bbb6171b8194ce18d86cb6ed04318ccfa7a8648f5fad4e28e1bd4a915eb8e639ce679dde28305254096c46c2cf4295c49b6920dab3aa5b2ad105f586f704f6ae6da4958fd7ba15ab6bf5cc1f7539d93eb64fc6343f9e187f461029b494a10cf234fdd9a62ce49560981879787e595ae216d3f37e8765a4b457157cb1548762024bb85f72745d5731985ed0669df9a1abb4e74522143b68cb6d2483d0df106717fe8990b7d11b0a14eca78b7e3402d3a720e899467bec19423d2a425c460612b6fd82289c59172f827b01b0222f0d65192d3fa0b7a281fdaf291ae4dbf4eb15f8e975f2afbc13fcb2cd3bb8ab87ee6175876cf54c12319ba18bf2c85a76d2f5b70c429740afffb5ae9fd54b19525c73c1f5d9d18ea2913883b2e38e8dd6d8282fb2c1f2c269ebbcd29d741b3af13cd7c91ac477a402558989ef3ac7dec36265ea5f8a0a3996dcf86169cada0e392c81bd60a775ffdd3e25416e28c60506712dc23d3504f7403505c04e127149877798658b39fca8c9c9e0bd5e432d2cc3822b4b23c6831450fb9238c272e53cf1a3114c663bc50a2505010000008c2a60629af981aa7fcd9decff77981d2e1146d64fc7dba76ff2560a47d5f6ea355a59ef6fb31267feb4615528b114d734c4e48eebe9e436b2c812a40a9d17a2977ca76df7d1538e951690954320098410612bf44131a50065245bc70bb965e57c9e3852df5d6608e506200d5d188d86c8c713ec5a8d871b8d4d2805938b47bab5d166e4108af46ffc59ab1e686ab4fbb527be1eba053a478dfe74d09e4174b66f7788a55d99e80158ff911e77bb81c98b1c64a7bfbe4092403c0e071368cbaedeb49f3d323d7377c2f693ac56fdad2415ca379240d46ba2c563a58f5de67e98a4cf016eb066cd291825d91c1dea2aa505fd6e5846c7b444a036bfac26633db7f9dd40e7527ff1fcca9dc53bb075c76110016339a1504948dfbf6bb66b4687c2d1c2b252c984c4b54e9cd6ec6be0ee7063b3b3b3d2858706e58619050a80c69088884b469136a243a827266ad5a3fce70934764918abb899b0a952f861b1448d55f071920b3fba35b8374066dbf760f063b1a10bfaff46ff4e60f23a509a43cfe20ecd26a35810b0b8e76557880f8cf7dce5dfcbfe3dc994269fdaa9ce918598d6aa12d416a47a2df64a1271826c7d2d62f666e91be406dd4d6a312cbf02ad4924d7d2ef3bc4b5b23e16c7311112ff281744066488cc2f08e03cb2eca35fc2f3965e652e4e6162fa5b9ad3950bd937cb2b44ce1a7a62a60c255fd442a652bf7d3713b80e8f2d17c6330ac2a4b22666fba8dbea7c1f9e8d"], 0x1016) sendmsg(r0, &(0x7f0000004fc8)={0x0, 0x0, &(0x7f000000eff0)=[{&(0x7f0000010000)="240000001900030007ff0907000083be8020000000040005031d85680300a3a2d188737e", 0x24}], 0x1}, 0x0) 22:55:40 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x8000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:55:40 executing program 6: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000680)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) writev(r0, &(0x7f0000001880)=[{&(0x7f0000001800)="fc6b9c479d50cf77", 0x8}], 0x1) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x20000, 0x0) sendmsg$kcm(r1, &(0x7f0000000300)={&(0x7f0000000040)=@l2={0x1f, 0xef, {0x9, 0x40, 0x5f4f, 0x7, 0x5, 0x2}, 0x5, 0x3f}, 0x80, &(0x7f0000000280)=[{&(0x7f00000000c0)="0caa7a98a650b6689a923d52813d4bcedcadd203050561e0ec33d35c9d664e658dfc2249687ad3f0120eb4ba7d0fb924c8169e8c2791abe3e187b57a19a816df2f063f4bf40ac9da01e12fd97f43106f4e4d8015d6127dcfdb79db1e3ac8f82c64a26fc1b8f743be76d98ead56a5a0902446cc13a6040723704db3c2f122ed3451836a511ac5f3beaa6d035e435f92ab518e1810cabace01b23eb9b29a951751ba2140ff5f76ea330a07ed406c801253", 0xb0}, {&(0x7f0000000180)}, {&(0x7f00000001c0)="53b695363ef5d2e50a6aa18968cfbf6b9f6ea441e455dc54e1020c87030300e87050698f3b4e6bca597cfbc87e7e8154ed88f4236df1475da7255cd2012e2323553da7759fc214ffabb4a7d03b35f31870560c220b95fdd957ddaca9939ede597058c472341041961d47b9f2d416fb26095f03f64cb46ccf", 0x78}, {&(0x7f0000000240)="354f78827d6c56ae45848ddbea6f511037342e973d0fccb1271b8d5d8050ef79ba3e25b59d4bfb", 0x27}], 0x4, &(0x7f00000002c0)=[{0x20, 0x10b, 0x50b, "f5ef1172226630a4155728"}], 0x20, 0x41}, 0x1) 22:55:40 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0xa00000000000000, 0x0, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) [ 789.885000] binder: undelivered TRANSACTION_ERROR: 29201 [ 789.890633] binder: undelivered TRANSACTION_ERROR: 29201 [ 789.966168] binder: 612:614 BC_FREE_BUFFER u0000000000000000 no match [ 789.991458] IPVS: set_ctl: invalid protocol: 0 224.0.0.1:0 22:55:40 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x1000000}) 22:55:40 executing program 7: syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x0, 0x0, 0x0, 0x1c000000]}) 22:55:40 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8000000000008912, &(0x7f0000000000)="025cc83d6d345f8f760070") ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(0xffffffffffffffff, 0x0) read(r1, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(0xffffffffffffffff, 0x540e, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000016) 22:55:40 executing program 6: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$unix(0x1, 0x2, 0x0) r0 = socket$inet6(0xa, 0x1, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/audio\x00', 0x400100, 0x0) ioctl$RNDADDTOENTCNT(r1, 0x40045201, &(0x7f0000000100)=0x1) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x180, 0x0) ioctl$KDSKBMETA(r2, 0x4b63, &(0x7f0000000040)=0x1f) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") prctl$intptr(0x1c, 0x0) 22:55:40 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x2c000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) [ 790.013530] binder: 612:614 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 790.020530] binder: 612:614 got reply transaction with no transaction stack [ 790.027770] binder: 612:614 transaction failed 29201/-71, size 0-8 line 2759 [ 790.037880] IPVS: set_ctl: invalid protocol: 0 224.0.0.1:0 22:55:40 executing program 0: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000000280)={0x0, @in={{0x2, 0x0, @rand_addr}}}, &(0x7f0000000340)=0x90) msgrcv(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="000000000000007d96ebe80000000000000400001f59e7e72a270e420000000000000000964abda010bf0c6744b4afb61bec64727893c79db80f878ec278ca8b70f59fb124738352d69c52cb5fabb6341ec9d71696f9029e5405bba5e05152111d2ae851facb9a48454781edece46d788f454d89761038ed49e8e6e78e25faf5cf4ffc6cf4e8e616219cf397139eb183f036e4"], 0x24, 0x0, 0x0) msgsnd(0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00000000ffffff7f"], 0x8, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000500)={{{@in, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in=@local}}, &(0x7f0000000100)=0xe8) ioctl$sock_inet6_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000140)={@empty, 0x25, r1}) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f760070") unshare(0x2000400) r2 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r2, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback={0x0, 0x1}}, 0x1c) listen(r2, 0xffffffffffffff81) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r3, &(0x7f0000e33fe0)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback={0x0, 0x1}}, 0x1c) getsockopt$inet_sctp_SCTP_STATUS(r3, 0x84, 0x9, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, @in={{0x2, 0x0, @loopback=0x7f000001}}}}, &(0x7f00000000c0)=0xb0) [ 790.110335] binder: 612:629 BC_FREE_BUFFER u0000000000000000 no match 22:55:40 executing program 4: r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/qat_adf_ctl\x00', 0x400, 0x0) getsockopt$inet6_mreq(r0, 0x29, 0x1c, &(0x7f0000000140)={@mcast2}, &(0x7f0000000180)=0x14) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='cpuset.effective_mems\x00', 0x0, 0x0) ioctl$TIOCLINUX7(r1, 0x541c, &(0x7f00000000c0)={0x7, 0x5}) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f0000000040)="0047fc2f07d82c99240970") preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000001200)=""/148, 0x94}], 0x1, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000000)='net/snmp6\x00') preadv(r3, &(0x7f0000000480)=[{&(0x7f0000000280)=""/209}, {&(0x7f0000000380)=""/242}], 0x10000000000002a1, 0x0) 22:55:40 executing program 7: syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x0, 0x0, 0x0, 0x1000000]}) [ 790.168160] binder: 612:629 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 790.175070] binder: 612:629 got reply transaction with no transaction stack [ 790.182271] binder: 612:629 transaction failed 29201/-71, size 0-8 line 2759 22:55:40 executing program 6: getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000001000)={0x0, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x73}, &(0x7f000000affc)=0x20) sigaltstack(&(0x7f0000001000/0x1000)=nil, &(0x7f0000000000)) sigaltstack(&(0x7f0000001000/0x4000)=nil, &(0x7f0000000040)) shmget(0x1, 0x2000, 0x10a0, &(0x7f0000002000/0x2000)=nil) 22:55:40 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8000000000008912, &(0x7f0000000000)="025cc83d6d345f8f760070") ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(0xffffffffffffffff, 0x0) read(r1, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(0xffffffffffffffff, 0x540e, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000016) 22:55:40 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0xffff0000}) 22:55:40 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x3c00000000000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:55:40 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu\x00', 0x200002, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000500)='tasks\x00', 0x2, 0x0) r3 = syz_open_dev$vcsa(&(0x7f0000000140)='/dev/vcsa#\x00', 0xcef0, 0x202) setsockopt$ALG_SET_AEAD_AUTHSIZE(r3, 0x117, 0x5, 0x0, 0x8) r4 = openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x10000, 0x0) ioctl$TIOCLINUX5(r4, 0x541c, &(0x7f0000000100)={0x5, 0xbdee, 0x80, 0x1, 0x5}) poll(&(0x7f0000000180)=[{r2}, {r2}, {r0}], 0x3, 0x4) r5 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snapshot\x00', 0x80000, 0x0) ioctl$ASHMEM_SET_NAME(r5, 0x41007701, &(0x7f0000000080)='\x00') 22:55:40 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x4c00000000000000, 0x0, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) 22:55:40 executing program 7: syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x0, 0x0, 0x0, 0x600]}) 22:55:40 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x4400000000000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:55:40 executing program 6: r0 = socket$inet6(0xa, 0x3, 0x5) setsockopt$sock_int(r0, 0x1, 0x25, &(0x7f0000000200)=0x7b36, 0x4) connect$inet6(r0, &(0x7f000000cfe4)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) write$binfmt_elf64(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="7f454c4600000000000000000000000000000000000000000000000000000000400000000000005599000000c0000000000000000038000000001200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x78) 22:55:40 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8000000000008912, &(0x7f0000000000)="025cc83d6d345f8f760070") ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(0xffffffffffffffff, 0x0) read(r1, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(0xffffffffffffffff, 0x540e, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000016) [ 790.388685] binder: undelivered TRANSACTION_ERROR: 29201 [ 790.394285] binder: undelivered TRANSACTION_ERROR: 29201 [ 790.482219] binder: 666:669 BC_FREE_BUFFER u0000000000000000 no match 22:55:40 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0xe0}) 22:55:40 executing program 7: syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x0, 0x0, 0x0, 0x6]}) 22:55:40 executing program 0: prctl$intptr(0xb, 0x0) r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x10080, 0x0) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000000040)={0xffffffffffff1546}, 0x1) setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, &(0x7f0000000080)=0x401, 0x4) [ 790.545547] binder: 666:669 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 790.552525] binder: 666:669 got reply transaction with no transaction stack [ 790.559949] binder: 666:669 transaction failed 29201/-71, size 0-8 line 2759 22:55:40 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x100000000000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) [ 790.607306] binder: 666:683 BC_FREE_BUFFER u0000000000000000 no match [ 790.665170] binder: 666:683 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 790.672098] binder: 666:683 got reply transaction with no transaction stack [ 790.679304] binder: 666:683 transaction failed 29201/-71, size 0-8 line 2759 22:55:41 executing program 4: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x6, 0x4, 0x4, 0x101}, 0x2c) openat$autofs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/autofs\x00', 0x40, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x5, &(0x7f0000000240)=@framed={{0x18}, [@map={0x18, 0x3, 0x1, 0x0, r0}], {0x95}}, &(0x7f0000000080)='GPL\x00', 0x800, 0x2ed, &(0x7f0000000280)=""/176}, 0x48) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000018c0)={r1, 0x38, &(0x7f0000000340)}, 0x10) setsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r0, 0x84, 0x12, &(0x7f0000000000)=0x8000, 0x4) 22:55:41 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) r1 = dup(r0) ioctl$TIOCGPTPEER(r1, 0x5441, 0x1000) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r2 = memfd_create(&(0x7f00000000c0)="7465616d300000163694d900", 0x1) accept$packet(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000300)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)=@setlink={0x40, 0x13, 0x614, 0x70bd28, 0x25dfdbfb, {0x0, 0x0, 0x0, r3, 0x100, 0x1180}, [@IFLA_BROADCAST={0xc, 0x2}, @IFLA_LINKINFO={0xc, 0x12, [@IFLA_INFO_SLAVE_KIND={0x8, 0x4, ']\x00'}]}, @IFLA_MASTER={0x8, 0xa, 0x8}]}, 0x40}, 0x1, 0x0, 0x0, 0x80}, 0x4000000) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000003c0)=0xffffffff, 0x4) ioctl$sock_SIOCGPGRP(r2, 0x8904, &(0x7f0000000380)) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = getuid() getresgid(&(0x7f0000000000), &(0x7f0000000340)=0x0, &(0x7f0000000080)) fchown(r4, r5, r6) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000280)={"7465616d300000163694d900", 0x0}) sendmsg$nl_route(r4, &(0x7f00000018c0)={&(0x7f00000002c0)={0x10}, 0xc, &(0x7f0000001880)={&(0x7f00000004c0)=@setlink={0x30, 0x13, 0x105, 0x0, 0x0, {0x0, 0x0, 0x0, r7}, [@IFLA_XDP={0x4, 0x2b, [@nested={0xc, 0x1, [@typed={0x8, 0x0, @fd}]}]}]}, 0x248}, 0x1}, 0x0) 22:55:41 executing program 5: socket$inet6(0xa, 0x1000000000002, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) read(r1, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(r0, 0x540e, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000016) 22:55:41 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x6}) 22:55:41 executing program 7: syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x0, 0x0, 0x0, 0x30]}) 22:55:41 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, &(0x7f0000000300)) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r2 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x4, 0x40) ioctl$TUNGETIFF(r2, 0x800454d2, &(0x7f0000000040)) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000007c0)=ANY=[]) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000f1dff8)={0x0, r1}) 22:55:41 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x89ffffff00000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:55:41 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x6000000000000000, 0x0, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) [ 790.790954] binder: undelivered TRANSACTION_ERROR: 29201 [ 790.796613] binder: undelivered TRANSACTION_ERROR: 29201 [ 790.855936] binder: 705:706 BC_FREE_BUFFER u0000000000000000 no match 22:55:41 executing program 7: syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x0, 0x0, 0x0, 0x6000000]}) 22:55:41 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x7000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) [ 790.899843] binder: 705:706 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 790.906926] binder: 705:706 got reply transaction with no transaction stack [ 790.914104] binder: 705:706 transaction failed 29201/-71, size 0-8 line 2759 22:55:41 executing program 6: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe2(&(0x7f0000000180)={0xffffffffffffffff}, 0x4800) getsockname$unix(r0, &(0x7f0000000480)=@abs, &(0x7f00000001c0)=0xfed4) r1 = syz_open_dev$sndseq(&(0x7f0000000140)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT(r1, 0x40505331, &(0x7f0000000080)={{0x0, 0x2164}}) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000280)={{{@in=@dev, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @multicast2}}, 0x0, @in=@local}}, &(0x7f0000000040)=0xe8) getgroups(0x8, &(0x7f0000000100)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]) lchown(&(0x7f0000000000)='./file0\x00', r2, r3) 22:55:41 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x300000000000000}) 22:55:41 executing program 0: r0 = socket(0x13, 0x4, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'veth1\x00', 0x0}) syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xffffffffffff8001, 0x80000) bind$packet(r0, &(0x7f0000000000)={0x11, 0x0, r1, 0x1, 0x0, 0x6}, 0x14) sendmmsg$inet_sctp(r0, &(0x7f0000871fc8)=[{&(0x7f000086c000)=@in6={0xa, 0x0, 0x2}, 0x1c, &(0x7f0000d1e000), 0x0, &(0x7f0000dda000)}], 0x492492492492510, 0x0) [ 791.011155] binder: 705:730 BC_FREE_BUFFER u0000000000000000 no match 22:55:41 executing program 7: r0 = fcntl$dupfd(0xffffffffffffff9c, 0x406, 0xffffffffffffff9c) ioctl$KDSKBMETA(r0, 0x4b63, &(0x7f0000000000)=0x5) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x42e]}) r1 = getpid() getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000480)={0x0, 0x0}, &(0x7f00000004c0)=0xc) lstat(&(0x7f0000000500)='./file0\x00', &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000780)=0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000007c0)={{{@in=@remote, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in6=@mcast2}}, &(0x7f00000008c0)=0xe8) r6 = accept4(r0, 0x0, &(0x7f0000001540), 0x80800) stat(&(0x7f0000000900)='./file0\x00', &(0x7f0000000940)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fcntl$getownex(r0, 0x10, &(0x7f0000000b00)={0x0, 0x0}) r9 = geteuid() getsockopt$inet_IP_XFRM_POLICY(r6, 0x0, 0x11, &(0x7f0000001580)={{{@in=@dev, @in=@local}}, {{@in=@remote}, 0x0, @in6=@local}}, &(0x7f0000001680)=0xe8) r10 = getegid() getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000b40)={0x0}, &(0x7f0000000b80)=0xc) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000bc0)={{{@in6=@ipv4={[], [], @broadcast}, @in=@rand_addr, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@rand_addr}, 0x0, @in=@remote}}, &(0x7f0000000cc0)=0xe8) r13 = getegid() sendmmsg$unix(r0, &(0x7f00000013c0)=[{&(0x7f0000000040)=@abs={0x1, 0x0, 0x4e22}, 0x6e, &(0x7f0000000400)=[{&(0x7f00000000c0)="8ef89e0de0148ccd50ff05c80b68dbec8d0b201a876587a62731bc0d6ef1db994abfd110bbb073452177affe026b4da9a7dd7e11e4fca2b82c0964cb243f92c38912cac82ca5b4649a2e59e57485130fa35c0fb5acb434b2903011e3bbc986997137b23aa034d3a3bf609079a9eb1806502da3342f8adc01e055da617566415ce9126582c359e247bcbed959dc3ffe6713f124b98867cfef08d94d5916d853b063dc3aa826e56f6b1e99cd8788750a8e01a21325d0b141106348c5", 0xbb}, {&(0x7f0000000180)="3eafda1a4f31dbd9c0bd5aaa5f2ea5727a977c03c640fd75d233957e12fefd943dbb631de5", 0x25}, {&(0x7f00000001c0)="d8f28632a70a828f3c3e48700f5171d0654d63c8c7c3f2db637d8da50c533ccc2c1798b0c5067172d9fd43c3799c894aab013dde522cd07edd5cf02050a2d882ea111d6d0ee9d99ac841b61c794bdddaa71abf0ceaf0c095b86358eaeb4d3c8425f9df78ef6a058cddd3612c4a30f0c1dd326467f9188d6dc1a80a1714d78e5c9fe9ef88f3c3fe37dfb435cc5f892fbaaed9f50a34712466121b8b4678080b68499a0e", 0xa3}, {&(0x7f0000000280)="7bcb3b070be45d42e3d703809968868a33effbfd467395c9e3a11f6c750e427e14e4ff8ae185c6a7e2fd52fad43647e85acd03652bf23c5f81d1e844bc4f35bbee5aebfc80c83ed3f50c0c2ed0a2a84295331a278ceb5bdf8df7377e0e9dfb46d15f46607655104144ee3a95bb43f16ed81a048f4d5ad64ad3ee8069", 0x7c}, {&(0x7f0000000300)="7764788731922456972512a4b56dfa6107ffcdc476a3a02be1d7e2e82c1f50c5b89f76df5ea912638670e633482fd03f32351d904211d1b4efbb7e49c2a78836529f2d796f005f0fb7b70ac74ea27f84ed3ad2c24d15538fef24e93dd1d56900b466ffe198d59c95972234f216c1278f16bab0d16c29ba4e7f8c319aeb6b221e1781e47026d15fc43323f719f065eb533abbe147ef7a99ce6d", 0x99}, {&(0x7f00000003c0)="ac04a934fe02b5e418648011", 0xc}], 0x6, &(0x7f00000005c0)=[@rights={0x18, 0x1, 0x1, [r0]}, @cred={0x20, 0x1, 0x2, r1, r2, r3}], 0x38, 0x4000}, {&(0x7f0000000600)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000740)=[{&(0x7f0000000680)="4fd0523ddcb2503978d06610175f661bef105a25f3ff4c0447809e4efea5d4942b751eb326b8ed7bec14200526628b3c60a2799adb5c785ef9bf32ab1cfdbf2985ac7042fe70e757ed7d752a540b672d7237f13b1c2ea817e05dfe52e544ca9d74749b6476806b00890b3ab603e73db7accc805942c3402d4eaf0f0a50fd159208dcec8e051c0bf3d7f4653a2f4af3ab449b4b591709", 0x96}], 0x1, &(0x7f00000009c0)=[@cred={0x20, 0x1, 0x2, r4, r5, r7}], 0x20, 0x20040000}, {&(0x7f0000000a00)=@abs={0x1, 0x0, 0x4e21}, 0x6e, &(0x7f0000000ac0)=[{&(0x7f0000000a80)="c3dbc6199d60ce89370d9bf71b4351d90c8b2869ed80343837c2291b6370c7d654fdddda", 0x24}], 0x1, &(0x7f0000000d00)=[@rights={0x20, 0x1, 0x1, [r0, r0, r0]}, @cred={0x20, 0x1, 0x2, r8, r9, r10}, @cred={0x20, 0x1, 0x2, r11, r12, r13}], 0x60, 0x40}, {&(0x7f0000000d80)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000001000)=[{&(0x7f0000000e00)="0fbc583fc5cd6bd63bdd4a463d7c81e0d8eb1a15822c3880d266f3641c4d18d396a19a479ac3dd96fcbc9f4e5f6c9c4d2c1629e3d4eaf174b7c45a3a1fc77da771c057bc3b19db2f8c972fadb8", 0x4d}, {&(0x7f0000000e80)="81b5769cc49a0043262a2eafa944eec7422e17b821e83b773beeec74da523998cbe7c9c19527d1584b2dcb6e42e6ad6712cabb8fd65c6b62cf9346142cb2ca3c7cce3682b17a8899e101bb48ad1dbd6e329d15670e837753cbeb02db31a3f338c202f7fcdb2676a2234a9ee097f65fc7d9e4cc34ddf091a37d6a0b1b187fed96935a90d7f3b04658ade7a16565d1eaefbb8f1bf2454cf1aaa40a2c422de72c67d14d86aaba98feab", 0xa8}, {&(0x7f0000000f40)="957b3df6551d4c030cb1585bc7d29b7827b78854b5624cf58891d02d42ffaf413f944bb95e3ab16a6e3bea67bf09ebd10bdec3ca2c65773ab290aba2c0b7dde300041fedae6a4122c0419f028811a96133b16f5a24eddf32ae20f935d6f537a8ea90eedf63d7a540defc4934ddffb40d821c2c1f6f42d2aa5b8aef132358a6e306ccd2d8a51edd96843d35308c47d8b72d547a7c9db04f5082675c56b6ad2610c095c33bbc1b3a92613e5e9e08", 0xad}], 0x3, 0x0, 0x0, 0x4}, {&(0x7f0000001040)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000001340)=[{&(0x7f00000010c0)="025add8f5c579836c404b73b8ba33975bbd0ec33875d4455bdbfd6f464d87817cd8bd0696b47d4165d1eaa1c9f9b9c09007cdb8f082e471da44f164e33615089170827b7c3426bfacb64f4c85fed90d884c7232615d22ecab374", 0x5a}, {&(0x7f0000001140)="39af74d488ad59a4ad1da53b83ffd18d0eb4c1687763a706a9fbb6ab93e83a31745cc04092c59e5a2980f949d62d99c4070a90ca7d01707b73c0d223b8159b3fe6fbdb53f7f6a702df444c019958b172fc9c8bede5c7a0ac3115f331ce6a6143b0915af47e756d5dd11a00e6387a3843d97345a325b3f0ba556383552b3e74", 0x7f}, {&(0x7f00000011c0)="f3c06812202200ff9d11687341fa44220fa73ea37632e639bd3f6e4d7ee43ed0b02f25d95fe22eb8e39c9ed62bda9b1bd1de6a433ed2187d48cc7389fd9d83225565ce9d8d29376052cc", 0x4a}, {&(0x7f0000001240)="6a27e9bf1f684e7338eda0fcb15c00c9275b27ead61d4e838915bc91c377f43b62be48ec49c85f0c8f5cf3a2c61d9c9ebf9db7ca56ea6cfefa694670", 0x3c}, {&(0x7f0000001280)="c5c1123b926405e351c41a50d70fb838bebb709665e89f8bb419bdbb55ed4b601c7d7ed8f6c1904f058c836f436556c3263003946b118eb44b637bac5428093b0f1a0e32e742f3ad34afbec9437b07fcd4564ebafe67852d5b1b28c650ee71a93feb2da512ae1ecc445c3e7f582eddf8c4b165dfaf7d8c04f046e56bce9e5567a342d9a8b6150b345f6b9b32cc62334f80c2982fd977d030a173796c6a8f244e2d4db1568a7fafad7859b65f963b3b00c8bd", 0xb2}], 0x5, 0x0, 0x0, 0x20000080}], 0x5, 0x24000000) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000001500)={{0xffffffffffffffff, 0x0, 0x9, 0x2, 0x8001}}) 22:55:41 executing program 4: unshare(0x28000000) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/rfkill\x00', 0x0, 0x0) r1 = socket(0x10, 0x80002, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") getsockopt$inet_sctp_SCTP_MAXSEG(r1, 0x84, 0xd, &(0x7f0000000040)=@assoc_value={0x0, 0x81ae}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r0, 0x84, 0x70, &(0x7f0000000140)={r3, @in={{0x2, 0x4e23, @rand_addr=0x3}}, [0x6, 0x413, 0x9, 0xfffffffffffffffe, 0x101, 0x1, 0x4, 0xfffffffffffff887, 0xfffffffffffffff8, 0x4, 0x5, 0x38000, 0x0, 0x7]}, &(0x7f0000000240)=0x100) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) poll(&(0x7f0000000080), 0x0, 0x400007f) io_setup(0x400000000008, &(0x7f00000004c0)=0x0) openat$vnet(0xffffffffffffff9c, &(0x7f0000000280)='/dev/vhost-net\x00', 0x2, 0x0) io_submit(r4, 0x0, &(0x7f00000002c0)) socket$pppoe(0x18, 0x1, 0x0) io_submit(r4, 0x2, &(0x7f0000000000)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000080), 0x121}]) 22:55:41 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x2b], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:55:41 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x400000000000000}) 22:55:41 executing program 6: io_setup(0x7fffffff, &(0x7f0000000000)=0x0) io_getevents(r0, 0x8, 0x9, &(0x7f0000000040)=[{}, {}, {}, {}, {}, {}, {}, {}, {}], &(0x7f0000000180)={0x0, 0x989680}) r1 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={0xffffffffffffffff, 0x7, 0x1, 0x7, &(0x7f00000001c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x8}, 0x20) ioctl$EVIOCGKEYCODE(r1, 0x80084504, &(0x7f0000000240)=""/183) r2 = getpid() ptrace$getregs(0xe, r2, 0x6, &(0x7f0000000300)=""/172) ioctl$PPPIOCGL2TPSTATS(r1, 0x80487436, &(0x7f00000003c0)="3885d57fff7a152b94312efd776c45e26c9a1e27f3b1692874779ae6ce75b12c29cfe83d7ccd4ba91dc33d0ff92c1e4e96b726590a5bd77d05106f745af1bfa7a1cf19991ef56051c15fa6c0ce48ae4095df4ab88ac5e39f814333de62fd63355cd398f6106a28996ec34c4ecacc5e0e6e4665df4c50884117acc86bfadc778df1c17e1ca8204e66bd95a0788ed29e6fa90011cdaa3203453438e81cb491a06cbe8f6cef958c68d84d211575e61a4f2ab8b133f0c9b9f08ec025f8b50318ca4c2ee437df61e71c58c6dd9ce231f2b7bb0871e76b8ebcdc02912ccaaefbc554a88b315ece4b6d04c3b7238d0827cd891afc6ae3cab9466356522fe99cf7ace1861a2ce8695f8854c377a1c6b193a83bfaf8614cbf1e4dbdb1dd132d9ba47b63cf5a45f2def8e9806c656059bccb9d357eab33723c894a3ba67b2e75cff96b8202398bbb7961ea22c1538a94db6199b08a3efb19f6634e722fa655259eb884aacd4cbfe03224d62e664a579e852a5e821dc771cb6160b9684b534704a096e992daf65efc215e9fb4f6cc5442140821042cd000faeab86e29eaf5b588064bd3adcb207654433f1cadc7a0a2be9b8f5004e1debab792ebb8e060aae27b73fdac280319e5bec71086b7775841ba9e9a3b2ea5e21a176a582c6c6a006f84d5b4827ab4287bb9696547844275f3f682a40dd8770fbea2f7b43e58d6839285062473ada9dc7aeef4e913bd339df5e0f5f64f78fa59412feba7b3e76e7a65d6126eeec668636a1fb186170c5a1200c73a4ae19da013c4f3609aefe8af739a98ee4b80ef1d807ab5980d406f5747d3cc024b532fe81e58ae560b79969bd2469c77c99ec8e80f147a1970797a0660d5539d0bfd6616676be7d4e38dfea2dde43e6cfadc8aabecb0af472eac62860e9056fdcdb43828921cb7077d361cb9063cc89c05c7c9a6fcea9a18df18c0eb499b75564ef91343aa6b2fde0823bb2f0bd3812198f38660b576b1c7fd14524f24f63046405cbb97497fc50b1899c8ce2420acb47b12c81f676137c08ba7922900a1e712a852f223b43948639b688db97b5d0faa14447a96077cad38841d16a6f799076c20739d655a106ab7aedaa17d5995abe40dc19ba6de912191d2c40bad4b1648070425aacfd94bd6ad6d631a9d86ddaec3ff9f8a28d271933fcd9eb29fd201a2bfbcd49bec8764456ede7197c186316fc3af2cda4a1507c20ddf5f3d0e3d99f730200598c14a5cd399662e2b581a8e70f7196ecdc15c5949dfbd64fa640237a10a0a305a35de5eec38916952deb4836050694fb771b34e9619f1a0f770439b182a36b55107a115e1fd67524767406f3a2ddaf8c660038b9d53b536890686a959ab7f1a104ed180d71281665fa5962896c72fd236b2f546a123aacc9094226635b5d6803f9920614bef2eb49188df89a733e6551e129a097c8880492f2d5b3af99efb18265850bf0f99f1647dc088730d05184977b74b19d77b3e6552fabf133445203c667ec0f6fb7abd3f2f0c1dcfecfc897ed9d34b93b43bf5f2a68f917d5f52d1d7169ae77568487d267536325707c633697d776676582f819ca435b6672666132727348b44f269c1c7ceb87313ab661fe66dfc2b690d59b173893e58e2c8bbd8b70fe0854fb9e4cea6136dfe9a25ed8af94edab093f6fa7900c199b18186aca49937d6ca62a4a293883cc9b6e013e1c8fe9d611b1c2e5277e259a83c930d452b410f2ecbea5f80e1b3d867ebc416548709c6fdfe80c806bee3ec6e36ed26647c67fbc9cfad4d1f59c78696d0eb033a7d9f263b84ba7a2b07efa0db2354dff52cf999c87dc9e785ac3c783b01dc5b91928178dbce02870dad43b4a1b7b9b94d61d4e0c0371024ef140633761b6bc8b058e95ccddff8b6872150692fae05e2944f7ba28e0c93f74fa482ac21eda02774974b6d1e1694adec6593cc6dd03ac3273ad0cfd887d02d06092319fdca624c3427aecd06c5add5c52ecc7419cebb1ab08bc9b6474702167bbdcb11101b07a5c85a63e0e152198e87828146e56ea159e2c225e6d53ff502d56b10c248ca214536d87ee34cdd8d708402d0977963ae1033e661bfe7beeeb69580a33a7336ad8b27b4f8026b8715c91ce4db18da9e8dce2184e23fa45bebb9597010c2a1f2973d90b434d8ae1765c73fbf5137ca32e81539efcfa7c85065b7e17e4f57e04a5d82baeef35a9c541b1d9dbb3542ffe45a88dbaba2cf4a5ba61408730de94bca4e81e8209786d607d834cebca49a55dd50219e3197827c2f2be7e53cb3d948b85538c8ea6d8e3c97891c7798d3b0075be63f238cbda3bedd252d9e51e35455e0dd3fdc71b1881af15f4c6b6c5b1dd811ffa86c718e2c8efcc12893045dd992e9bbb8a42e659c01dafb3d0b6e635ba38d7b5a77a070fdc756bb610badf8b7783d75678d4b409d4c4c972483710f4579aff187585d00b26f91d0f6324bd0880b8d0e142f1a535eeb51cb4867090ae19356ff6864dec3d988ba41f998c3f8491675c47a591bd3bdef3852e5325a31aa73227843e229eb0ba311bc085ac7fc1aeeaa46c9de388d30c2e47fb72fc4d7f7937457a3aefcfd212686b39cfe51939c2ec4fbae0fe5729fcecb23acd2ec5f7b2038f1b2fe4f1b61558454f78d95433b6b41e18a9e3e57d20736a957efd5dc8efc9c984b64c283360c067f0ec8b4110eb1e4b778d2a5059972c06432dbe206850b0e992ba0b05172bf2a154f60729fd23844dab00055ce5b0c86b3484ae46d8d8797cc500720d1f4a995d24be18e1a844943b5eff2c20e8f135b03a8c79f796588b2019da25e1b18251d799e2da78b0d10dbfb26af072b06771d669525febfe957c7a7bea0f9d09aa5ee674706331a1afc9bfcc8c2c7bea52ca148c87c1909deb7b8cfa63d7f01a8fce53b2750421c79749468af1c600d38e83082400a2b5e757d9cbb79af40f875eeb19a1438d2fe4b2e40007e57a6ff68a93b50d081da696e3bbb931d33f12517fbb9847d1de3ae016db87681663327c978bb4b93b7decd0d6e53571a7a6de520236dee8bd53f2cbdd95a1f5339571d1f8a27231ccafef610f30b6d932475754ff519d56da6e8cc514f5a90814b38362879985ee40c050cf5af886679e197d84a8b376e9885fdbdb546ddcf953a74af0d8b33b149e4b53e22e02f83d87bb066cd6c3989a2faaaf4ce4566f1dd0f53e635098569e50a89c4641e108367973d34ba033945fa9982d851d3137f4ced0696d175a12c73b5698ebda877f6736933c485fbe703547674d1811b2d205cf27d1c4df49309bf9960889529651cc10d1c127cc9b827b48bdab46a028cb1eb94039ee4c6bafa021e42b392a12ea8645d1a808722eb35e893792480e4ff36ec3806af144f4d9eb6d84e8d2224e6fb58ab523ecbdb34c3a65bb3f9bbb8b41d3553079ea804a2241e4fad37bf3231fdcd4f377943a63dc3226e5e9b25d4efba7c789615431b19c5a8590663ec8a410c8ed166998bacce8fec794f417736911304b7396adf81348f5e6e618cb952de283457beabbb140b427afef5c4f00798a8557e8049d98ed16c6484002f00dddf91918e60c5a6601fd4ca57a95bfda8f8c084bd65994041b6818fde071060e99f63866cbefa406647ec0d02d0eed7015d66e93578c2d8e1ff8fcaf4efda5a341ccbc2ba0e95426a6e313766246e9971248bccc838228a9a304e4cb34ac40c31aa4b51e4649e43d22e020035385db02d9ef76b2b1bc0ac296bb4b2029c57db38b3a6736b39afabf98b75eff9f4c802b78c9517b9b88b26fb5d75cdd1ba297757732ecd754b7d8c599fb75df04ef8650032b055744e9f227ff60e44fdd7cdd6e0680cee6e9dad10fd9f96e28b0807d0a401c273c1f9301246f86147cb465db0cb8dab8d719c598d4c6fc0649d9a1e65147132628b74de35e338280c79f506b8fb742bcccbf3d03ff2633e124c51517f5a6e61dcc9c4893f3ebf03e1cf649f0b860e71a21c95b02478af4f078d9bbd563db8349efb1bcc86731891d1c340f2cf078536e2999c452e116aa28975e8be20c026fada15a1439fc7d4543bc12b888caaf48c2309fcf325c3df2ae8cf8b9c971fb0f739587b3614e5fea2b869c3f605272411619ef0a0bb932cc02a26d31e7309581099f08887a43e034a0e50828af167d34da234cc3555df221100a886242c04095ec2d1142f444753a1d5a0a4e09a94a9960d70f4d6c20db4dea1be2158b1d6175445f51db2fd5e9c566f31192a2bb7a05a6ec500c40b470a9ebcfbc5021564e8c3ff950f445e30718d1011d45a5096123f829905b88473a65a966a141adba8b6f0a462e036ec58b70c9818b03ddcc167fd32426350350dceac7d3011dcd59c991329db86743158070ebd681954103566ec8b5ca6d7e091b5928fc68830f967afdbb463e375d4007dcf278aa5e99cff51b7883bdb47a4be9c9eace51c2931856a794989a23d34dc456f08efdfec8636833763f752bb9c5bd10ca488589bf8628e0d47d960c881bb23f7b41a012e5290d51acaa786cbf213703bb033bf1cfb16f3a016db5656cf852e6ec54b6c9255d7505a43276f5701724954d70efd540e388c14c22830a1ff2dc166e03e15fd90657d8ac07ea5c9ac88d38b5064fa1be1b84cb813275027bf69bcd77077253d598893b5394b139c9efde8ce7e5e0a3a5a834667b3d13927377a81eb586e37ebfb43b5a55f420ff1338cef9a98a01f81e2dd84dabe2b7275972d6e1578c38ec1a763482784c53414c1a1196cab58877e698167c878003adcba18bac20c84cd412c6e927ba6a7342267383e8f1c78dc25430a602d814dc51a8563c27d6e108428af40f70d95df39c7b5e32b4cfca4ad35293e6b21327fc4d92fb4eda3d0e57b27a27e9971a7e31f8fd9ec5ead6d9dd921ee788ab0306beb2592c667acfcdbbc4bc6f0a317a912ce7c1aafb0163d51e804b205ce89b3be5d833d001501be9a05027c324aedb2b2c9ec352bedec8db45c8907e975167b49064907b0d2e2dcd3eeec83b506efecdf5ca506e17bbc7ff69b524262e755864d7a57e4f29fbe6e233fa5cf041953d7a7a7fb35ec5923aa79c6e9c21298fa9a7df40c4fcfe25eccb1cb4b388238f29fbfef7ebda1cc2b103dc5a326902747bd940a9345322f297e80b3d8147bc1ea627db9bf4f6173512d209ea9e9e35f37de86de207b1f44d6a8ccb6b8e6aa079270e59dfa2753103fae7fec5ac4495320e91c536a20bdf2e9b515f9bd6b902bf77ed957a56be5477c695815758e52594dd48a59f38f56bc8537128675213f3013ec0bb38fe42f6413911904edd13169eda04c4f0358601eb9061c3d6e3b353d3280057af9df0f0cb98a1636fe650b4091c7127a4ba75823a2068fe2af19dc043fbd0114f85d78eb82169befea0377551ccb43362c2b354f4007ec89f02992bd2a7df6a57cca2d4676cd6b784ede5b18db7b0749a729f7533a61c076574e3f9c59793f46a194235b33c2c6cdac04843b4b19efe6aee779793ca2367b1f2cb9466092d031a9902e00ad8888bb0e5b5be374bb9ba5f039d14dcbbf650c99ed9f88be79ed7712ac6abadc77c74e98966a84c6bde35b3528966988033c4094be0d70d8e61e30140c39299d423d94623fd359a3f7b8b511be25a75301379942e321ce00f509adc02bcee6d8fd1338ca80816db260b12538f3a6acd2241641b42ec83efeccda1305e784ac1b5db35266aca6566fb245dea9aecdb2dc9e053ed97cfe7ce775e6a254370505903fdfb0d128a48d34aba927a7bec4") ptrace$setregset(0x4205, r2, 0x201, &(0x7f0000001400)={&(0x7f00000013c0)="9abf51dcdc4b8d91eff03cf6f81b70e9da7ae27cdf2f0511d26ef4812849ca8e44f37ed317e3e1efbe497e41c35518", 0x2f}) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f00000014c0)=@mangle={'mangle\x00', 0x1f, 0x6, 0xc30, 0x700, 0x3b8, 0xa20, 0x700, 0x0, 0xb60, 0xb60, 0xb60, 0xb60, 0xb60, 0x6, &(0x7f0000001440), {[{{@uncond, 0x0, 0x118, 0x140, 0x0, {}, [@common=@eui64={0x28, 'eui64\x00'}, @inet=@rpfilter={0x28, 'rpfilter\x00', 0x0, {0x8}}]}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00', 0x0, {0x1}}}, {{@ipv6={@empty, @remote={0xfe, 0x80, [], 0xbb}, [0xffffffff, 0x0, 0x0, 0xffffffff], [0xffffffff, 0xff0000ff, 0xffffffff, 0xffffff00], 'veth1_to_bond\x00', 'bridge_slave_0\x00', {}, {0xff}, 0x73, 0x9, 0x7, 0x3}, 0x0, 0x250, 0x278, 0x0, {}, [@common=@inet=@policy={0x158, 'policy\x00', 0x0, {[{@ipv4=@remote={0xac, 0x14, 0x14, 0xbb}, [0xff000000, 0xff], @ipv6=@dev={0xfe, 0x80, [], 0x21}, [0xffffffff, 0xff000000, 0x0, 0xff], 0x4d3, 0x3505, 0x4, 0x1, 0x8, 0x2}, {@ipv4=@dev={0xac, 0x14, 0x14, 0x1f}, [0xff000000, 0xffffffff, 0xffffffff], @ipv6=@mcast1={0xff, 0x1, [], 0x1}, [0xffffffff, 0xff000000, 0xffffffff, 0xff000000], 0x4d5, 0x3506, 0xc, 0x1, 0x1, 0x10}, {@ipv6=@mcast1={0xff, 0x1, [], 0x1}, [0x0, 0xffffffff, 0xffffff00, 0xffffffff], @ipv6, [0xffffffff, 0x0, 0xff000000], 0x4d2, 0x0, 0x33, 0x1, 0xf, 0x12}, {@ipv4=@dev={0xac, 0x14, 0x14, 0x17}, [0xff000000, 0x0, 0xffffffff, 0xffffffff], @ipv4, [0xffffffff, 0xff000000, 0xff000000, 0xff000000], 0x4d4, 0x3505, 0x87, 0x0, 0x1, 0x1e}], 0x2, 0x1}}, @common=@frag={0x30, 'frag\x00', 0x0, {0x8, 0x3, 0x0, 0x8, 0x2}}]}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00', 0x0, {0x1}}}, {{@uncond, 0x0, 0x320, 0x348, 0x0, {}, [@common=@unspec=@bpf0={0x230, 'bpf\x00', 0x0, {0x9, [{0x80000000, 0x401, 0x7f, 0x101}, {0x1, 0x100000000, 0x6, 0x3}, {0x7, 0x1, 0xfffffffffffffc01, 0x80}, {0x5, 0x3f, 0x5, 0x32}, {0x7ff, 0xfff, 0x1, 0x7}, {0x8000, 0x4, 0x1, 0x3ff}, {0x1ff, 0x800, 0x6, 0x6}, {0x8, 0x7ff, 0x800, 0x40}, {0x100000001, 0x8, 0x101, 0x3f}, {0xe9c, 0x7, 0x101, 0x8}, {0x8, 0x40, 0x800}, {0x0, 0x400, 0x41, 0x1ff}, {0x7fffffff, 0x9, 0x4, 0x3}, {0x31e0153d, 0x4, 0x9, 0xfffffffeffffffff}, {0x1, 0x1, 0x6, 0x10000}, {0x5b1, 0x1f, 0x7fff, 0x7}, {0x10000, 0x3, 0x8001, 0x4}, {0x468, 0x3, 0x8001, 0xfffffffffffffff9}, {0x1, 0xabe, 0xfffffffffffffffb, 0xffffffff}, {0x6, 0xbd, 0xffffffffffffffff, 0x8001}, {0x5, 0x8, 0x7, 0x1}, {0x1, 0x2, 0x3, 0x80000000}, {0x0, 0x1, 0x9, 0x2}, {0x0, 0xfffffffffffffff8, 0x1, 0x4}, {0x1, 0x8, 0x0, 0x9}, {0x5, 0x6, 0x5, 0x7fff}, {0x0, 0xffffffff, 0x10000, 0x176}, {0x100000000, 0x400, 0xffffffff, 0x8}, {0x9, 0x6, 0x7fff, 0x7ad}, {0x906, 0x100000001, 0x2, 0x1f8}, {0xb4, 0x8001, 0x4, 0xffff}, {0xfff, 0x47, 0x4, 0x9}, {0x1, 0x1, 0x7fffffff, 0x100000}, {0x6, 0x7, 0x4, 0x1}, {0x100000000, 0x43d, 0xffffffffffff0d8a, 0x7}, {0x5, 0x7, 0x0, 0x9}, {0x6, 0x3, 0x6, 0xdf04}, {0x8, 0x7fff, 0x40, 0x401}, {0x1, 0x2, 0x1, 0xdec}, {0x895910d, 0x3, 0x8000, 0x2}, {0x0, 0x9, 0x1, 0x200}, {0x9, 0x1, 0x1ff}, {0xffffffff00000001, 0xfff, 0x4, 0xe8}, {0x2, 0x7, 0x100000000, 0x1000}, {0x85, 0x84b4, 0x1b, 0x20}, {0x0, 0x4ad, 0x5, 0xf699}, {0x400, 0x5, 0x6, 0x800}, {0x5, 0x5, 0x8, 0x2}, {0x3f, 0x40, 0x101, 0x101}, {0x3, 0x4, 0x1f, 0x71}, {0x8, 0xeae, 0x31ccfaea, 0x6}, {0xffffffffffffffe1, 0x1, 0x4, 0x6000000000000000}, {0x100000000, 0x9, 0x2, 0x6}, {0x4, 0x0, 0xffffffffffff31ac, 0x4d65}, {0xfe, 0x6, 0xffffffffffffffe1, 0x2}, {0xffffffffffff68ff, 0x3, 0xc18b, 0x7f}, {0x10000, 0x4bf, 0x6d, 0xfffffffffffffffd}, {0x8fc, 0x2, 0x9, 0x7}, {0x1ff, 0x8, 0x6, 0x3}, {0x0, 0x5, 0x9, 0x8}, {0x3, 0x9, 0x96c9, 0x1000}, {0x81, 0x10001, 0x80}, {0x1f, 0xb4b, 0xc0cb, 0x5}, {0x9, 0xb5f, 0xf966, 0x2}], 0x990}}, @inet=@rpfilter={0x28, 'rpfilter\x00', 0x0, {0x4}}]}, @inet=@TOS={0x28, 'TOS\x00', 0x0, {0x3, 0xff}}}, {{@uncond, 0x0, 0x2f8, 0x320, 0x0, {}, [@common=@unspec=@bpf1={0x230, 'bpf\x00', 0x1, @bytecode={0x0, 0x6, 0x0, [{0x1f, 0x7c, 0x80000000, 0x8}, {0x100, 0x4c11484b, 0x195, 0xdd}, {0x5, 0x8, 0x7f, 0x7}, {0xffffffffffffffc1, 0xfffffffffffffc29, 0x100000000, 0xffffffff}, {0x7, 0x9cf, 0x2, 0x4}, {0xcd9, 0x9, 0x0, 0x2}, {0x3, 0x100, 0xfffffffffffffffd, 0x3f}, {0x40, 0x101, 0xa54}, {0x668, 0x7fffffff, 0x7fffffff, 0x101}, {0x1, 0x3, 0x9, 0xfffffffffffffffe}, {0x5, 0x8001}, {0x100, 0x80000001, 0x200, 0x7fff}, {0x1ff, 0xfffffffffffff4a9, 0x617, 0x7}, {0x8001, 0x800, 0x7fffffff, 0x5}, {0x100000000, 0xa08c, 0x3ff, 0x100}, {0x80, 0x6, 0x57f1, 0xffff}, {0x6, 0x8, 0x3, 0x5}, {0x1, 0x9, 0x61b9c470, 0x81}, {0x100000000, 0x73c, 0x7, 0x1}, {0x8, 0x7ff, 0x3, 0x4}, {0x8, 0x8, 0x1000, 0x2}, {0xd47b, 0xffffffff, 0xa7e3, 0x20}, {0x2, 0x8, 0x9, 0x2f67}, {0x5, 0x2, 0x4, 0x2}, {0x2, 0x0, 0x5, 0x4}, {0xc66a, 0x100000001, 0x6, 0x24}, {0x4, 0x9, 0x3, 0x3c}, {0x2, 0x5, 0x4, 0x1}, {0x2, 0x10000, 0x2, 0x2}, {0x1, 0x8, 0x7fff, 0x1}, {0x7df, 0xb9, 0x1, 0x8}, {0x5, 0x0, 0x4, 0xffffffffc79e77c1}, {0x6, 0x7f, 0x20, 0x2b}, {0xfffffffffffffff9, 0x2, 0x8, 0x80000001}, {0x2, 0x0, 0xffffffffffffffff, 0x40c5}, {0x3, 0x7ff, 0x7f, 0x80000000}, {0x401, 0x200, 0xfffffffffffffff7, 0x2}, {0xb2, 0x6, 0x10001}, {0x6d, 0x4, 0x0, 0x5}, {0x34d, 0x40000000000000, 0x8, 0x9}, {0x89, 0x0, 0x4, 0x3f}, {0x5, 0x1000, 0x20}, {0xffffffffffffffff, 0xff, 0x401, 0x101}, {0x2, 0x9, 0x7, 0x5}, {0x0, 0x9, 0x1, 0x3}, {0x1, 0x7, 0x4, 0x6}, {0x7fff, 0x6, 0x8, 0x8000}, {0x8001, 0x8, 0x9, 0x7}, {0xffffffff, 0xfff, 0x4, 0x1ff}, {0x5, 0x6, 0x4, 0xef0}, {0x5, 0x9c, 0x343, 0x3ff}, {0xfc000000000000, 0x1, 0xfff, 0x80000000}, {0x2, 0x4, 0x2, 0x5}, {0x1000, 0x4000000040000, 0x7, 0x4}, {0x9, 0x4, 0x7, 0x7bb}, {0x0, 0x9bb, 0x0, 0x67847034}, {0x96, 0x80000001, 0xb0dc, 0x844c}, {0x400, 0x80000001, 0x2, 0x8}, {0xd5, 0x4d4ddb01, 0xffff, 0x3ff}, {0x40, 0x8000, 0x38, 0x1}, {0x130, 0xfc51, 0x0, 0x2}, {0x7, 0x5, 0x5, 0xa2a2}, {0x8, 0xd580000000000000, 0x8f}, {0x0, 0x1f, 0xcbb1}], 0x2cd}}]}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00', 0x0, {0x1}}}, {{@uncond, 0x0, 0x118, 0x140, 0x0, {}, [@inet=@rpfilter={0x28, 'rpfilter\x00', 0x0, {0x1}}, @inet=@rpfilter={0x28, 'rpfilter\x00', 0x0, {0xf}}]}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00', 0x0, {0x1}}}], {{[], 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x0, 0xfffffffffffffffe}}}}, 0xc90) ioctl$TIOCGPTPEER(r1, 0x5441, 0x0) ptrace$peekuser(0x3, r2, 0x9) getresuid(&(0x7f0000002180), &(0x7f00000021c0), &(0x7f0000002200)=0x0) r4 = request_key(&(0x7f0000002240)='id_resolver\x00', &(0x7f0000002280)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00000022c0)='ppp0\x00', 0x0) keyctl$get_persistent(0x16, r3, r4) getsockopt$bt_rfcomm_RFCOMM_CONNINFO(r1, 0x12, 0x2, &(0x7f0000002300)=""/38, &(0x7f0000002340)=0x26) setsockopt$inet_MCAST_LEAVE_GROUP(r1, 0x0, 0x2d, &(0x7f0000002380)={0x3f, {{0x2, 0x4e21}}}, 0x88) lgetxattr(&(0x7f0000002440)='./file0\x00', &(0x7f0000002480)=@random={'btrfs.', 'bridge_slave_0\x00'}, &(0x7f00000024c0)=""/145, 0x91) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000002580)=[{0x8, 0xcb}, {0xe, 0x480}, {0x4, 0x9}, {0x0, 0x37}, {0x0, 0xfa3e}, {0x0, 0x5}, {0x8, 0x838}], 0x7) waitid(0x2, r2, &(0x7f00000025c0), 0x40000000, &(0x7f0000002600)) ioctl(r1, 0x9, &(0x7f00000026c0)="258e4aa0d3c9d0066a4386c6ec262654743bec87068e5942bc7ce8144d110256c4a61235da0163c92f26c225ed765598db430db7a3a1c47fe83192f0dfade4ccc7a660ac1eb850b9d26b85d7c62df48edeb1597decd783ddda0e29e81af1814b882177b01047f10a907a2065cc2891719193dad0b372c68a3f1102186a9f") getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r1, 0x84, 0x70, &(0x7f0000002740)={0x0, @in6={{0xa, 0x4e24, 0x100, @empty, 0x8}}, [0x5, 0x4, 0x100000001, 0x7f, 0x0, 0x80000001, 0x7f, 0x3ff, 0x6, 0x0, 0x5, 0x3, 0x16, 0x401, 0x6]}, &(0x7f0000002840)=0x100) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x1f, &(0x7f0000002880)={r5, @in6={{0xa, 0x4e22, 0x6, @ipv4={[], [0xff, 0xff], @rand_addr=0x4}, 0x7}}, 0x94bb, 0x8}, &(0x7f0000002940)=0x90) ioctl$SNDRV_TIMER_IOCTL_INFO(r1, 0x80e85411, &(0x7f0000002980)=""/105) ioctl$RNDADDTOENTCNT(r1, 0x40045201, &(0x7f0000002a00)=0x8) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000002a40)={{{@in6, @in=@dev}}, {{@in6=@dev}, 0x0, @in6=@local}}, &(0x7f0000002b40)=0xe8) setsockopt$inet6_mtu(r1, 0x29, 0x17, &(0x7f0000002b80)=0x3, 0x4) setsockopt$IP_VS_SO_SET_ZERO(r1, 0x0, 0x48f, &(0x7f0000002bc0)={0x3c, @loopback=0x7f000001, 0x4e24, 0x1, 'none\x00', 0x4, 0x2, 0x35}, 0x2c) sendmsg$nl_generic(r1, &(0x7f0000002f00)={&(0x7f0000002c00)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000002ec0)={&(0x7f0000002c40)={0x258, 0x1c, 0x0, 0x70bd2c, 0x25dfdbfb, {0x1}, [@generic="de5c70447fb67361bc7c7faab37a0dd35b60f469152876086e14efba07", @typed={0xc, 0x55, @str='ppp0\x00'}, @generic="e19f2c102a0916f107c42fc7735aa5a1d0137294c12eb991b47c266b6d28da69c66988bdfa5e4e2829418417f6e1361fe8c84af3460a37160c76c0ad6bbd9c8ed76d89c73c448d53f01fbac9e51c68d690f83a183f1d2990c8441098bf755bc95c99247182a003710009817f85022549aee798a947625e4c57c96f2b1e8eede0275b76bb8c3114281ddaaf1caaec6c834d0fc3f94f80a7d86300e931538976f83afb9cc254ba6a96129ac5db769ec0fc40", @typed={0x8, 0x2f, @ipv4=@loopback=0x7f000001}, @generic="633b34a1faade6c599c83f35b3d2725de03b852ce50e6840b900b6276194c22228301cbc93c6fcf01e3d83c9528fbe414b62ba339e9608dde8de46a07f0191ebd30cf28060f1adf523e6f70081269d840b4a7f45c5350f9fff3d6e097d75279e44e7fb36fdab3c49f4fd316c9d084a0f2a67718906a36a9d9002b77218829f28dfbfb314340dc5bd80c292b505e6f6e0ca891be9e23463af359b1a", @generic="29df47f95fd1313c98ab17e49189ecaa0fa523128c63694c298e980f74eb02a57f5d87c2d0ca522dd5b3a07b8374f8123c7ffb734f75cc5bfaa3e9f815658a85c2de62f4830b4d871506378ba00378dcef7fd02974ff17367c19a04ec0195dbc3986bc6ec3da58fd5721a71da28a9399e071a9c8f5690f68c4cec6478020f1f8939a7f2ddf3bd049d9159c016d8ac8a7f90d3e180ea4ae57fc626c2bc83f95a7072662874922a6d1775a9fd38451240c3ce404848554de0414c42511a8bfe264e5733e0e9e"]}, 0x258}, 0x1, 0x0, 0x0, 0x20048804}, 0x4000000) keyctl$get_security(0x11, r4, &(0x7f0000002f40)=""/188, 0xbc) getsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000003000), 0x10) [ 791.114973] binder: 705:730 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 791.122052] binder: 705:730 got reply transaction with no transaction stack [ 791.129278] binder: 705:730 transaction failed 29201/-71, size 0-8 line 2759 [ 791.250994] binder: undelivered TRANSACTION_ERROR: 29201 [ 791.256602] binder: undelivered TRANSACTION_ERROR: 29201 22:55:42 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) read(r1, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(r0, 0x540e, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000016) 22:55:42 executing program 0: pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x800) sendmsg$nl_route_sched(r0, &(0x7f0000000380)={&(0x7f0000000080)={0x10}, 0xc, &(0x7f0000000340)={&(0x7f00000000c0)=@deltaction={0x250, 0x31, 0x200, 0x70bd29, 0x25dfdbfb, {0x0, 0x100000001, 0xfff}, [@TCA_ACT_TAB={0x44, 0x1, [{0x10, 0x5, @TCA_ACT_INDEX={0x8, 0x3, 0x7}}, {0x10, 0x16, @TCA_ACT_INDEX={0x8, 0x3, 0x8}}, {0x10, 0x11, @TCA_ACT_INDEX={0x8, 0x3, 0x4}}, {0x10, 0x3, @TCA_ACT_INDEX={0x8, 0x3, 0x9}}]}, @TCA_ACT_TAB={0x5c, 0x1, [{0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3, 0x3ff}}, {0x18, 0xa, @TCA_ACT_KIND={0x10, 0x1, 'connmark\x00'}}, {0x10, 0x7, @TCA_ACT_INDEX={0x8, 0x3, 0x4}}, {0x10, 0x3, @TCA_ACT_INDEX={0x8, 0x3, 0x81}}, {0x10, 0xa, @TCA_ACT_INDEX={0x8, 0x3}}]}, @TCA_ACT_TAB={0x28, 0x1, [{0x10, 0x19, @TCA_ACT_KIND={0x8, 0x1, 'xt\x00'}}, {0x14, 0x1, @TCA_ACT_KIND={0xc, 0x1, 'police\x00'}}]}, @TCA_ACT_TAB={0xb0, 0x1, [{0x10, 0x8, @TCA_ACT_KIND={0x8, 0x1, 'bpf\x00'}}, {0x14, 0x11, @TCA_ACT_KIND={0xc, 0x1, 'police\x00'}}, {0x10, 0x6, @TCA_ACT_INDEX={0x8, 0x3, 0x3f}}, {0x14, 0x1, @TCA_ACT_KIND={0xc, 0x1, 'vlan\x00'}}, {0x10, 0x1, @TCA_ACT_INDEX={0x8, 0x3, 0x8001}}, {0x14, 0xb, @TCA_ACT_KIND={0xc, 0x1, 'mirred\x00'}}, {0x10, 0xa, @TCA_ACT_INDEX={0x8, 0x3}}, {0x10, 0x1e, @TCA_ACT_KIND={0x8, 0x1, 'bpf\x00'}}, {0x10, 0x1f, @TCA_ACT_INDEX={0x8, 0x3, 0xc026}}, {0x10, 0x15, @TCA_ACT_KIND={0x8, 0x1, 'ipt\x00'}}]}, @TCA_ACT_TAB={0x3c, 0x1, [{0x14, 0xa, @TCA_ACT_KIND={0xc, 0x1, 'skbedit\x00'}}, {0x14, 0x11, @TCA_ACT_KIND={0xc, 0x1, 'vlan\x00'}}, {0x10, 0x7, @TCA_ACT_INDEX={0x8, 0x3, 0x2}}]}, @TCA_ACT_TAB={0x18, 0x1, [{0x14, 0x6, @TCA_ACT_KIND={0xc, 0x1, 'csum\x00'}}]}, @TCA_ACT_TAB={0x5c, 0x1, [{0x14, 0x3, @TCA_ACT_KIND={0xc, 0x1, 'gact\x00'}}, {0x10, 0x18, @TCA_ACT_INDEX={0x8, 0x3, 0x10000}}, {0x14, 0x14, @TCA_ACT_KIND={0xc, 0x1, 'vlan\x00'}}, {0x10, 0x5, @TCA_ACT_KIND={0x8, 0x1, 'xt\x00'}}, {0x10, 0xe, @TCA_ACT_INDEX={0x8, 0x3, 0x9}}]}, @TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x19, @TCA_ACT_INDEX={0x8, 0x3, 0x10001}}]}]}, 0x250}, 0x1, 0x0, 0x0, 0x40}, 0x20048080) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000040)=0x4006, 0x4) sendto$inet6(r1, &(0x7f0000000400)="0401000000c000ddd3460900ffb25bc202938207d9033780398d5375c5f73f2e5506dc5712f29513f06f8f6575efe5eb8f00beff8b307756bdb02262391ff4a728834186520000000000000000000000", 0x50, 0x0, &(0x7f0000000500)={0xa, 0x100200000800, 0x8000000000005, @ipv4={[], [0xff, 0xff], @broadcast=0xffffffff}}, 0x1c) 22:55:42 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x3000000000000000}) 22:55:42 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x6000, 0x0, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) 22:55:42 executing program 7: syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)) r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0xc000, 0x0) setsockopt$packet_buf(r0, 0x107, 0x2, &(0x7f0000000040)="a98c31f44dc4833468056c93cd0b571119660eb43b3285d0508e8b25cbf458a166381286a2c12656d4ee84d48e6c97b6c735e10963766020437fd428dcc9b229eda5bec32e704ba41c3d27265f196f6e5e5e0afa98a8d92726cff14a2ae7b90e5681f1b660df8e707920b8dd188fb2f15e2b56129e1210af35e8d9740a2b7603be156814", 0x84) 22:55:42 executing program 6: r0 = syz_open_dev$admmidi(&(0x7f00000001c0)='/dev/admmidi#\x00', 0x7, 0xc0080) setsockopt$inet6_tcp_int(r0, 0x6, 0x1f, &(0x7f0000000180)=0x7ff, 0x4) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000080)={&(0x7f0000000140)={0x10}, 0xc, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="20000000140025010000000000000000120f0000", @ANYRES32=r3, @ANYBLOB="080002007f000001"], 0x20}, 0x1}, 0x0) 22:55:42 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x33], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) [ 791.869377] binder: 780:782 BC_FREE_BUFFER u0000000000000000 no match [ 791.899400] binder: 780:782 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 791.906426] binder: 780:782 got reply transaction with no transaction stack 22:55:42 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000140)={{{@in=@dev, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in6=@mcast2}}, &(0x7f00000000c0)=0xe8) fstat(r0, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_fuseblk_mount(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='./file1\x00', 0x6000, r1, r2, 0x0, 0x7, 0x1001040) r3 = socket$inet(0x2, 0xa, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x4012, 0xffffffffffffffff, 0x0) ioctl$sock_inet_udp_SIOCINQ(r3, 0x541b, &(0x7f0000000040)) 22:55:42 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x300000000000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:55:42 executing program 7: syz_emit_ethernet(0x3e, &(0x7f0000000000)=ANY=[@ANYBLOB="0180c2000000aaaaaaaaaa04000000000030000000000067907800000000ffffffff2000907800000000450000030000000000000000ac14ffbbe000000198aff4061bd9a32beec71330b03c213943f68947208a1ab90816ff2eac54df40ddc021676dd910a6bb222ad49e01f51b88fe1e3c86e1802a3bd8101fd1ef2b949f1fc41346e971eddccebbcfaf45242cdfe32e6a484ca0e70a8c029c0118ae85df3ed91c7ec0d36a3366228e43703c46daac81c6c0d42b90eacb36806c7be398be388d780c1ed22d1547b1df87fb29a3672bdcb954207026f66aa8def9a36def4d28dc96f77d64ba4e1e173e75d81c9501bf67f2717b088c5031e0722f99dffef06a8dc4693ede07637a181cbbacc19abcff1c20aaba74ebe279"], &(0x7f0000ea3000)) 22:55:42 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x100000000000000}) [ 791.916364] binder: 780:782 transaction failed 29201/-71, size 0-8 line 2759 22:55:42 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000005000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000080)="b9c70b0000b802000000ba000000000f300f21bcc42175d08cf6d66a0000c4624d93443a00b9980100000f3265f2410f0866470fe07d001d0000000043d9fe66baf80cb85cc87b8fef66bafc0ced", 0x4e}], 0x1, 0x0, &(0x7f00000002c0), 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000008f00)={'bond0\x00'}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = syz_open_dev$sndpcmc(&(0x7f00000001c0)='/dev/snd/pcmC#D#c\x00', 0x100000001, 0x2000) setsockopt$inet_msfilter(r3, 0x0, 0x29, &(0x7f0000000200)=ANY=[@ANYBLOB="7f000001ac1414aa078220013d6b22e40000000004400000ac1414bbac1414aa"], 0x20) ioctl$KVM_IRQ_LINE(r1, 0x4008ae61, &(0x7f00000003c0)={0x9, 0x10000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000000)=[@textreal={0x8, &(0x7f0000000140)="65d9f3ba2000b0e1eed9ff66b8c4b800000f23c00f21f86635000005000f23f80f01d1baf80c66b8a322e48266efbafc0cb09dee6726670f32670fb2aec1cb0000ff22c02200", 0x46}], 0x1, 0x0, &(0x7f00000000c0), 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 792.043097] binder: 780:807 BC_FREE_BUFFER u0000000000000000 no match [ 792.069817] binder: 780:807 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 792.076882] binder: 780:807 got reply transaction with no transaction stack [ 792.084074] binder: 780:807 transaction failed 29201/-71, size 0-8 line 2759 [ 792.115505] kvm: pic: single mode not supported [ 792.115671] kvm: pic: level sensitive irq not supported [ 792.155778] binder: undelivered TRANSACTION_ERROR: 29201 [ 792.166790] binder: undelivered TRANSACTION_ERROR: 29201 22:55:42 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x3000}) 22:55:42 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x29], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:55:42 executing program 6: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sys/net/ipv4/vs/sync_sock_size\x00', 0x2, 0x0) r1 = socket$pptp(0x18, 0x1, 0x2) ppoll(&(0x7f0000000100)=[{r0, 0x2}, {r1, 0x5000}], 0x2, &(0x7f0000000140)={0x0, 0x989680}, &(0x7f0000000200)={0x1}, 0x8) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x1, 0x0) write$cgroup_int(r2, &(0x7f0000000080)={[0x0]}, 0x45c) 22:55:42 executing program 4: perf_event_open(&(0x7f0000000140)={0x2, 0x5c, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_settime(0x6, &(0x7f0000000000)={0x0, 0x989680}) 22:55:43 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) 22:55:43 executing program 0: ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f0000000440)=0x0) r1 = syz_open_procfs(r0, &(0x7f0000000480)='net/xfrm_stat\x00') ioctl$LOOP_SET_CAPACITY(r1, 0x4c07) r2 = syz_genetlink_get_family_id$team(&(0x7f0000000080)='team\x00') ioctl$TCSETS(r1, 0x5402, &(0x7f0000000000)={0xffffffffffffff72, 0x3f, 0xfffffffffffffff7, 0x0, 0x4, 0x0, 0x7, 0x400, 0x927e, 0x101, 0x8, 0x1}) getsockopt$inet6_mreq(r1, 0x29, 0x1d, &(0x7f0000000100)={@loopback, 0x0}, &(0x7f0000000140)=0xfffffffffffffee0) getsockopt$inet_mreqn(r1, 0x0, 0x20, &(0x7f0000000180)={@dev, @rand_addr, 0x0}, &(0x7f00000001c0)=0xc) getsockname$packet(r1, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f00000002c0)=0x14) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000300)={{{@in6=@mcast2, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@rand_addr}, 0x0, @in6=@local}}, &(0x7f0000000400)=0xe8) sendmsg$TEAM_CMD_NOOP(r1, &(0x7f0000000540)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000500)={&(0x7f00000005c0)=ANY=[@ANYBLOB="ac000000", @ANYRES16=r2, @ANYBLOB="00042dbd7000fedbdf250000000008000100", @ANYRES32=r3, @ANYBLOB="400002003c00010024000100757365725f6c696e6b75705f656e61626c65640000000000000000000000000008000300060000000400040008000600", @ANYRES32=r4, @ANYBLOB="566acc81ab894c178a4ffe357f8dbbbe0f29f5b1cb27cb5d3d1f3ddaa7d8cbae20809659f4e799562cc6015d9a7fa1ddde19120a82fe2b94f1bb05cc090014674240730a627068475cd90a133724ed9bc275ed2800dccd0c7e0e66e1aaec015427f7fd907ce97d94521ca7e50d2fcbe378e43afe6bbb7e122eb8b23c6f4a4aa99cf778a4706d82450e04b28f0c260e601cdbf4e6723127322c992267d511bbb99caeeb8d61b5aac4131ce9f5ff4a19de5bde98079e14757e4d5b593ec3cf89412030c70a6149f2a15bf77e0bf6a802010c9610", @ANYRES32=r5, @ANYBLOB="0400020008000100", @ANYRES32=r6, @ANYBLOB="3c00020038000100240001006d636173745f72656a6f696e5f636f756e74000000000000000000000000000008000300030000000800040004000000"], 0xac}, 0x1, 0x0, 0x0, 0x800}, 0x6386419418ba4d3b) r7 = socket$inet6_sctp(0xa, 0x8, 0x84) getpeername(r7, &(0x7f0000000240)=@pppol2tp={0x0, 0x0, {0x0, 0xffffffffffffffff, {0x0, 0x0, @local}}}, &(0x7f00000000c0)=0x80) 22:55:43 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) read(r1, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(r0, 0x540e, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000016) 22:55:43 executing program 7: syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000000080)={0x0, 0x0, [0xde9, 0x0, 0x0, 0xc1b]}) r0 = syz_open_dev$midi(&(0x7f00000000c0)='/dev/midi#\x00', 0x1ff, 0x729181) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000100)={0xf4fb, 0x7, 0x8000}, 0x4) setsockopt$inet6_tcp_TLS_RX(r0, 0x6, 0x2, &(0x7f0000000000)={0x303, 0x33}, 0x4) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000140)=0x0) rt_tgsigqueueinfo(r1, r1, 0x1e, &(0x7f0000000180)={0xe, 0xffffffff, 0x2, 0x3da068c4}) fcntl$setown(r0, 0x8, r1) getsockopt$ARPT_SO_GET_ENTRIES(r0, 0x0, 0x61, &(0x7f0000000280)={'filter\x00', 0xe, "dddca70000008f1566eb978ee0f6b6003e32a99c8872d4aacbefb0d668473a3e0356f8625e842f3ce1644c1e65cff76f821cb072efb0e305c4224eafcf20a7fb1f17b05855597b3997eef5f1f6adad1b3fdf58ad90c6977ab5185a0a435f95a1e91bee47fda5663b3f79025835c551eb42dbe80eb2d509fcb0c9d81ad7e538f7c0c550195a7ec241866f29a238001694b88c4b79d20480ce6ee4a409214fb494af4e92c6bf8d97894ddfb7afe4f8180cc0c80cf0a093f1f8a50a1b6dde53ece4da85f3eadd22ac3c6589bfb10369d6785c8c89ca30d024a3157119320bd4c7044ff804e34ce4f395cab9f717d43f5f1f7c167bec6b328c30e827d6079200b2b4f36b0571af6c7ddda6d90290b2ad2f98bb12d03bc3c32e5f041129e05342162418840b9a9a46e418726ad76840cddae78f3f920d1658b7efc338bacd49dbf90b6b07f5a347adffcffd55315881ccfa2f113b179beb4985c15490d1dd3a36923c56817b53529e80c223a17f580500f9ba26f715c480d6bffc63cf20d92d8ba15dd600"}, &(0x7f0000000200)=0xffffffffffffff2d) mq_open(&(0x7f0000000240)="2c76626f786e5574306d696d655f74797065706f7369785f61636c5f6163612f7373282d63707573657f00", 0x0, 0x14, &(0x7f0000000040)={0xffffffffffffffea, 0x2c, 0x5, 0xe8b0, 0x2, 0x0, 0x9e, 0x7fff}) 22:55:43 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x6000000}) 22:55:43 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x33000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:55:43 executing program 4: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x0, 0x0) ioctl$KVM_SET_ONE_REG(r0, 0x4010aeac, &(0x7f0000000140)={0x7ff, 0x7fff}) r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=@ipmr_getroute={0x1b, 0x1a, 0x3, 0x0, 0x0, {0x80}}, 0x1c}, 0x1}, 0x0) 22:55:43 executing program 6: r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x800, 0xa03) getsockopt$inet_sctp6_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, &(0x7f0000000040)={0x0, 0x10001, 0x8, 0x1, 0x1, 0x9, 0x3ff, 0x809, {0x0, @in={{0x2, 0x4e21, @multicast2=0xe0000002}}, 0x800, 0x7, 0x80000001, 0x6, 0x8}}, &(0x7f0000000180)=0xb0) syz_open_dev$evdev(&(0x7f0000000100)='/dev/input/event#\x00', 0x5, 0x20002) setsockopt$inet_sctp6_SCTP_CONTEXT(r0, 0x84, 0x11, &(0x7f0000000140)={r1, 0x101}, 0x10e) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x40000100}, 0x10) r2 = socket(0x11, 0x80002, 0x0) setsockopt(r2, 0x107, 0xd, &(0x7f0000001000), 0xc5) [ 792.911166] binder: 848:850 BC_FREE_BUFFER u0000000000000000 no match 22:55:43 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x700000000000000}) 22:55:43 executing program 7: syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)) r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x10000, 0x0) getsockopt$kcm_KCM_RECV_DISABLE(r0, 0x119, 0x1, &(0x7f0000000040), 0x4) 22:55:43 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) read(r1, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(r0, 0x540e, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000016) [ 792.957489] binder: 848:850 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 792.964488] binder: 848:850 got reply transaction with no transaction stack [ 792.971733] binder: 848:850 transaction failed 29201/-71, size 0-8 line 2759 22:55:43 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x3c00], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:55:43 executing program 6: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xfff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000003000/0x18000)=nil, &(0x7f00000001c0)=[@text32={0x20, &(0x7f0000000180)="0f09660fd1c7c4e2858c344066b83a010f00d80f3566baf80cb84e8fe38cef66bafc0cec360f07b9640b00000f32660f78c500f88fe99091d8", 0x39}], 0x1, 0x0, &(0x7f0000000100), 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 22:55:43 executing program 4: r0 = socket$inet(0x2, 0x0, 0x5) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000080), 0x4) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="00fe7f0000f2690000000073b2bee4f340eb3c") bind$inet(r0, &(0x7f000012e000)={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) r2 = openat(0xffffffffffffffff, &(0x7f0000000180)='./file0\x00', 0x10840, 0x40) ioctl$KVM_GET_VCPU_MMAP_SIZE(r2, 0xae04) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e23}, 0x10) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x80000, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r3, 0x89e2, &(0x7f0000000100)={r1}) syz_open_dev$audion(&(0x7f0000000140)='/dev/audio#\x00', 0x9, 0x101000) [ 792.998862] binder: 848:859 BC_FREE_BUFFER u0000000000000000 no match 22:55:43 executing program 0: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xfffffffffffffffd}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000280)='pipefs\x00', 0x0, &(0x7f0000000040)) r0 = openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x40, 0x8) name_to_handle_at(r0, &(0x7f0000000040)='./file0\x00', &(0x7f00000002c0)={0x1008, 0x3, "6bc6c3e8f77d3ac7264fb359838b258465c3c6cb96e98778c9c79097e1dd0702659791b6e4dce30a9381592b7ab0f487c705b64a3774a4448404fdc93d0d6a5d5a4368e20204806e4a8da5feda38a9522ed78d89bad0d065ffa78790027a380b7e645da35d3b79202e7f830a7ffb16d7b9c0d89ef5f05eae2130105254467193d6f77b3d69096a007608d919d47dc181a955e9fb1494d66d503aecb753e4ba66ccad8b5225fa026c34ccc12cc37f90b22e269332de449cba50eff2eaab285cb90ea3aa234c0e9774c84a1b814d20bd3ded9c0bb67f6e53e8fa2dd889981ac006d204c0e3d33bf64593e41daa30aeb65edb20989e372b885977c53a87627c5bbd5d6c4cd26e3e06eb3b5e1e865c7f3953b4a14651a4b68c64bcd81bdb25e1c844c2406a9e96450a080f22bb7730380acd03c2321057c2bafc1d9e0457560fa1b08d930fb75f9eb7e5b88f676e31856a43676d7a8ccf9ec7f55b728e82cbe7b7b8b90f827a8b0ef7c7638f23700d96cc55b364718d6f41b35e5b2ceb3f899129cf8af63022e89e8d5626c6a17dd4995575466504a24bca2546f45c7b0a4006a95ba3102bfab7ce308558de9ba162184087c2e0ca754725441b4a8fab5a33629405307b82ec71a11326fb701fb9f40d714e5b699a292f42b69975d4e12ba0ce86b060ac5c538ad3671721f8518d14a48484cbc69889fd1d224e6fb450a65565f74fc46ed173dc7690bc6ced33408bcda4e5c8400c900ea0753e772ba043fc9180c3205359921bb8941eeec0361254a8416cdbd3f5740fd538871514bf13da7c59adde64d15e61c9bff4ff7727c0676655d5647b317d67e10d9558b59fcf1d353cd60a2b56720a0a65ed450fcc120df16c1d7b7fdb18631387c08ff326054e149931ec441a566a524c46e0b45765ef7d19f1d5414167978de3125b248fdf8a3ef7afb9ae4706a6cc3870d49a5b5542e959d832319ae5cb8734302ce06e9d1c9a24beeb208328b0c145739bce9a2b554a3a4dc6081977ddcf5035560bc3740066a14745d6a704329a422da24eeeb5a86250300649a771e76041b8510db0a572cf0b51325719bd84ff89561b30e01426e617257657a1afb77830e0ac5ed7de68e787b2897264599fa5143e8992adee64b9ce6d5f2b09d8006ea18e4bc649cf2c14af14709cb7c9af051bcc6b33bff0c190db35cd7603088ae92236b939ff8a3dc223b241b14ea0bb6ecd49f3773cfb4f5689f077507dfa29976e22c660eaf1f4d6362e5de61e725e6e1b97e34a6a573e58e29df41f547119244e69e4e40cae75912ea784e4f8a0064f729ba1c293c064f4825f1d343b17a56dc293e3621c263dfaa213e8b5ab26f4c34f97bf50507c34e9efd7235cadf269631fa19f870d23bc7f19c443f62b01166b2577fbf888980e55dce7ad4a78f3ce58e0378a1d592ebc52bdf34131445f4018e69996edaf12bdb256cd31fdcd61e2c91bd4e6c78b1477baec48a1f8441251cb9f2c50cb18ccecda36e21c249c939b563f8a136abd4ebdeb692f19bb7f93ac6786c2879d545e73b1997bda0826b4e6d2548b81bcda1555b9e09fa49eeae07e1aa68f24ec7a8b58e2a8ecf34e415c4031ad447494ba388dcf1aa944d0e298b3bdb55ce2fd733f9a35421202525a2e4897f631aca25e45d49806c101c67db63ad8184ee10ca57414ca669222b661608114e4cb514192b0f6a0cb8c8b73a645210a5b07a3af752a18a9171d92c4ce0f397c84de8ae6569f91cd1bdc1b3db21745b5aaff56f7edfca1d670ee05845ec28ef97e819b8ad713d705059595f4501fbf06c8b4d1e5739c18152bf025dc1610e77448137a048bcbace27141edb4257d22283cb6a281f2e05eb108b250ba7022e2a100f637143f19328d227cb9c328cf2dde83e1d9012066b00d1c6f79c12d66f4ed1fd7d03742c72d7f02ccd2f4c6aab3702870bc61d100fb6ddf56f7454ea258affa52edfccbe373df95315f57a7e001556f36d721821ff25b3d79d54da9e307544c01232ccca053494ab2aeb91c0a33636362646b921fd5afced43805cf07a05d0fd287e096e237387ca84371561dcf4f5dd7428d3de1077f9142dc086dd0dd902c21688da169004ed87404b1362c7d54136729f53d95f8746a0ffb70afcc3c931e8fe463a5628ecf7df4d2fe256511019420432f4b3c08596522c9d00bf58c819aac17ed0cb096ba2813a5d1020bd3370c0864cb81bfb59cb9949d9ba78ee142cadb3db0a4af5f77754ca97bbb868e0718fbeec0ac4d6e0e74cfc632b6f7270e150dfe3230dcb86d015da1bd216d7fda87b5c580490079834c33c99f55a873ce440f38477548bbe8b5804e3c57a06df8db4b1d06c9b7bda9c2b155fbea433641e082a1956f3f0b5c8b573554e0564b8d17d49e788a4051edc424bbd56e03dc88efe41e3f81e8d9b54f727323e54e2146ec33be026beec4df2570f784cd974e7c94d16cfcc6cab12128d513bfa0218e93ec0f1edbcc3b9f4261dbc75fdf7ec37385bf09873a122dff356cd67927eaa455e2ff9b89d7b92cf561a0ab345ea779f6cce661d6df41ddd3e5f09670162d00e8893e5c8c17245aaed8bbd773e03b87571597eeba6a128cd079d5d250b3ec438b4220d22aad4685d0667bd1083e4a800d88b486c5d4835374a40ac3175176fdf0c3e6f271cf48f2e35e2639b7ce08e2c8ed01ba504cf6e2eac53ae8ee1d77d1b085e7912a27d4f9c49a053abf5f39416eee135f5d1ffc45df267c757eca1821b922ba84c1fb1f4d27cb041962bbd5436a65e80be13fb8bf53ba9718817f217305f9ab46f0407d55b80c47b7c2c53efd1c99da308ae5dece591184c79e65cfedbeb36bf2ee1cb826ee9afe23bda3a875da94103beb7b2085e9f50f95e46912e227d5ea2b9ca710c2fbd36e72a581c748b32769e0326b0ef2a99da51102512df6d6cd0e739eb7e6c16e16c2f90340f4bd2d09f2cbfdf618733322dd6c0e9f5e909abf3f8c2c4f6287f7e07446821cef80621b2683778c3b1603c53979f66d504c142dcce3d101dcddb8966ddbcf0cddf8989cdbd4fe2265031bf703f83cc2a13feed051cd3b0f01929b7f63d58f7dffba9b8bc39836da874c6f104481f645ee415a6adcd30caa8e0bbaafecae2c75f22736c621edb49db48d4e846dc23ad03bb0cb202a6855e1b83c0c8784376e2af3f0b81531f2bc38fc650b395b840f623336d867b7e1fa41a288910b6780b1e19b10ce405400622e2714b145cf530413ee358dae3388c62bcd0e490eb0e503e7469bd20bf42aac8481c6126d479157f3a20e35e7e66b4c2130ee1719942ade9aa0aa8aa73a0b3a696808e94429829a25cf87aa3c28ce9839955ad40eea3c4b8d63d2165ac9c7c73e7d62bc63b6ee6d6dc1456262b7af5b31b93078a3706dd89de64619fb8fa2c313deb0c3a92cdef2fd0dc581d6f868eb237c13dbd6ce77d8784af95585be0c374e9cd10b7051b4887bc08bfcbc5eed457c6058b2eae24dc041c5fbca0ff0a1a890fe02afc47203ffa273e2eb1cb993bcfc8f98eb75be249042b2039eccdb7ab44bc4a301466f7255e5fba3769fa65c1a9032c00011731ae348a3a124ebc71401f68782ae0d81e54aca02553388c515fc827b4ee0b55e320ed956599a75ba15c77fea21c9e1263164245a4b947d52e46a29da3ad25925095796f0bfa7101870512bef8aff9be0338fae875e5df69a2928f28f57a2e867e626429baa1cba781349b9be7e4fe4a3cea65e708aa80185656fd80178352bd55b6f34b5756dcc42e91b6a2462ce1db473bf0594bc14286f2d5aa9d44dc685a2301ee6ba3acf73a2f65e0396af36b843dc173708e4b89512eb5c9ad593b180b6d4d178fb23a62340d67a8192631dec64d8ba118eda2897f3c2a3846db6991da04210dc9a0b7fc6f1b7b62100ab8fef6dfae73282a1d4ef9a168ab6de6022641bfeef549f972f3938dc37a2dca1d144926a5fd28afe0c00bfd3bf900141319abbad5b3df2391b557579b3b00fcad34d7799024a89217ac5dd0ff780bbf6a84d18955b58151260c66f0e1d678ee5732dde346b8accc9265ef112b2f4b38195671c92152abf559fb2f6fd575007409d723b6bfa1477285850423f3e17c8088c00c9a6b5ecfa42959d2b32eaf19e13e67dbc2d4e1242eb5c53378f0b4b583c7c6347930d60b01f644e34a997c3b2be92ef083c55ee6d6577f7423b2ff35e6abe20f58f6a7a0a1f3f815dda2ad9fc92f7676e244192bd5e855dd29b0833b10a068e5a3c76a158a7d5b73ab6d682343060c5fb923f1da21ce2782edcda3235db815e664673312bd72793fcd2652687ead17418a47ab0df9c538d267d5897fa8f8cb39153ac25cd550dfca26763bd93b105a49eba4fce1fdd56d5e931764348fa3f927208dbb54d28ee5540925bbb23bd3d17c06d7a57fc8bb206238a9f4f288ef6e747c27d0f2cf1b4ee72f2093976628e164c665d1880f2dd64c8f27fd39ee7f6fca44a45506e129d13650abe293891eab3322ecb10378fbfe882965cc52b716d0b8613c33fd1e9fb75c488bafbd558d85c96d64195be0e15ff775d9b261b54a7fad62e7ef098891fef0a8bf4ee71ae4e61ef9ceeda04b320c5e7ccb22b5232bdccc3de58f7072b2ac847ee052c967f28bb0119420b5e6cd044e59460abd0fab602f61a78fa587190856e8ce071e26c94c53b7d7e7b16e46d3a7e586c3aba396a8748e91c76d485bf9464a1feebfa187bf18c4c643a00f6ec01bf46ecd1732ccea6e7af97eada9fa3478c9f5376eed8e9ac8d5a3a5e562118886cca48391b46215816b0c11aef2cc5eae25a2c7cf1f9d38952a794070e38f274c131820a7ba8fd4ac4a7a34f519c4852dd7ba38e9e72356e95a694cf72e8d87b235d8b7920e0de02488e86e12398552ff79ffeebab9e9e4b3ff19e9008f747ec87777c6e7c6bc0f4efac0100ea5ec00cfccfada367b8c6e266d043f619f1d9622e49a3bcf7feae1807a588e81c9a504cf7d2bd503f39af7af912f09be2647f6257533a5e6812e36f4e0e7af32ac2bb05ee7d58126a63eabe3f4c08e65fcf69d2c09e803fdba08d8a55a5f7889a5566ca14a83269ccb1a1d9ac8a7cdad459e3922f6cd5b0f601a6d52e03edbde2d6ae26b795c92101d3f2c93827cd3a06bc17d22467d28852703650f3008b66367db4145ad1f1d023ecba3afc9161a1b743b9ec683bf1270b7ead65ddfecd615c1c3595db25ee16bc804d9b051376c32ca771318453beec89dd04a876715be1f7613e180e7e19af365df89f70c3e5836cd69e78b996ef267aa286e60ebc01cb82bde5badf90b1f3d00a820c5a4cc481f3c8c288ff7ba34c8a5db46b2cac21b108b7043f6ded73db4ee1b1e146d2b6c077db82d2e35497e9c1ac44368ebd52c185ded943ea124e0fb7406f7a4690a3390140c1326289a37367115dc1edbe3da06f7fbe745db58df2ed2a027c26437ffb3bbb1a4e97c6d4859c8a7d64b804818305fe222b8135996c301ebca7ef710e4b29b31b93bb1740991cb7d6e9e4b12225ac9641865f04d8b5f5e63571cd717ba24aa3b7336dc70cab098e7402241907352777d71e8d6627ec3f876f3ab24238cd58491df4dbc8f662428a27354b9dfd5063d0eefdd1d7caacc4738a9102b0cfb2030feaabe357b734f558b60f4f32ddd5af32c181d3e612e01f4e2bd88ea2c40f047432a7eb629b2c9cce5446b4fe9b151e3b1ba004a20a41bec0cc4911c17b949ae032279df86794bb2de4f96fccb3da59cd0a7972e13f428760f88427"}, &(0x7f0000000100), 0x1400) [ 793.085354] binder: 848:859 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 793.092287] binder: 848:859 got reply transaction with no transaction stack [ 793.099487] binder: 848:859 transaction failed 29201/-71, size 0-8 line 2759 22:55:43 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x3000000}) 22:55:43 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x500000000000000, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) 22:55:43 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x3], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:55:43 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) read(r1, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(r0, 0x540e, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000016) 22:55:43 executing program 7: r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x4000, 0x0) getsockopt$bt_BT_CHANNEL_POLICY(r0, 0x112, 0xa, &(0x7f0000000040)=0x5, &(0x7f0000000080)=0x4) fcntl$F_SET_RW_HINT(r0, 0x40c, &(0x7f00000000c0)=0x3) socket$nl_generic(0x10, 0x3, 0x10) 22:55:43 executing program 0: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xfffffffffffffffd}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000280)='pipefs\x00', 0x0, &(0x7f0000000040)) r0 = openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x40, 0x8) name_to_handle_at(r0, &(0x7f0000000040)='./file0\x00', &(0x7f00000002c0)={0x1008, 0x3, "6bc6c3e8f77d3ac7264fb359838b258465c3c6cb96e98778c9c79097e1dd0702659791b6e4dce30a9381592b7ab0f487c705b64a3774a4448404fdc93d0d6a5d5a4368e20204806e4a8da5feda38a9522ed78d89bad0d065ffa78790027a380b7e645da35d3b79202e7f830a7ffb16d7b9c0d89ef5f05eae2130105254467193d6f77b3d69096a007608d919d47dc181a955e9fb1494d66d503aecb753e4ba66ccad8b5225fa026c34ccc12cc37f90b22e269332de449cba50eff2eaab285cb90ea3aa234c0e9774c84a1b814d20bd3ded9c0bb67f6e53e8fa2dd889981ac006d204c0e3d33bf64593e41daa30aeb65edb20989e372b885977c53a87627c5bbd5d6c4cd26e3e06eb3b5e1e865c7f3953b4a14651a4b68c64bcd81bdb25e1c844c2406a9e96450a080f22bb7730380acd03c2321057c2bafc1d9e0457560fa1b08d930fb75f9eb7e5b88f676e31856a43676d7a8ccf9ec7f55b728e82cbe7b7b8b90f827a8b0ef7c7638f23700d96cc55b364718d6f41b35e5b2ceb3f899129cf8af63022e89e8d5626c6a17dd4995575466504a24bca2546f45c7b0a4006a95ba3102bfab7ce308558de9ba162184087c2e0ca754725441b4a8fab5a33629405307b82ec71a11326fb701fb9f40d714e5b699a292f42b69975d4e12ba0ce86b060ac5c538ad3671721f8518d14a48484cbc69889fd1d224e6fb450a65565f74fc46ed173dc7690bc6ced33408bcda4e5c8400c900ea0753e772ba043fc9180c3205359921bb8941eeec0361254a8416cdbd3f5740fd538871514bf13da7c59adde64d15e61c9bff4ff7727c0676655d5647b317d67e10d9558b59fcf1d353cd60a2b56720a0a65ed450fcc120df16c1d7b7fdb18631387c08ff326054e149931ec441a566a524c46e0b45765ef7d19f1d5414167978de3125b248fdf8a3ef7afb9ae4706a6cc3870d49a5b5542e959d832319ae5cb8734302ce06e9d1c9a24beeb208328b0c145739bce9a2b554a3a4dc6081977ddcf5035560bc3740066a14745d6a704329a422da24eeeb5a86250300649a771e76041b8510db0a572cf0b51325719bd84ff89561b30e01426e617257657a1afb77830e0ac5ed7de68e787b2897264599fa5143e8992adee64b9ce6d5f2b09d8006ea18e4bc649cf2c14af14709cb7c9af051bcc6b33bff0c190db35cd7603088ae92236b939ff8a3dc223b241b14ea0bb6ecd49f3773cfb4f5689f077507dfa29976e22c660eaf1f4d6362e5de61e725e6e1b97e34a6a573e58e29df41f547119244e69e4e40cae75912ea784e4f8a0064f729ba1c293c064f4825f1d343b17a56dc293e3621c263dfaa213e8b5ab26f4c34f97bf50507c34e9efd7235cadf269631fa19f870d23bc7f19c443f62b01166b2577fbf888980e55dce7ad4a78f3ce58e0378a1d592ebc52bdf34131445f4018e69996edaf12bdb256cd31fdcd61e2c91bd4e6c78b1477baec48a1f8441251cb9f2c50cb18ccecda36e21c249c939b563f8a136abd4ebdeb692f19bb7f93ac6786c2879d545e73b1997bda0826b4e6d2548b81bcda1555b9e09fa49eeae07e1aa68f24ec7a8b58e2a8ecf34e415c4031ad447494ba388dcf1aa944d0e298b3bdb55ce2fd733f9a35421202525a2e4897f631aca25e45d49806c101c67db63ad8184ee10ca57414ca669222b661608114e4cb514192b0f6a0cb8c8b73a645210a5b07a3af752a18a9171d92c4ce0f397c84de8ae6569f91cd1bdc1b3db21745b5aaff56f7edfca1d670ee05845ec28ef97e819b8ad713d705059595f4501fbf06c8b4d1e5739c18152bf025dc1610e77448137a048bcbace27141edb4257d22283cb6a281f2e05eb108b250ba7022e2a100f637143f19328d227cb9c328cf2dde83e1d9012066b00d1c6f79c12d66f4ed1fd7d03742c72d7f02ccd2f4c6aab3702870bc61d100fb6ddf56f7454ea258affa52edfccbe373df95315f57a7e001556f36d721821ff25b3d79d54da9e307544c01232ccca053494ab2aeb91c0a33636362646b921fd5afced43805cf07a05d0fd287e096e237387ca84371561dcf4f5dd7428d3de1077f9142dc086dd0dd902c21688da169004ed87404b1362c7d54136729f53d95f8746a0ffb70afcc3c931e8fe463a5628ecf7df4d2fe256511019420432f4b3c08596522c9d00bf58c819aac17ed0cb096ba2813a5d1020bd3370c0864cb81bfb59cb9949d9ba78ee142cadb3db0a4af5f77754ca97bbb868e0718fbeec0ac4d6e0e74cfc632b6f7270e150dfe3230dcb86d015da1bd216d7fda87b5c580490079834c33c99f55a873ce440f38477548bbe8b5804e3c57a06df8db4b1d06c9b7bda9c2b155fbea433641e082a1956f3f0b5c8b573554e0564b8d17d49e788a4051edc424bbd56e03dc88efe41e3f81e8d9b54f727323e54e2146ec33be026beec4df2570f784cd974e7c94d16cfcc6cab12128d513bfa0218e93ec0f1edbcc3b9f4261dbc75fdf7ec37385bf09873a122dff356cd67927eaa455e2ff9b89d7b92cf561a0ab345ea779f6cce661d6df41ddd3e5f09670162d00e8893e5c8c17245aaed8bbd773e03b87571597eeba6a128cd079d5d250b3ec438b4220d22aad4685d0667bd1083e4a800d88b486c5d4835374a40ac3175176fdf0c3e6f271cf48f2e35e2639b7ce08e2c8ed01ba504cf6e2eac53ae8ee1d77d1b085e7912a27d4f9c49a053abf5f39416eee135f5d1ffc45df267c757eca1821b922ba84c1fb1f4d27cb041962bbd5436a65e80be13fb8bf53ba9718817f217305f9ab46f0407d55b80c47b7c2c53efd1c99da308ae5dece591184c79e65cfedbeb36bf2ee1cb826ee9afe23bda3a875da94103beb7b2085e9f50f95e46912e227d5ea2b9ca710c2fbd36e72a581c748b32769e0326b0ef2a99da51102512df6d6cd0e739eb7e6c16e16c2f90340f4bd2d09f2cbfdf618733322dd6c0e9f5e909abf3f8c2c4f6287f7e07446821cef80621b2683778c3b1603c53979f66d504c142dcce3d101dcddb8966ddbcf0cddf8989cdbd4fe2265031bf703f83cc2a13feed051cd3b0f01929b7f63d58f7dffba9b8bc39836da874c6f104481f645ee415a6adcd30caa8e0bbaafecae2c75f22736c621edb49db48d4e846dc23ad03bb0cb202a6855e1b83c0c8784376e2af3f0b81531f2bc38fc650b395b840f623336d867b7e1fa41a288910b6780b1e19b10ce405400622e2714b145cf530413ee358dae3388c62bcd0e490eb0e503e7469bd20bf42aac8481c6126d479157f3a20e35e7e66b4c2130ee1719942ade9aa0aa8aa73a0b3a696808e94429829a25cf87aa3c28ce9839955ad40eea3c4b8d63d2165ac9c7c73e7d62bc63b6ee6d6dc1456262b7af5b31b93078a3706dd89de64619fb8fa2c313deb0c3a92cdef2fd0dc581d6f868eb237c13dbd6ce77d8784af95585be0c374e9cd10b7051b4887bc08bfcbc5eed457c6058b2eae24dc041c5fbca0ff0a1a890fe02afc47203ffa273e2eb1cb993bcfc8f98eb75be249042b2039eccdb7ab44bc4a301466f7255e5fba3769fa65c1a9032c00011731ae348a3a124ebc71401f68782ae0d81e54aca02553388c515fc827b4ee0b55e320ed956599a75ba15c77fea21c9e1263164245a4b947d52e46a29da3ad25925095796f0bfa7101870512bef8aff9be0338fae875e5df69a2928f28f57a2e867e626429baa1cba781349b9be7e4fe4a3cea65e708aa80185656fd80178352bd55b6f34b5756dcc42e91b6a2462ce1db473bf0594bc14286f2d5aa9d44dc685a2301ee6ba3acf73a2f65e0396af36b843dc173708e4b89512eb5c9ad593b180b6d4d178fb23a62340d67a8192631dec64d8ba118eda2897f3c2a3846db6991da04210dc9a0b7fc6f1b7b62100ab8fef6dfae73282a1d4ef9a168ab6de6022641bfeef549f972f3938dc37a2dca1d144926a5fd28afe0c00bfd3bf900141319abbad5b3df2391b557579b3b00fcad34d7799024a89217ac5dd0ff780bbf6a84d18955b58151260c66f0e1d678ee5732dde346b8accc9265ef112b2f4b38195671c92152abf559fb2f6fd575007409d723b6bfa1477285850423f3e17c8088c00c9a6b5ecfa42959d2b32eaf19e13e67dbc2d4e1242eb5c53378f0b4b583c7c6347930d60b01f644e34a997c3b2be92ef083c55ee6d6577f7423b2ff35e6abe20f58f6a7a0a1f3f815dda2ad9fc92f7676e244192bd5e855dd29b0833b10a068e5a3c76a158a7d5b73ab6d682343060c5fb923f1da21ce2782edcda3235db815e664673312bd72793fcd2652687ead17418a47ab0df9c538d267d5897fa8f8cb39153ac25cd550dfca26763bd93b105a49eba4fce1fdd56d5e931764348fa3f927208dbb54d28ee5540925bbb23bd3d17c06d7a57fc8bb206238a9f4f288ef6e747c27d0f2cf1b4ee72f2093976628e164c665d1880f2dd64c8f27fd39ee7f6fca44a45506e129d13650abe293891eab3322ecb10378fbfe882965cc52b716d0b8613c33fd1e9fb75c488bafbd558d85c96d64195be0e15ff775d9b261b54a7fad62e7ef098891fef0a8bf4ee71ae4e61ef9ceeda04b320c5e7ccb22b5232bdccc3de58f7072b2ac847ee052c967f28bb0119420b5e6cd044e59460abd0fab602f61a78fa587190856e8ce071e26c94c53b7d7e7b16e46d3a7e586c3aba396a8748e91c76d485bf9464a1feebfa187bf18c4c643a00f6ec01bf46ecd1732ccea6e7af97eada9fa3478c9f5376eed8e9ac8d5a3a5e562118886cca48391b46215816b0c11aef2cc5eae25a2c7cf1f9d38952a794070e38f274c131820a7ba8fd4ac4a7a34f519c4852dd7ba38e9e72356e95a694cf72e8d87b235d8b7920e0de02488e86e12398552ff79ffeebab9e9e4b3ff19e9008f747ec87777c6e7c6bc0f4efac0100ea5ec00cfccfada367b8c6e266d043f619f1d9622e49a3bcf7feae1807a588e81c9a504cf7d2bd503f39af7af912f09be2647f6257533a5e6812e36f4e0e7af32ac2bb05ee7d58126a63eabe3f4c08e65fcf69d2c09e803fdba08d8a55a5f7889a5566ca14a83269ccb1a1d9ac8a7cdad459e3922f6cd5b0f601a6d52e03edbde2d6ae26b795c92101d3f2c93827cd3a06bc17d22467d28852703650f3008b66367db4145ad1f1d023ecba3afc9161a1b743b9ec683bf1270b7ead65ddfecd615c1c3595db25ee16bc804d9b051376c32ca771318453beec89dd04a876715be1f7613e180e7e19af365df89f70c3e5836cd69e78b996ef267aa286e60ebc01cb82bde5badf90b1f3d00a820c5a4cc481f3c8c288ff7ba34c8a5db46b2cac21b108b7043f6ded73db4ee1b1e146d2b6c077db82d2e35497e9c1ac44368ebd52c185ded943ea124e0fb7406f7a4690a3390140c1326289a37367115dc1edbe3da06f7fbe745db58df2ed2a027c26437ffb3bbb1a4e97c6d4859c8a7d64b804818305fe222b8135996c301ebca7ef710e4b29b31b93bb1740991cb7d6e9e4b12225ac9641865f04d8b5f5e63571cd717ba24aa3b7336dc70cab098e7402241907352777d71e8d6627ec3f876f3ab24238cd58491df4dbc8f662428a27354b9dfd5063d0eefdd1d7caacc4738a9102b0cfb2030feaabe357b734f558b60f4f32ddd5af32c181d3e612e01f4e2bd88ea2c40f047432a7eb629b2c9cce5446b4fe9b151e3b1ba004a20a41bec0cc4911c17b949ae032279df86794bb2de4f96fccb3da59cd0a7972e13f428760f88427"}, &(0x7f0000000100), 0x1400) [ 793.276929] binder: undelivered TRANSACTION_ERROR: 29201 [ 793.282551] binder: undelivered TRANSACTION_ERROR: 29201 22:55:43 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x4000000}) 22:55:43 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0xffffff8d], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) [ 793.345583] binder: 916:918 BC_FREE_BUFFER u0000000000000000 no match 22:55:43 executing program 4: r0 = socket$inet6(0xa, 0x5, 0x0) r1 = socket$inet(0x2, 0x80001, 0x84) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) r3 = dup(r0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r4 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x0, 0x0) ioctl$KVM_GET_XSAVE(r4, 0x9000aea4, &(0x7f0000000280)) ioctl(r2, 0x8912, &(0x7f0000000040)="025cc83d6d345f8f660070") r5 = socket$inet(0x10, 0x3, 0x0) sendmsg(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080), 0x1, 0x0, 0xfffffffffffffefa}, 0x0) bind$inet(r1, &(0x7f0000000180)={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000980)={'vcan0\x00', 0x0}) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000001080)=ANY=[@ANYBLOB="6e61740000000000000000000000000000000000000000000000000000000000510e0000f20acc97e0b50000000084001d0001000100000000000000003801000003000000000000002fffff132a2be0711ddb06f67d94983abbba6cd25d0d2a64c3ed97358456", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f000380100000000000000000000000000000000000000000000000028006970763668656164657200000000000000000000000000000000000000001d8000000000000048005245444952454354000000000000000000000000000000000000000000000b000000e0000001000000000000000000000000000000000000000000000000000000004e214e2100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c80010010000000000000000000000000000000000000000000000004800534e4154000000000000000000000000000000000000000000000000000100000000fe8000000000000000000000000000aa000000810000000000000000000000000067006600000000000000000000ffffe0000002fe8000000000000000000000000000aaffffffffff000000ffffffff000000ff00000000ffffffff00000000ffffffff626f6e6430000000000000000000000067726574617030000000000000004000000000000000000000ff0000000000000000000000000000000000000000000000000000000000ff000000000000000000000000000000008e00ff0572000000000000000000000000000000300158010000000000000000000000000000000000000000000000006800697072616e67650000000000000000000000000000000000000000000001fe8000000000000000000000000000bbfe8000000000000000000000000000bbffffffff000000000000000000000000ac1414bb000000000000000000000000010000000000000028004d41524b0000000000000000000000000000000000000000000000000002020000000101000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0003801000000000000000000000000000000000000000000000000280069707636686561646572000000000000000000000000000000000000000008100100000000004800534e4154000000000000000000000000000000000000000000000000000104000000e00000020000000000000000000000007f000001000000000000000000000000ff6a00650000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a800d0000000000000000000000000000000000000000000000000002800000000000000000000000000000000000000000000000000000000000000feffffff000000000232f8cbef5c279e0aed59c6219913843c5b8baba7908b90ce858e2fd4e9e542e6ee1ff47fcffc21b1bf2962455df198cf775fc08763f159f1b34675fe2c535e922e103cf0e45b51f330ea"], 0x608) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f00000009c0)={@empty, r6}, 0x14) socket$inet6(0xa, 0x2, 0x1) dup2(r0, r1) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000000680)={0x8001, {{0xa, 0x4e22, 0x1, @loopback={0x0, 0x1}, 0xffffffffffffff00}}}, 0x88) 22:55:43 executing program 6: ioctl$sock_inet_SIOCGIFDSTADDR(0xffffffffffffffff, 0x8917, &(0x7f00000000c0)={'yam0\x00', {0x2, 0x0, @multicast2=0xe0000002}}) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r0, 0x29, 0x40, &(0x7f0000000080), 0x4) set_robust_list(&(0x7f0000000140)={&(0x7f0000000040)={&(0x7f0000000000)}, 0xbfd1, &(0x7f0000000100)}, 0x18) sendto$inet6(r0, &(0x7f0000000180)="e4010682228cbbc70c6b9a3e60a057283d199f637accd2ee1bbc38cc06758263e0351f4f60efba24722a2449226f195cd1ccd828471af5516815a235e7c69291f50d85385425ef40f48eff0bcd05994fceace3a4e1065cefdd7e11cdb119069f76f880b5b3", 0x65, 0x8000, &(0x7f0000000200)={0xa, 0x4e24, 0x7f, @dev={0xfe, 0x80, [], 0xe}, 0x1}, 0x1c) 22:55:43 executing program 7: syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)) r0 = add_key(&(0x7f0000000000)='ceph\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000080)="d64015fb5451969a04d869efdcc1696e062da87fadd7c365f0e9ecc03977830de03647e0164f96a3262388406057e7052b0664811875ed309244487b771cb1520f7f724f5c6eccb1f2117c3c190de34eed9cea56482604fef0528e9cae30f85745f5620aa539966120b932cd9f51c334f73f5c2bc406768400e7f5bab9048deec50aec4bd018dbbdf7152948d8e6aef802167a134578b4c6f74d0b76171c08978ced3e1c3b85", 0xa6, 0xffffffffffffffff) keyctl$restrict_keyring(0x1d, r0, &(0x7f0000000140)='blacklist\x00', &(0x7f0000000180)='(*\x00') [ 793.411203] binder: 916:918 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 793.418179] binder: 916:918 got reply transaction with no transaction stack [ 793.425380] binder: 916:918 transaction failed 29201/-71, size 0-8 line 2759 22:55:43 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(0xffffffffffffffff, 0x0) read(r1, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(r0, 0x540e, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000016) 22:55:43 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0xffffffffffffffff) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) sendto$inet6(0xffffffffffffffff, &(0x7f0000000040), 0x113, 0x20000004, &(0x7f000031e000)={0xa, 0x4e22}, 0x1c) 22:55:43 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0xe0000000}) 22:55:43 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0xfffffff5], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:55:43 executing program 7: syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x1, 0x0, [0x0, 0x0, 0x2, 0x3]}) 22:55:43 executing program 6: setrlimit(0x7, &(0x7f0000000040)={0x0, 0x8000}) r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000080)={0x65}, 0x8, 0x806) prctl$setfpexc(0xc, 0x100000) signalfd(r0, &(0x7f00000000c0)={0x7}, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x1, 0x2, 0x3ff, 0x1, 0x0, 0x1}, 0x2c) [ 793.597056] binder: 916:949 BC_FREE_BUFFER u0000000000000000 no match [ 793.718843] binder: 916:949 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 793.725789] binder: 916:949 got reply transaction with no transaction stack [ 793.733012] binder: 916:949 transaction failed 29201/-71, size 0-8 line 2759 22:55:44 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600000000000000, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) 22:55:44 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(0xffffffffffffffff, 0x0) read(r1, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(r0, 0x540e, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000016) 22:55:44 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008914, &(0x7f0000000040)="295ee1311f16f477671070") r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/mixer\x00', 0x0, 0x0) clone(0x0, &(0x7f0000000080), &(0x7f00000000c0), &(0x7f0000000000), &(0x7f0000000180)="15680224df43b45582708a16c5f916f8b16eccdc9f31d85dab68208da0f3dc8f0a09078a62161eede55c9e3da0ff1ba30670d48aa4e9f73635545f5c0d7aa21365a3601c1cfac37d928e160530b824457dd427db21af92b3a0b0d39518693129bdc40e1d5fcdb309d65c04212b390a0eccda7858adea6a5a5a2bc2c8bd8f6da0f5c28e941fc36842ba6da373f5d9f941a5b6a79df1b4cc55bd555020b0f846c4106107b9e40e4706") ioctl$RNDGETENTCNT(r1, 0x80045200, &(0x7f0000000140)) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000240)={0x12000, &(0x7f0000000100), 0x4, r1, 0x1}) 22:55:44 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x3b000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:55:44 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x5, &(0x7f0000000100)="0047dc2f07fd923fa9e800") r2 = semget(0x0, 0x0, 0x20) r3 = geteuid() getresgid(&(0x7f00000000c0), &(0x7f0000000500), &(0x7f0000000540)=0x0) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000000280)={{{@in=@rand_addr, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in=@rand_addr}}, &(0x7f0000000200)=0xe8) fstat(r0, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) semctl$IPC_SET(r2, 0x0, 0x1, &(0x7f0000000400)={{0x9, r3, r4, r5, r6, 0x2}, 0x80000001, 0x5, 0x4000400}) r7 = syz_open_dev$tun(&(0x7f0000008940)='/dev/net/tun\x00', 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000080)=[@text16={0x10, &(0x7f0000000000)="0f09650f01bfa6c30f070f01d10f20c06635000000400f22c00f20c06635020000000f22c0baf80c66b8e817458166efbafc0c66ed6766c7442400f2ffffff6766c7442402fd26b3e46766c744240600000000670f011424baf80c66b86e02978e66efbafc0cb80900efba4300b80900ef", 0x71}], 0x1, 0x0, &(0x7f00000000c0), 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000040)={"79616d300001178b00", 0x4012}) ioctl$TUNSETTXFILTER(r7, 0x400454d1, &(0x7f0000000000)={0x0, 0x2aaaaaaaaaaaab8b, [@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}]}) 22:55:44 executing program 7: syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)) modify_ldt$read_default(0x2, &(0x7f0000000000)=""/226, 0xe2) 22:55:44 executing program 6: r0 = socket$inet6(0xa, 0x80003, 0xff) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x80000, 0x0) setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, &(0x7f0000000080), 0x4) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000040)={0xffffffff}, 0x111, 0x100f}}, 0x20) write$RDMA_USER_CM_CMD_CONNECT(r1, &(0x7f0000000200)={0x6, 0x118, 0xfa00, {{0x0, 0x9, "1cf43e796e96e1522a10252a213b08e6a9114626a3d9526251b284ae5869a2ba8440639c0db175beb04273f0c8799847047e1392cd5e9a814acedb8e56a7c6987663b27e32ecaa5016b93cd7cfe5678a5cbfb612ecb94bc1f6fef8a428934f0a3574ac7ba6689b36ea1b4a3936809611d0e7940b3a0aa3e7e1a4a9f8fc09b4f454b6454366baa3ce93c06f1a8e79138a50a142a287d9a5a9de87b98d862ed220dbe016f3a862ec7d977ac92f18de04191c5e48cdd4fdb50aa03ef7d5539dca0f9a04712d1d9e62b220d56d6f9b9486008956e1fd9b1cfce8df77bef3e32168638f6aba33075c3d603dc1172bde01079ef5e4f8506ef63d29f7c37b1afe1d939c", 0x6f, 0x10001, 0x3f, 0x1c0000, 0x1, 0x0, 0xaf}, r2}}, 0x120) 22:55:44 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x3}) [ 793.814489] binder: undelivered TRANSACTION_ERROR: 29201 [ 793.820117] binder: undelivered TRANSACTION_ERROR: 29201 22:55:44 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(0xffffffffffffffff, 0x0) read(r1, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(r0, 0x540e, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000016) 22:55:44 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x3b00], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) [ 793.899299] binder: 988:989 BC_FREE_BUFFER u0000000000000000 no match 22:55:44 executing program 7: syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)=ANY=[@ANYBLOB="0180c2000000aaeaaaaaaa00080045000030000000000067907800000000ffffffff2100907800000000450000030000000000190000ac14ffbbe0000001"], &(0x7f0000ea3000)) pipe(&(0x7f0000000000)) 22:55:44 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x30}) 22:55:44 executing program 6: r0 = socket$kcm(0x29, 0x1000000000000005, 0x0) io_submit(0x0, 0x1, &(0x7f0000001dc0)=[&(0x7f00000014c0)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000001440), 0x0, 0xfffffffffffffffd}]) r1 = socket$inet_tcp(0x2, 0x1, 0x0) io_setup(0x2, &(0x7f0000000080)=0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0xbd, &(0x7f00000014c0)}, &(0x7f0000000100)=0x10) r3 = syz_open_dev$audion(&(0x7f0000000200)='/dev/audio#\x00', 0x9, 0x802) ioctl$EVIOCGABS20(r3, 0x80184560, &(0x7f0000000240)=""/195) r4 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0xc0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r4, 0xc02c5341, &(0x7f0000000140)) exit_group(0x8000) linkat(r4, &(0x7f0000000040)='./file0\x00', r4, &(0x7f00000001c0)='./file0\x00', 0x1400) io_submit(r2, 0x12f, &(0x7f00000000c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000001000)}]) [ 793.943192] binder: 988:989 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 793.950266] binder: 988:989 got reply transaction with no transaction stack [ 793.957424] binder: 988:989 transaction failed 29201/-71, size 0-8 line 2759 22:55:44 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) r1 = openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0xc0, 0x100) ioctl$KVM_GET_VCPU_EVENTS(r1, 0x8040ae9f, &(0x7f0000000080)) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, &(0x7f00000000c0)={0x0}, &(0x7f0000000140)=0x8) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x1f, &(0x7f00000001c0)={r2, @in={{0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x11}}}, 0xc70f, 0xcbb}, &(0x7f0000000280)=0x90) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r3 = socket$inet6(0xa, 0x3, 0x20000000021) readv(r0, &(0x7f0000000640)=[{&(0x7f00000002c0)=""/221, 0xdd}, {&(0x7f00000003c0)=""/139, 0x8b}, {&(0x7f0000000480)=""/54, 0x36}, {&(0x7f00000004c0)=""/34, 0x22}, {&(0x7f0000000500)=""/223, 0xdf}, {&(0x7f0000000600)=""/64, 0x40}], 0x6) connect$inet6(r3, &(0x7f0000000040)={0xa, 0x0, 0x0, @local={0xfe, 0x80, [], 0xaa}, 0x9}, 0x1c) sendto$inet6(r3, &(0x7f0000000000), 0xfedf, 0x0, &(0x7f0000000180)={0xa, 0x0, 0x0, @local={0xfe, 0x80, [], 0xaa}}, 0x1a) 22:55:44 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x44], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:55:44 executing program 0: getgroups(0xa, &(0x7f0000000040)=[0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0]) getgroups(0x5, &(0x7f0000000140)=[0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0]) getresgid(&(0x7f0000000180), &(0x7f00000001c0)=0x0, &(0x7f0000000200)) stat(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r6 = getegid() fstat(0xffffffffffffff9c, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getgroups(0x6, &(0x7f0000000380)=[r1, r2, r3, r5, r6, r7]) perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) move_pages(0x0, 0x1, &(0x7f0000000100)=[&(0x7f0000ffa000/0x4000)=nil], 0x0, &(0x7f0000000140), 0x0) r8 = syz_open_dev$admmidi(&(0x7f00000003c0)='/dev/admmidi#\x00', 0x0, 0x40) fchownat(r8, &(0x7f0000000400)='./file0\x00', r4, r0, 0x400) [ 794.132651] binder: 988:1010 BC_FREE_BUFFER u0000000000000000 no match [ 794.174271] binder: 988:1010 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 794.181305] binder: 988:1010 got reply transaction with no transaction stack [ 794.188680] binder: 988:1010 transaction failed 29201/-71, size 0-8 line 2759 22:55:44 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) 22:55:44 executing program 6: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer\x00', 0x20000, 0x0) ioctl$KVM_GET_REG_LIST(r0, 0xc008aeb0, &(0x7f0000000100)={0x237c, [0x2, 0x2, 0xffffffffffffffff]}) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ppp\x00', 0x101005, 0x0) close(r0) ioctl$EVIOCGPROP(r1, 0xc004743e, &(0x7f00000001c0)=""/246) setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, &(0x7f0000000000)={0x3e, @multicast1=0xe0000001, 0x4e20, 0x1, 'wlc\x00', 0x0, 0x1, 0x51}, 0x2c) epoll_ctl$EPOLL_CTL_DEL(r0, 0x2, r0) pwritev(r1, &(0x7f0000f65000)=[{}], 0x1, 0x800000000000000) fcntl$setflags(r0, 0x2, 0x1) 22:55:44 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) read(0xffffffffffffffff, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(r0, 0x540e, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000016) 22:55:44 executing program 7: 22:55:44 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0xffffffffffffffff}) 22:55:44 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x6], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:55:44 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket(0xa, 0x3, 0x19) setsockopt$inet6_opts(r0, 0x29, 0x39, &(0x7f0000000080)=@srh={0x3b, 0x4, 0x4, 0x2, 0x2, 0x9000000, 0x7, [@local={0xfe, 0x80, [], 0xaa}, @remote={0xfe, 0x80, [], 0xbb}]}, 0x28) ioctl$sock_inet_sctp_SIOCINQ(r0, 0x8982, &(0x7f0000000240)) ioctl$sock_netdev_private(r0, 0x89f4, &(0x7f0000000040)="585502526b91ee0e3061a9e8ec910c8980316a96b2b7cca8e5fa0cef87ab90e5b14ea5cf08664c0f2a5c6a482ee6d6c33dbbe3d41fb5f7577b2598ac8d") 22:55:44 executing program 4: r0 = socket(0x11, 0x2, 0x0) r1 = syz_open_dev$tun(&(0x7f0000000200)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={"6966623000faffffffffffffff00", 0x1202}) ioctl$TUNSETLINK(r1, 0x400454cd, 0x339) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000080)={'ifb0\x00\x00\x00\x00\x00\x00\x00!\x00', 0xa201}) fdatasync(r2) [ 794.298322] binder: undelivered TRANSACTION_ERROR: 29201 [ 794.303989] binder: undelivered TRANSACTION_ERROR: 29201 22:55:44 executing program 7: r0 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0xffffffffffffffe1, 0x200000) r1 = getgid() ioctl$TUNSETGROUP(r0, 0x400454ce, r1) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)=ANY=[@ANYBLOB="0180c2010000aaaaaaaaaa00080045000030000000000067907800000000ffffffff2100907800000000450000030000000000000000ac14ffbbe0000001"], &(0x7f0000ea3000)) [ 794.365869] binder: 1041:1042 BC_FREE_BUFFER u0000000000000000 no match [ 794.402369] binder: 1041:1042 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 22:55:44 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x3a00000000000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:55:44 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) read(0xffffffffffffffff, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(r0, 0x540e, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000016) 22:55:44 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f000099e000)={0x2, 0x4e20, @multicast2=0xe0000002}, 0x10) sendto$inet(r0, &(0x7f0000000200), 0xfffffffffffffeb4, 0x20008005, &(0x7f0000db4ff0)={0x2, 0x4e20, @loopback=0x7f000001}, 0x10) r1 = getpgrp(0x0) sched_getattr(r1, &(0x7f0000000000), 0x30, 0x0) recvfrom(r0, &(0x7f0000f9cf9b)=""/101, 0x6478c8501c739c9d, 0x120, 0x0, 0x35) [ 794.409496] binder: 1041:1042 got reply transaction with no transaction stack [ 794.416856] binder: 1041:1042 transaction failed 29201/-71, size 0-8 line 2759 22:55:44 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x300}) 22:55:44 executing program 7: syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)) r0 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x40000) ioctl$BLKALIGNOFF(r0, 0x127a, &(0x7f0000000040)) [ 794.525555] binder: 1041:1057 BC_FREE_BUFFER u0000000000000000 no match 22:55:44 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x2900000000000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) [ 794.573093] binder: 1041:1057 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 794.580188] binder: 1041:1057 got reply transaction with no transaction stack [ 794.587563] binder: 1041:1057 transaction failed 29201/-71, size 0-8 line 2759 22:55:44 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) read(0xffffffffffffffff, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(r0, 0x540e, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000016) 22:55:44 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) [ 794.742840] binder: undelivered TRANSACTION_ERROR: 29201 [ 794.748542] binder: undelivered TRANSACTION_ERROR: 29201 [ 794.782864] binder: 1077:1078 BC_FREE_BUFFER u0000000000000000 no match [ 794.803267] binder: 1077:1078 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 794.810665] binder: 1077:1078 got reply transaction with no transaction stack [ 794.818007] binder: 1077:1078 transaction failed 29201/-71, size 0-8 line 2759 [ 794.837315] binder: 1077:1079 BC_FREE_BUFFER u0000000000000000 no match [ 794.855547] binder: 1077:1079 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 794.862634] binder: 1077:1079 got reply transaction with no transaction stack [ 794.870000] binder: 1077:1079 transaction failed 29201/-71, size 0-8 line 2759 22:55:45 executing program 6: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="0047fc2f07d82c99240970") r1 = dup(r0) setsockopt$bt_BT_POWER(r1, 0x112, 0x9, &(0x7f0000000040)=0x6, 0x1) r2 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_int(r2, 0x6, 0x19, &(0x7f0000000100), &(0x7f0000000140)=0x4) 22:55:45 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x7}) 22:55:45 executing program 7: syz_emit_ethernet(0x3e, &(0x7f0000000000)=ANY=[@ANYBLOB="0180c2000000aaaaaaaaaa00080045000030000000000067907800000000ffffffff2100907800000000450000030000000000000000ac14ffbbe0000001acdfc51812184e56e240310347f6015322ab0f68a96009925c904d542bfaeaf2f1976c04318d19b57393aec945c99a25803ffbbab3beb3e6dbcf6c228f143e8c18ef56d37943854add9688bd3925a7bff1122080266558935b54ffaf446f94cf375c23619e6757e6d27c77c38f6b62ecd1a904d67b52885f0391896166f52f5d78a0917cf2aee00f5894f03fe7bfe91094f64de6013b7beec64b02fa4d33f4a3946fac34ce972d9b32824ab4efa89f0d433c86752b6971feaa07"], &(0x7f0000ea3000)) 22:55:45 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x200000000000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:55:45 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) read(r1, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(r0, 0x540e, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000016) 22:55:45 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) 22:55:45 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000040)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r2, 0x84, 0x8, &(0x7f0000013e95), 0x4) setsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r2, 0x84, 0x6b, &(0x7f0000000180), 0x4) close(r2) close(r1) r3 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000000)='/dev/urandom\x00', 0x400000, 0x0) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r3, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8000040}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x1c, r4, 0x400, 0x70bd26, 0x25dfdbff, {0x5}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x10001}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4048000) [ 794.924758] binder: undelivered TRANSACTION_ERROR: 29201 [ 794.930353] binder: undelivered TRANSACTION_ERROR: 29201 22:55:45 executing program 7: syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)) r0 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x7, 0x2) ioctl$EVIOCGUNIQ(r0, 0x80404508, &(0x7f0000000040)=""/44) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f0000000080)={0x0, 0x401}, &(0x7f00000000c0)=0x8) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000100)={r1, @in6={{0xa, 0x4e20, 0x4, @remote={0xfe, 0x80, [], 0xbb}, 0x2}}}, &(0x7f00000001c0)=0x84) [ 794.992670] binder: 1082:1084 BC_FREE_BUFFER u0000000000000000 no match [ 795.025885] binder: 1082:1084 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 795.033088] binder: 1082:1084 got reply transaction with no transaction stack 22:55:45 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x3c], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) [ 795.040580] binder: 1082:1084 transaction failed 29201/-71, size 0-8 line 2759 22:55:45 executing program 6: r0 = creat(&(0x7f0000000000)='./file0\x00', 0x1d1) sendto$inet6(r0, &(0x7f0000000180)="7dbadc654bb8d436b5ff6d657a26fb3b09b0305ad1490f19e2a046fcdecb9a2c7485a7df9f2a5ba232f8e65d26f5885e02ba0da29dd83723881e8d0986c967693d56bd71fee2be39826bec946c9f17297021caa52f261384b017b88d0bba0ee18a5a968a17fe3e0736f446467a5e00c4e0a8ea731aa2d3a8b4778d1f32bacbb544fcb9f2cd04c89a5fc01d0f8cc6bc2227bbf288", 0x94, 0x24040840, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x151) connect$inet6(r1, &(0x7f0000000140)={0xa}, 0x1c) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f0000000240)={0x0, 0x7fffffff, 0x130}, &(0x7f0000000280)=0x8) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000300)={r2, 0x1c, &(0x7f00000002c0)=[@in6={0xa, 0x4e24, 0x9, @mcast2={0xff, 0x2, [], 0x1}, 0x5}]}, &(0x7f0000000340)=0x10) inotify_add_watch(r0, &(0x7f0000000380)='./file0\x00', 0x6000200) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x1, &(0x7f0000000100)={0x303, 0x33}, 0x3) setsockopt$sock_int(r1, 0x1, 0x7, &(0x7f0000000080), 0x4) [ 795.098197] binder: 1082:1105 BC_FREE_BUFFER u0000000000000000 no match [ 795.125570] binder: 1082:1105 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 795.132695] binder: 1082:1105 got reply transaction with no transaction stack [ 795.140159] binder: 1082:1105 transaction failed 29201/-71, size 0-8 line 2759 [ 795.229171] binder: undelivered TRANSACTION_ERROR: 29201 [ 795.234761] binder: undelivered TRANSACTION_ERROR: 29201 22:55:45 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x600}) 22:55:45 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f000099e000)={0x2, 0x4e20, @multicast2=0xe0000002}, 0x10) sendto$inet(r0, &(0x7f0000000200), 0xfffffffffffffeb4, 0x20008005, &(0x7f0000db4ff0)={0x2, 0x4e20, @loopback=0x7f000001}, 0x10) r1 = getpgrp(0x0) sched_getattr(r1, &(0x7f0000000000), 0x30, 0x0) recvfrom(r0, &(0x7f0000f9cf9b)=""/101, 0x6478c8501c739c9d, 0x120, 0x0, 0x35) 22:55:45 executing program 7: 22:55:45 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) 22:55:45 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0xffffffffffffffff], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:55:45 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x100000001, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket(0x9, 0x0, 0x1) getsockopt$bt_BT_RCVMTU(r1, 0x112, 0xd, &(0x7f0000000080)=0x1, &(0x7f0000000140)=0x2) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f00000005c0)='IPVS\x00') r3 = syz_genetlink_get_family_id$team(&(0x7f0000000400)='team\x00') getsockopt$inet6_mreq(r1, 0x29, 0x1f, &(0x7f0000000940)={@mcast1, 0x0}, &(0x7f0000000980)=0x14) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f00000009c0)={{{@in=@broadcast, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in6=@mcast2}}, &(0x7f0000000ac0)=0xe8) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000000b00)={{{@in=@local, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@broadcast}}, &(0x7f0000000c00)=0xe8) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000c40)={'team0\x00', 0x0}) accept4$packet(r1, &(0x7f0000000c80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f0000000cc0)=0x14, 0x80000) getpeername(r1, &(0x7f0000000d00)=@ll={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000d80)=0x80) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000dc0)={'vcan0\x00', 0x0}) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000e00)={0x0, @multicast2}, &(0x7f0000000e40)=0xc) accept4$packet(r0, &(0x7f00000010c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000001100)=0x14, 0x80000) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000001140)={{{@in6=@dev, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in6=@local}}, &(0x7f0000001240)=0xe8) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f00000012c0)={0x0, @broadcast}, &(0x7f0000001300)=0xc) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001380)={'tunl0\x00', 0x0}) getpeername$packet(r1, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, &(0x7f0000001400)=0x14) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000001440)={{{@in=@local, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in6=@dev}}, &(0x7f0000001540)=0xe8) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f0000001b40)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000001b00)={&(0x7f0000001b80)=ANY=[@ANYBLOB="70050000", @ANYRES16=r3, @ANYBLOB="000028bd7000ffdbdf250100000008000100", @ANYRES32=r4, @ANYBLOB="2802020038000100240001006d636173745f72656a6f696e5f636f756e740000000000000000000000000000080003000300000008000400fcffffff40000100240001006c625f706f72745f737461747300000000000000000000000000000000000000080003000b00000008000400f8ffffff08000600", @ANYRES32=r5, @ANYBLOB="380001746966795f70656f72735f696e74657276616c0000000000000000000000080003000300000008000400f8ffffff3c00010024000100757365725f6c696e6b7570000000000000000000000000000000000000000000080003000600000004000400080006000000000021134fc850bc1f00000042c01e8bddaf1985571eeddeb57fc65607a86a9fa16d6296684f65dd722c63b9145db10000000098209258622f4402daf1128ba9cfe2b9df016c6e808f52ed7a56404eb7f98901a45ae61758f4dca8c346e94d4398158cbcedaec2437e000000", @ANYRES32=r6, @ANYBLOB="4c000100240001006c625f74785f6d6574686f64000000000000000000000000000000000000000008000300050000001c000400686173685f746f5f706f72745f6d617070696e670000000038000100240001006e6f746966795f70656572735f636f756e74000000000000000000000000000008000300030000000800040016a0000040000100240001007072696f72697479000000000000000000000000000000000000000000000000080003000e000000080004000700000008000600", @ANYRES32=r7, @ANYBLOB="38000100240001006c625f73746174735f726566726573685f696e74657276616c00000000000000080003000300000008000400200000003c00010024000100757365725f6c696e6b75705f656e61626c65640000000000000000000000000008000300060000000400040008000600", @ANYRES32=r8, @ANYBLOB="08000100", @ANYRES32=r9, @ANYBLOB="7c0002003c000100240001006d6f64650000000000000000000000000000000000000000000000000000000008000300050000000c00040072616e646f6d00003c00010024000100656e61626c65640000000000000000000000000000000000000000000000000008000300060000000400040008000600", @ANYRES32=r10, @ANYBLOB="08000100", @ANYRES32=r11, @ANYBLOB="7c00020038000100240001006d636173745f72656a6f696e5f696e74657276616c00000000000000000000000800030003000000080004000100000040000100240001006c625f686173685f737461747300000000000000000000000000000000000000080003000b0000000800040000800000080007000000000008000100", @ANYRES32=r12, @ANYBLOB="500002004c000100240001006c625f74785f6d6574686f64000000000000000000000000000000000000000008000300050000001c000400686173685f746f5f706f72745f6d617070696e670000000008000100", @ANYRES32=r13, @ANYBLOB="800102004c000100240001006c625f74785f6d6574686f64000000000000000000000000000000000000000008000300050000001c000400686173685f746f5f706f72745f6d617070696e670000000038000100240001006c625f73746174735f726566726573685f696e74657276616c000000000000000800030003000000080004000100010040000100240001007072696f72697479000000000000000000000000000000000000000000000000080003000e000000080004009f20ffff08000600", @ANYRES32=r14, @ANYBLOB="40000100240001007072696f72697479000000000000000000000000000000000000000000000000080003000e000000080004000700000008000600", @ANYRES32=r15, @ANYBLOB="40000100240001006c625f686173685f737461747300000000000000000000000000000000000000080003000b000000080004000000008008000700000000003800010024000100616374697665706f727400000000000000000000000000000000000000000000080003000300000008000400", @ANYRES32=r16, @ANYBLOB="08000100", @ANYRES32=r17, @ANYBLOB="3c00020038000100240001006e6f746966795f70656572735f636f756e74000000000000000000000000000008000300030000000800040097750000"], 0x570}, 0x1, 0x0, 0x0, 0x44040}, 0x240040d0) sendmsg$IPVS_CMD_NEW_SERVICE(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000000c0)={&(0x7f0000000280)={0x78, r2, 0x400, 0x70bd2d, 0x25dfdbfc, {0x1}, [@IPVS_CMD_ATTR_SERVICE={0x1c, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0x5e}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x2}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x7edd0a1c}]}, @IPVS_CMD_ATTR_DEST={0x48, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x906}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xba}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@loopback=0x7f000001}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x2}]}]}, 0x78}, 0x1, 0x0, 0x0, 0x4804}, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r18 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f00000003c0)={0x73, 0x79, 0x7a}, 0x0, 0x0, 0xfffffffffffffffd) keyctl$restrict_keyring(0x1d, r18, &(0x7f0000000300)='asymmetric\x00', &(0x7f0000000340)='-cpuset\x00') [ 795.497562] binder: 1118:1119 BC_FREE_BUFFER u0000000000000000 no match [ 795.534252] binder: 1118:1119 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 22:55:45 executing program 7: syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)=ANY=[@ANYBLOB="f77fc2000000000067907800000000ffffffff210090a2fff100ff03000041876a321600000000ac14ffbbe0000001"], &(0x7f0000ea3000)) mlock(&(0x7f0000ff9000/0x4000)=nil, 0x4000) socket$inet_udp(0x2, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) clock_gettime(0x0, &(0x7f0000001440)={0x0, 0x0}) recvmmsg(r0, &(0x7f00000013c0)=[{{&(0x7f0000000000)=@ipx, 0x80, &(0x7f0000001080)=[{&(0x7f0000000080)=""/4096, 0x1000}], 0x1, &(0x7f00000010c0)=""/120, 0x78, 0x8}, 0x1}, {{&(0x7f0000001140)=@pppol2tpv3in6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000001300)=[{&(0x7f00000011c0)=""/13, 0xd}, {&(0x7f0000001200)=""/238, 0xee}], 0x2, &(0x7f0000001340)=""/105, 0x69, 0x924}, 0x1}], 0x2, 0x2000, &(0x7f0000001480)={r1, r2+10000000}) bind$bt_rfcomm(r3, &(0x7f0000001980)={0x1f, {0x5, 0x7, 0x5, 0x0, 0xaf80000000, 0x1}, 0x8}, 0xa) execveat(r3, &(0x7f00000014c0)='./file0\x00', &(0x7f0000001680)=[&(0x7f0000001500)='$\x00', &(0x7f0000001540)='-ppp1posix_acl_access,]keyring/{vmnet0\x00', &(0x7f0000001580)='\x00', &(0x7f00000015c0)='&\x00', &(0x7f0000001600)='\x00', &(0x7f0000001640)='^keyring\x00'], &(0x7f0000001900)=[&(0x7f00000016c0)='.\x00', &(0x7f0000001700)=':GPL\x00', &(0x7f0000001740)='\x00', &(0x7f0000001780)='\x00', &(0x7f00000017c0)='ppp0&\x00', &(0x7f0000001800)='\x00', &(0x7f0000001840)='\x00', &(0x7f0000001880)='vmnet0/vmnet0\x00', &(0x7f00000018c0)='^*\x00'], 0x100) 22:55:45 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x8dffffff00000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:55:45 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x1c00}) [ 795.541404] binder: 1118:1119 got reply transaction with no transaction stack [ 795.548781] binder: 1118:1119 transaction failed 29201/-71, size 0-8 line 2759 22:55:45 executing program 6: syz_emit_ethernet(0x3e, &(0x7f0000000180)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaa0086000000b1b3d1000000000000fe80eef8000000000000f2ffffffff09000000000000000000000000000000aa00000000000890d9"], &(0x7f0000000080)) r0 = syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0x5, 0x80880) set_mempolicy(0x3, &(0x7f0000000000)=0x1f, 0x5) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={r0, 0x7, 0x1, 0xcff, &(0x7f0000000140)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x7}, 0x20) [ 795.606500] binder: 1118:1135 BC_FREE_BUFFER u0000000000000000 no match [ 795.631127] binder: 1118:1135 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 795.638286] binder: 1118:1135 got reply transaction with no transaction stack [ 795.645653] binder: 1118:1135 transaction failed 29201/-71, size 0-8 line 2759 [ 795.777093] binder: undelivered TRANSACTION_ERROR: 29201 [ 795.782679] binder: undelivered TRANSACTION_ERROR: 29201 22:55:46 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) read(r1, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(r0, 0x540e, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000016) 22:55:46 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x1000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:55:46 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x4}) 22:55:46 executing program 7: syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)) r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x4000, 0x0) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000480)={0x0}, &(0x7f00000004c0)=0xc) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000000500)={{{@in6=@mcast1, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in6=@local}}, &(0x7f0000000600)=0xe8) r3 = getgid() r4 = gettid() lstat(&(0x7f0000000640)='./file0\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f0000000700)='./file0\x00', &(0x7f0000000740)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fcntl$getownex(0xffffffffffffff9c, 0x10, &(0x7f00000007c0)={0x0, 0x0}) fstat(r0, &(0x7f0000000800)={0x0, 0x0, 0x0, 0x0, 0x0}) r9 = getegid() ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000880)=0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f00000008c0)={{{@in=@loopback, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in=@dev}}, &(0x7f00000009c0)=0xe8) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000a00)={0x0, 0x0, 0x0}, &(0x7f0000000a40)=0xc) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000a80)={0x0}, &(0x7f0000000ac0)=0xc) uselib(&(0x7f0000000d40)='./file0\x00') fstat(0xffffffffffffffff, &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f0000000dc0)='./file0\x00', &(0x7f0000000bc0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000d80)={0x4, 0x100000000, 0x7, 0x6, 0xffffffffffffff80}, 0x14) sendmsg$unix(r0, &(0x7f0000000d00)={&(0x7f0000000040)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000400)=[{&(0x7f00000000c0)="25322f9881e66e092d023f88d129f1c78647d539ed89dd4616c71850f362b771f1b57bb00634dc94f1bcaf358d8e1229148e9b6da7483c8c34cf462d23bd2c92cbf72f0cc050737c863679490cb43d07ebd15cabab0ff69b3d26404e3d20765557a62ed3f4baeb46378b3761ebfb9f51626b3aece2f5d36ebcf2ffb5217f3345bc0fc398b5729d9b1c0bf34a0db0e79d4ab272df9a443de9c79724d4196b0a6b196c57ed7cf59cf6054d8136aab7ac63636c0ae877574f2e1041", 0xba}, {&(0x7f0000000180)="d36915af7fbde4f203cd94ccfa58cf068a6db8470234bd4a15c0b09a6fbcbe08e24401f309ca8891b18f15940301f62d3d0ea3bc0fee9de67d50ea55ef9b9a821c76506efdd4", 0x46}, {&(0x7f0000000200)="cb1c8be4e220f3c3ea4485e1a5f4543e12b3de32f464bc5fa2c5d5157efca2b4a7e941f6b11b944ca91e8e935f32bdcbb95b3d404bb9edd16ac16dc1eb4ba496ba35098d05b279942389b764d771877d0dc64ce8a15994108d09f5bb41fe3ea68e3771fe00a83ed3998c8218927b947359b5326471233b2eeb57d6074510217008ed033e5d56ba68e20407bbe0f998b7e9d15b6cbd7f452b10500c4d960a8cd8d25f0611a1b7d1b2c20d5dbb6a", 0xad}, {&(0x7f00000002c0)="7147473a794c57dfe8e5bd3159b440b9096fff1106b2d79dc8771ed8f27d75dee7e36b1b0892a934fda373c9c31ad58cc501895bdf4d452b2238307f9b9ff4e1e988773490c3260bd9bfed896618cc5edc2fccde3452cff6c59e72c4692c2ec06712aa6dda7c0cf8e676d025722d2b78c65168674e72df25ad20bc817fc6940c68419e2d4a125db2040d8af0cecdde5d71fb88c958bc52d60134d0f89467afd6dd3c172b744088c281726643dd97070909647ccf79ebe1e1663a7ed07c0216382b306c7d87c518f9323651fd73ce0e2c9aa8364924202058c9bdfd81ea96e17dc8b9447a370da483", 0xe8}, {&(0x7f00000003c0)="0e96d2b3100559085d4de1a236c951e04e57f71ff2b637e7c8fa4437e2050fd33862b46298", 0x25}], 0x5, &(0x7f0000000c40)=[@cred={0x20, 0x1, 0x2, r1, r2, r3}, @cred={0x20, 0x1, 0x2, r4, r5, r6}, @cred={0x20, 0x1, 0x2, r7, r8, r9}, @cred={0x20, 0x1, 0x2, r10, r11, r12}, @cred={0x20, 0x1, 0x2, r13, r14, r15}], 0xa0, 0x40000}, 0x20000000) 22:55:46 executing program 6: r0 = socket(0x10, 0x2, 0xc) write(r0, &(0x7f0000000040)="1f0000000104ff00fd4354c007110000f39414ff7f000000010423c8ffdf003581103d98c3d995cceb4866cb20dcc82919ae92b015132eb58c199c1d88e0e765e74bcc6a79d7bf26821259e36402482e71dec4167bc26bcc73ad1621956926bcdd3a32413e39313b6ec102396ed4eb00568e0aa1ab88b4ce475c414185d33a3d25454e826215d13a2e5dc8d2bc80515e5eafc098bfa6633f661dc6e4dcac0cf5513d0381312fbfa133ca6e69851c2ba8b1f5a01725d1239e1069f543", 0x3ef) 22:55:46 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6800000000000000, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) 22:55:46 executing program 4: setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000280)=ANY=[@ANYBLOB="73656375726974790000000000000000000000e9ffffff0000000000000000000e00000004000000c0080200efebffffffff09673fa644cc9d57e89b86d523c34714ffffff28918900280300002803f936ffffffff04000000478d4534c280b684a54c92bea45cb994070a7444a23ef22e78979bc2af6edd5e14f63cb7a7b5511d6b410978e5d8fde231d45c67f5f2d42f6c4325740d87f915074093"], 0x1) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x2, 0x20000) r2 = syz_genetlink_get_family_id$fou(&(0x7f0000000180)='fou\x00') sendmsg$FOU_CMD_ADD(r1, &(0x7f0000000400)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000000340)={0x5c, r2, 0x0, 0x70bd22, 0x25dfdbfc, {0x1}, [@FOU_ATTR_PORT={0x8, 0x1, 0x4e20}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4, 0x5}, @FOU_ATTR_AF={0x8, 0x2, 0x2}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e22}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4, 0x5}, @FOU_ATTR_AF={0x8, 0x2, 0x2}, @FOU_ATTR_TYPE={0x8, 0x4, 0x3}, @FOU_ATTR_AF={0x8, 0x2, 0x2}, @FOU_ATTR_TYPE={0x8, 0x4, 0x2}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x3f}]}, 0x5c}, 0x1}, 0x0) ioctl$sock_inet_SIOCSARP(r1, 0x8955, &(0x7f0000000040)={{0x2, 0x4e20, @rand_addr=0x20}, {0x6, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff]}, 0x5c, {0x2, 0x4e23, @rand_addr=0xeca}, 'bcsf0\x00'}) sendmsg$nl_route(r0, &(0x7f0000000240)={&(0x7f00000000c0)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f00000001c0)=@setneightbl={0x1c, 0x43, 0x601, 0x0, 0x0, {}, [@NDTA_NAME={0x8, 0x1, '\x00'}]}, 0x1c}, 0x1}, 0x0) ioctl$ASHMEM_GET_PROT_MASK(r1, 0x7706, &(0x7f00000003c0)) [ 795.955568] binder: 1159:1166 BC_FREE_BUFFER u0000000000000000 no match [ 795.958730] netlink: 11 bytes leftover after parsing attributes in process `syz-executor6'. [ 796.000471] binder: 1159:1166 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 796.007568] binder: 1159:1166 got reply transaction with no transaction stack [ 796.014920] binder: 1159:1166 transaction failed 29201/-71, size 0-8 line 2759 [ 796.073538] binder: 1159:1179 BC_FREE_BUFFER u0000000000000000 no match [ 796.092436] binder: 1159:1179 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 796.099572] binder: 1159:1179 got reply transaction with no transaction stack [ 796.107020] binder: 1159:1179 transaction failed 29201/-71, size 0-8 line 2759 [ 796.124383] binder: undelivered TRANSACTION_ERROR: 29201 [ 796.130080] binder: undelivered TRANSACTION_ERROR: 29201 22:55:46 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f000099e000)={0x2, 0x4e20, @multicast2=0xe0000002}, 0x10) sendto$inet(r0, &(0x7f0000000200), 0xfffffffffffffeb4, 0x20008005, &(0x7f0000db4ff0)={0x2, 0x4e20, @loopback=0x7f000001}, 0x10) r1 = getpgrp(0x0) sched_getattr(r1, &(0x7f0000000000), 0x30, 0x0) recvfrom(r0, &(0x7f0000f9cf9b)=""/101, 0x6478c8501c739c9d, 0x120, 0x0, 0x35) 22:55:46 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x29000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:55:46 executing program 7: syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)) execve(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040), &(0x7f0000000180)=[&(0x7f0000000080)=':llo\x00', &(0x7f00000000c0)='\x00', &(0x7f0000000100)='\x00', &(0x7f0000000140)='\x00']) r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snapshot\x00', 0x42a01, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f00000001c0)={0x1, [0x0]}, &(0x7f0000000200)=0x8) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f0000000240)={0x8, 0x1, 0x0, 0xa7db, r1}, 0x10) 22:55:46 executing program 6: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc8106d345f8f760070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000080)=[@text16={0x10, &(0x7f0000000040)="0f0fe8b70f32b820018ed0ea00a012002e0f07ba610066b80000c0fe66eff30f123467660f73f30f0f01cb0f06", 0x2d}], 0x1, 0x0, &(0x7f00000000c0), 0x0) ioctl$KVM_SET_CPUID(r3, 0x4008ae89, &(0x7f0000000000)={0x1, 0x0, [{0x400000b6, 0x0, 0x7f}]}) openat$ashmem(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ashmem\x00', 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 22:55:46 executing program 4: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x5, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000001c0)="295ee1311f16f477671070") r1 = dup2(r0, r0) ioctl$ASHMEM_GET_PROT_MASK(r1, 0x7706, &(0x7f0000000000)) 22:55:46 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x8000000}) 22:55:46 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x700000000000000, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) [ 796.531558] binder: 1188:1190 BC_FREE_BUFFER u0000000000000000 no match 22:55:46 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x30000000}) 22:55:46 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x2b00], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) [ 796.579208] binder: 1188:1190 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 796.586409] binder: 1188:1190 got reply transaction with no transaction stack [ 796.593802] binder: 1188:1190 transaction failed 29201/-71, size 0-8 line 2759 [ 796.610354] binder: 1188:1198 BC_FREE_BUFFER u0000000000000000 no match [ 796.668119] binder: 1188:1198 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 796.675283] binder: 1188:1198 got reply transaction with no transaction stack [ 796.682653] binder: 1188:1198 transaction failed 29201/-71, size 0-8 line 2759 [ 796.798379] binder: undelivered TRANSACTION_ERROR: 29201 [ 796.804145] binder: undelivered TRANSACTION_ERROR: 29201 22:55:47 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) read(r1, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(r0, 0x540e, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000016) 22:55:47 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") mkdir(&(0x7f0000000180)='./file0\x00', 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x220000, 0x0) ioctl$KVM_GET_NR_MMU_PAGES(r1, 0xae45, 0x6) r2 = syz_fuse_mount(&(0x7f0000000000)='./file0\x00', 0x4002, 0x0, 0x0, 0x0, 0x0) lremovexattr(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)=@random={'user.', '$^cpuset\x00'}) chdir(&(0x7f0000000380)='./file0\x00') r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/snapshot\x00', 0x0, 0x0) clone(0x0, &(0x7f0000000700), &(0x7f0000000280), &(0x7f00000000c0), &(0x7f00000002c0)) dup3(r3, r2, 0x0) 22:55:47 executing program 7: syz_emit_ethernet(0x42, &(0x7f0000000040)={@dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x1d}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [{[], {0x8100, 0x400, 0x5}}], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000000)={0x6, 0x5, 0xffffffff}, 0xc) 22:55:47 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x2f00], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:55:47 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x700}) 22:55:47 executing program 6: perf_event_open(&(0x7f0000000140)={0x2, 0xb1, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000a40)='ns/ipc\x00') r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)="68756765746c622e324d422e75e2d8311f67dfaae3a9db2f6d23310000000000000000000000000000", 0x0, 0x0) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r0, 0x84, 0x6c, &(0x7f00000001c0)={0x0}, &(0x7f0000000200)=0x8) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000000240)={r1, 0x3, 0x6, [0x8, 0xfffffffffffffff9, 0x9, 0x6, 0x2, 0x5]}, &(0x7f0000000280)=0x14) setsockopt$bt_BT_CHANNEL_POLICY(r0, 0x112, 0xa, &(0x7f0000000080)=0x3e2a, 0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000100)='ns/ipc\x00') ioctl$TIOCSCTTY(r0, 0x540e, 0xba44) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x28) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x3, 0x0) 22:55:47 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x74000000, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) [ 796.956633] binder: 1215:1227 BC_FREE_BUFFER u0000000000000000 no match [ 796.991210] binder: 1215:1227 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 796.998587] binder: 1215:1227 got reply transaction with no transaction stack [ 797.005955] binder: 1215:1227 transaction failed 29201/-71, size 0-8 line 2759 [ 797.036542] binder: 1215:1233 BC_FREE_BUFFER u0000000000000000 no match [ 797.044878] binder: 1215:1233 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 797.052102] binder: 1215:1233 got reply transaction with no transaction stack [ 797.059468] binder: 1215:1233 transaction failed 29201/-71, size 0-8 line 2759 [ 797.103312] binder: undelivered TRANSACTION_ERROR: 29201 [ 797.108982] binder: undelivered TRANSACTION_ERROR: 29201 22:55:47 executing program 0: r0 = socket(0x1e, 0x805, 0x0) r1 = socket(0x1e, 0x805, 0x0) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000040)=@req3={0x80000000}, 0xfeda) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000040)=@req3={0x80000000, 0x0, 0x2, 0x3ff}, 0x94) setsockopt$inet6_dccp_int(r0, 0x21, 0x15, &(0x7f0000000080)=0x401, 0x4) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg(r0, &(0x7f0000030000)={&(0x7f00004f5000)=@generic={0x10000000001e, "0100000900000000000000000226cc573c080000003724c71e14dd6a739effea1b48006be61ffe0000e103000000f8000004003f010039d8f986ff01000300000004af50d50700000000000000e3ad316a1983000000001d00e0dfcb24281e27800000100076c3979ac40000bd15020078a1dfd300881a8365b1b16d7436"}, 0x80, &(0x7f0000000480), 0x0, &(0x7f00006e9c68)}, 0x0) 22:55:47 executing program 7: syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x20000, 0x0) ioctl$SNDRV_CTL_IOCTL_TLV_COMMAND(r0, 0xc008551c, &(0x7f0000000040)={0x1000, 0x4, [0xff]}) 22:55:47 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x1c000000}) 22:55:47 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x2c00], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:55:47 executing program 6: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_getres(0x0, &(0x7f0000000180)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000588ff8)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$lock(r1, 0x7, &(0x7f0000002000)={0x1}) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) ioctl$BLKPG(r3, 0x1269, &(0x7f0000000200)={0x3f, 0x8, 0xf3, &(0x7f0000000080)="7ccc6c8c7bee937ebd4d5061660c07085d801cf968e8c6f65dc6d96528f37ee402c1eeb348bb30ae77c88e8a2faa01b53dcf528416d25588efb95816a292b2d3018f60d9bf7a1faaaa5ce7e135a7c92ea2cd4396aab668dd2a9c7612df696f6497d8c3f996a944103492a180a0cbc285a702d718228cbe4fde99be39a2745fe5ec8eb1e9a6551195ff665c21719b20af5648b9d726e88ece559f2554e0a1381c976cbaef0084cb7c0814649d844fb3db69423faf681e12aed4c7b7cc82281d33b4a9e5fca7da6cdc26f0c4a6336c95beb104f74679441d9ecb6ad1ba85a312fa50569000d877d1b1324c09748ba7eb410131f6"}) fcntl$lock(r1, 0x7, &(0x7f0000010000)) r4 = dup3(r0, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r4, 0x84, 0x7c, &(0x7f0000000500)={0x0, 0x50, 0x9}, &(0x7f0000000540)=0x8) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r4, 0x84, 0x6d, &(0x7f0000000580)={0x0, 0xda, "81529516b0cf771ccb78a31f2b757c95e9b8ed2951b6a0f4e00d90ecc36478fabd1918b72ebf397cda54af6157416309bf855b8a0e2db3cb06e37d73e63c0a4c44f1ce90e1cb9cd266002802fd67cea20c9373791c3e938210bcc74f94d6102a70756dbdaf0e0c6409740bdc12a98fffd0b93fed9559318c46f19648222abef45e5b869be6b45e2d4abd46effe53f82a2e9509f7fe01d1213b588f34e0eea50d078f27c3df805df81076244b8609c67693a118525e46dc685d30ea278f3d216b86d146ce1f18292f70635bdda576d88fa8d2b23bb63767dd40a6"}, &(0x7f0000000680)=0xe2) getsockopt$inet_sctp_SCTP_CONTEXT(r2, 0x84, 0x11, &(0x7f0000000840)={0x0}, &(0x7f0000000880)=0x8) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r3, 0x84, 0x66, &(0x7f0000001a80)={0x0, 0x2}, &(0x7f0000001ac0)=0x8) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r3, 0x84, 0x13, &(0x7f0000001b00)={0x0, 0x7f}, &(0x7f0000001b40)=0x8) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(r4, 0x84, 0x1b, &(0x7f0000001b80)={0x0, 0xa8, "632717c7e24560918fb90340ba04cdf60320840fe87bf081ac6884bd3bcde48c5805300c47386b829d3097cdb7f5197467e6099919f69cebdb252c4a5a373d0ad0d12967d418a463548f058c6048bcd86a498b7581614b357d26531fd64ca1549f232740cf19af7627f8e5eb422c2ae54398c6863896d348a46b916c81649b022353d28726018c71f0efb6fe44ad993bd076852402dbddae1d20f3ee7f78782f69cf0c48753642d9"}, &(0x7f0000001c40)=0x37) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r4, 0x84, 0x22, &(0x7f0000002180)={0xa384, 0x8000, 0xfff, 0x9, 0x0}, &(0x7f00000021c0)=0x10) sendmmsg$inet_sctp(r3, &(0x7f0000002400)=[{&(0x7f0000000240)=@in={0x2, 0x4e24, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10, &(0x7f00000004c0)=[{&(0x7f0000000280)="7db55bc5384cbdeada9d53167cf3b4a03a78ceec3aed514914f4bb489b735ad40efdc1197f", 0x25}, {&(0x7f00000002c0)="974d3a8e741cc45802f735f7053c22bede48ea730ffdc4ded5abc4e193a2c32b4729ff3bd6520edc814ccc9b5241deac8bedba92d1a94682a63e883e7da6399b22a808447f73022304ad54b0fc2f14bc53a6a604d9d179f8006f6cd7e4548443558e0ff844118969ad28aa53e097a67b9aaa5da94d387856744880e3004047e95c24b6988539f8cf8bd221139a2a40c43bd9220e841e7d53a92564f91250f35ed5a64d084ba889051378d8875e2f470c272b4e50e167c10574204ab8e2852193bb16e8233c3a046dde00450da3e870fb950473983530c127", 0xd8}, {&(0x7f00000003c0)="aab23a75a9acb06c34504d5f99b5d48a4b5650c3831ffdc48f8d6266352319856939f4c65687e8c905038b8b", 0x2c}, {&(0x7f0000000400)="8413d6c0e34f6846301f3e839145e3908df61515dc595b7551f03e14298ee81336689e40adff2e3e19daa8bd8826b474e98955291b6e3b469552e41858ab0e6e7625238a006b59815653577f0d0efd31cd066291804eb42b8fa82f96bd31e71c8bb2436d67452d44bd7438ba552cf2bf1077574d20242e513202878745c44a57bfe4ad17bbc339dd93a135ea2a27b9999b4d57c81571426251f92800a8435820c8090a5188c43a99b4e63b", 0xab}], 0x4, &(0x7f00000006c0)=[@dstaddrv6={0x20, 0x84, 0x8, @local={0xfe, 0x80, [], 0xaa}}, @sndinfo={0x20, 0x84, 0x2, {0x9, 0x8204, 0x100000001, 0x1, r5}}, @dstaddrv6={0x20, 0x84, 0x8}, @sndinfo={0x20, 0x84, 0x2, {0x400, 0x8002, 0x7, 0x8, r6}}, @dstaddrv6={0x20, 0x84, 0x8, @local={0xfe, 0x80, [], 0xaa}}], 0xa0, 0x40000}, {&(0x7f0000000780)=@in6={0xa, 0x4e21, 0x238d, @dev={0xfe, 0x80, [], 0xe}, 0x8}, 0x1c, &(0x7f0000000800)=[{&(0x7f00000007c0)="8145e7ddb7725402de77977df8c062d5165709aee5003944", 0x18}], 0x1, &(0x7f00000008c0)=[@sndrcv={0x30, 0x84, 0x1, {0x3, 0x401, 0x8002, 0x100000001, 0x5, 0x3, 0x8, 0xffffffffffffff01, r7}}, @dstaddrv6={0x20, 0x84, 0x8, @mcast2={0xff, 0x2, [], 0x1}}, @prinfo={0x18, 0x84, 0x5, {0x30, 0x2}}, @prinfo={0x18, 0x84, 0x5, {0x20, 0x6}}], 0x80, 0x4}, {&(0x7f0000000940)=@in={0x2, 0x4e21, @multicast1=0xe0000001}, 0x10, &(0x7f0000001a40)=[{&(0x7f0000000980)="2405ee053ffabc17bad222", 0xb}, {&(0x7f00000009c0)="76b5aede1bf3c25b5f18c3a9817fa1ac55bd3e388dbc33", 0x17}, {&(0x7f0000000a00)="c60bd3a24833d351c404607d35ad50b721ed7b98a72df4c7c5a3a0daa40b27c01c14983f4b005a4919737bb94a3fe3c90bb1b2a6bae81bf2f9ccda3c5e", 0x3d}, {&(0x7f0000000a40)="fd08af73062a36eae9332e331f943cccc5b84d6d29c0bf321048e621575b4a7e5ae04118f209ffb4d33108d7d8145749ddbe705346cddb573befbe0a520ed2fc7e94fe04ad2e865d75c8b76e7ebaaf1d06cb1ee2d89d5b32f87fd540043dc34629662159d42ad1cde89062c999dd2eb816cafb4a2b25a40dc5298cc1dc8b8fdcf8061322b39470aae10587d4682e3aad8a2632e8cb083c935882427ed4b4b50f15895355a26a37d74fa1f01951b9b90b23782ffef6dd6fdb09454690a9b7c5295c881ac1114f21ae3fc9375b77213e437505169faab273a448be82b46e8a99b6c4c3fe002427a6feae07b238fa0b305118566437c2fe405fb6cfb55930177789a10ffab0059ee516b1fbf0cadc0d7fb6178d3d9062ab373d7a11f60db47d8c4d43e903d377f03652d3299a456833c4a7ae4508d155137485861aff28ef0244c7ad389c15c91f5d8429ee2a7442baeb12a3e7499f775d7e05a46d9bdc038185c6364cc50f8a0540af6320324084c7f6fcdb047706bb14dbea4f2d783f810c3131978e627943eb887a241c333aa6dcc5d3329d54e6899eb9b244062801727f68e361220275fdf305574e362b870ffa235504efa2eea1a924c87f9e037db30a58319719cb63c88350025019515a03bb36281d53c6329bd279390cc37ac5a1449dd4899a6ba6e180f0dc2e99d4fdeca34b73a8c224042e3cf2ed64ba2bb826004b2b0e2f1037595916b61565add04cf373d6a165b97b2fa74b3bd3ef347e8610c6bd7d2260dfd8967e88027e71744361ce446e31649c7ba4e4fd1877c975e9735a84c4c3dd481d556ebd9ff996b9722fe60dd35eea43d0b13b4f7df6c966d2bd79e81b525b4fc9ad486838d3a0bb713f4e4b7e84baefcf4a3750f84942899cce4551dd1d1c6a0fbac9af1b58055053d9550ff008e1a9471f43c469e227854979d9436730a2021410fc2f7afb75a6bc229c6fae7f05db125826fdd623762fc4d2404dbc2649761872770d58e2689d5be2c36ffb9364f6886d90152bdcda2ee692982e2f31767ac70c7d5a3e9398e3f4dbf128fabc8336af1e14495f7018a9b2a1b361fcfc17c66e6513428e55d47c71e00c6ea33d2d0714c9341ffb5bf55788121ccf5fbc26caca50558b040b4bab9fc5533cc393c20b924b3ac7478533e0ffdd1793086c3189c422a39304cab0c4801ac573db29faa0465db5258d5553c7d0eab9871dcd0ef0e2b6c8ec4b6ec1a5745273917559e2bdfb01ebc2792fe15539fe8c9134825831df059c0b79938faabd6076f496e5ef727d84404fca1b81f55398a003478c1eabc8a4a36db293566940348c7c2bb1d0195f9315a19c15d8782842e9d3bb748e8fe05208891e0864faf6bbcf1c51332c058af45cc73bd121e9a98c135bfd5e0ca7e211e7b4325f17810bab65cbcc8417ff1980bec26167950b625dbe534afd31802ab475627f8af827a3d6f6b8519eebb870932d93e092d38787ca12a3876fa1f68a65cc85384db6f813bf3b3a2225efc29d438a614f7fd0ecef3d99ddd62e3aa38b832869601c821f844b50c0562c715fc5b60f084d3082d6c4cb45d3a3ec6154f95c14ca8a3b259fba43c15becd6493d972ef29bdc7fec47b53b0ff1b4d639bb54798aee41eba424b60742fbc2991ed3d6c403b4834308781d18e43bb8742d0cc8ec41df4960d4f42439a5746132d0ef5d03f420637bfa2826b91ca8cf86019ac7a8fb4e743dd149b8768d685775645ed918a300d3609200c93c0cad396e9e3cc053a37720402275c2ff9b0363de0753c625d5509759e460fae5efcdfc6e862c0f15af38bed70d522dfecc6dd350d844d950b24c86f6babcfae323b3de9a15032be7a08675482f2e694a390e36ec662a631b7af862137c9c8babee6a6b989fb6cf1b9ec9f5e762c5c7e165949a5965e9c1a0cc87da78c535c138ac4cbd6df2e0c4d9f89d5d21adf3b7d03ae911d1f4761e2e7b10258093aeb2d712201713a1148eedb9f7a6272a8c0d0977d28476e1cb078e41d17374cca401ce9b4a68f323e2f57957077f33078992e28cc065b31473697d11cf359c27a4dfddc0c2427022b2a525f03f8e24216f7a9a4a9202b244fc9bb36a757e55920a474507c2eaafa6436376241d94620a50614031a39228e11bc000a36d92a136750d6302e390818ad0f86a9287e4edc2259487621a7ecc88e6c025b64c4e974f359416d188e262dfb997e1d9d054eaf0b177c9ff75e70ba09ff787afdb579731d8ba7da5366c4393483b4bd0ac5779948848f076baee8398b9368ddd00308bf2c5228534b092cbd98f9e37024b12d2a0680bb8f0fdeba8266273f26dd82f30a934beca73c158b2c77fdbeab3b35edc79a66ded12354607d63e58184f097677131acaa6e74d01bf196d4e2ff8a2eef69451ef518ff176d953e8990482a537010acc54d8b62facc6080ed07e479c0b5b3ce2e8a038ad998badbae198c1ccbe7b6cd7aa8a8bff693b6e987625a1ab61237949128a41c95c09827c07662ba7609cda2869467ce917c035a90801e0edce66965aafb2d763156071e7d4ec8af503df16e9deb12f31a07f674f8ebc742a8a20e008ac227f29fd46c0b9d13ae2ad31e7ebbaed847739e4854760f39bffd01c7a0cf4d75680091573975a6e109b67053bda8f6d38bd722975afa7cee6c69cd73ede20c3eff308006a0fb2df50838941cc8f9a4c2e6bcf9800ac514a1378e3215f5f127ff7d8aaadbedc2b9a56e216c6da7904525c587ecde6bda55af7e145f0d93ddbfc303b81a766a8db0d1bb7d21bb32b55899b9e4c5e69b917c291a2dfc6e5f5c19d8fc1c700a03d263c4b8e6d1d9f09eebafbc150c13a9f3ca79a8f68f4e90879e0215d10754a077527b7f715202ec77b17add5a9bd7fec78f65f6eaada68256d0bf506e19c2c339f2619d11589f60b7538707519d33813170dc42b191a244e9083294431e4e57b0203f932f37f1d2a284eb3e469d8a489232ff557760f3c384cfb1f270962c5a007619709927252f01957d939118ba0438fc400988054c8616f16cf523b3fb15b70cd84331433277472379578d56ae024a794b921d874327d06644ca452da38a0a4d9faefd07a52371990252e44ed410618766a02398f5b63c2f5c9164601659ff43338f711d0e39f606131e0cd4d81f647131066c9a4bb1c370e79998af585cb2c092f6ad2106f19b38b11511979c8201910f0ffec49974677dccc3008579879f754f7a406e00804d220c86f5ecf8fb856a51f5ae50bb47fb6cca69e4c821068857c7804a6ace4357a45c125b3a8a53a041d6db6dd70c6d8f316711d0ea581f2f4afce91ea9586fbf91b0f28ad6d527df128a4a59316f9663db38f7d40735b21908a5a9db813ea65a19277083fc9976ea9094284d7f908ad9fcc2f3d4f72fc87177b4ff69b5f6ab13f204501f3bba601ea2c41afbd34142f2094b6bf751b2a99f6e1776652c05fed6b8bdb8688d721999440d9ca0b4a87470e70102e44b8849c752912d2087569ead0fab23c40bcb10d6ddbf9d4cf50ae0463505439e1385d34d5979699a895335569657948318ba2d7164082128b316f8298ab64bbffd756f4ba6ff207c6c7c39c98d3344afeee153ed3ee363c95e01de300025b4916c5786bc5715cf17599370a08516bf3fdb53c282a161e58ca8ba2a6d20906882654e5cb774fabdbd47c7ab593eed7c2df4944bd9a8f3f3785d49dffdb1a791f9df874c7a4a920b9c5c2dd747eea89383ac05fd417f0f8047721385870969958a56bfd3795c3da580ece057de60f42491187851394dca76810bfaefb35696577e6d837a904e35e342fda5f3d7ed37920981aa54ec8eb39ed768ef8ace88ab2e4e94d7828fa2c496b3c5d3ba19ee8aa21b9e4fc136075c19326d1d6d901a04dee7bf11821dbf20e0d08f6c4213bf8c829a4c15c04c88fb96f0ddb133ab9b60acc236a2c47b1102f528dde688912bddaa8a940de6e6a25712c96212b859162ea7b4c638d09710be6480d797f7d4431e3289698bbbf7ed6d8259530b66e1882ebf6e9828168315981f0683aa45632e35a2002ee74fedb684f98246bc2f1915f1fdf1978c23c12913345178dd96f1fa48ad8ee2db0ca6cc30306c57a4194412589d5ba4b28e45090f49eb15c56b39d32bc4c004aa601540379b7c8d4a6f893572d50ee937a7ac2636d91fd97bba817449112e4385628d2a988f24b28419df00d51ba93f43b36d82389f20161f3993f5f93f1ae81bc21313cb02165440bda6dce25f994b56c148faf6c5df3918216f947a241aa22f3024d1ca1cb421c26e4b6f2b83e45ce5a52e63ff60b2f6dc87ec5943c92a44404c0878ada3b9d142577fa23ec1e612ddc53977df77aa1000cfb80449e2a38fd71fbe46ae0b598bc7de2cd986bc460f3cc9156157081bbc98620d492cb1d818b5997a9b46c0c22d8bd3d01969e5af758e22e6dce6f1560e8075bc4c6aa1dce2eb6962b48cdc9253471d9727beda19d6698763cc9b479a0fd844ae6ad19868bf67353fb6fe8bf2a530329bda4bbe2a0e6161e5100de4d3443893ae76b190d9a3251140a029af3669b9797c290632f0b5900fad2f2634eb4299dc0887a458b7af3c85326d12800133ab96430d8b7395dabb852e40c94beef6ac2f1eab01737811ac901f036187d1da28db87f5fbe881ae1cbf7e6ac51d0a6a25aa4b82f125058ea1d233e1f2d6c9a2719b108787925e01c6dfeecd0f61699d8b5c460a445a6025e413dc959101e4b77d90d9ccd331a1c501f4cedf278e8ac5cddb9db95c20f85bdf894210f847e5cce043fd6de5eee88add20ba7d906f9eb8a62d0fbdb3f479ad6c64d54dffa06378b6d99bdaf42f7815b3827a21191db42a5b2b50b55a384395925164d14ef4aaa566c9cccd1a302090c5fa5ac7c6051f9cea9350c18c4bdd014e4f287a09903b9f6341b9a064b33855c6f63a63e47b1813f0ab73b4d68525cbc246dbed6f928c8f5bddee5114f00d6a3d718e41a6fd95d6aed5797ec25b88304ad0c555ec45d9396635649170005cafb948c645ec71614d84aa5fc1071a3c1700a9ea06e9e9df9e83f4bb109e9a6449420f547c7122fce8ec158119c6a27a69c3e9f3b9df25b5ba4b22392859ed95b6f72d1ec35b604b0ce8dd3543e0fdd3d0f526d698fbebb05d24193ab93d308dee00fded4171bb3eb254dcad4127102338c6e59958114a30d10025cf3e8faa175772a5ecb4c5a9c074387eddd5cd97af4f2571c9283c72997bf87804e7719047805eb7c2bbd95ab143076412e97ee248e63a409591988822ab70cabccab72bc16b34352c0f7b5f9ebc151f9e1442419623bf39aac74076de6f2197c3228ee06b8f4326036724f99264c3fa38cfe98dbf74af6d288cdd9992d6093abfc52cfc69e9a22fe0c34acf8a11cd04bc263249b381b109f8eff522eb1ac6f0c3560407dfcc16adc9004bd52c696a8c7c5f79564990ce846c66fc8266988f3f231c8d5c7d35eee23acd05ce1c61e959dd3aabd1ff32570630704b3d4a63e860d3213c729be08073919bb60655d5f77fac3bee32cf3fb044efe0284b6db05d756424e38511fa08b5b2a8c98ad7bc2d56200398efdffb7b4f3b7dc6ba614e15123bb1177f5ca143f450f0a6b73867478621611869fc2709a0c8caf3bf27918704d208d8676d1606e4be25f12730d8c8708870bf30d93dc019832bbfeec85595a0fa8233ba5759a6395ac3d4f491299a824d2d6ad275fde0b807525bdf9f092e90c752f01a2e756efa34fe81ed368d6959fc3c010a0db", 0x1000}], 0x4, &(0x7f0000001c80)=[@sndinfo={0x20, 0x84, 0x2, {0x6, 0x8008, 0x7fff, 0xffffffff80000000, r8}}, @sndinfo={0x20, 0x84, 0x2, {0x8, 0x200, 0x80, 0x80, r9}}, @prinfo={0x18, 0x84, 0x5, {0x0, 0x6}}, @dstaddrv6={0x20, 0x84, 0x8, @ipv4={[], [0xff, 0xff], @multicast1=0xe0000001}}, @dstaddrv4={0x18, 0x84, 0x7, @broadcast=0xffffffff}, @sndrcv={0x30, 0x84, 0x1, {0x7, 0x6, 0x208, 0xffffffffffffffce, 0x0, 0xf9, 0x80000001, 0x1, r10}}, @dstaddrv6={0x20, 0x84, 0x8, @dev={0xfe, 0x80, [], 0xb}}, @dstaddrv6={0x20, 0x84, 0x8, @local={0xfe, 0x80, [], 0xaa}}, @init={0x18, 0x84, 0x0, {0x1, 0x7, 0x10000, 0xde1}}, @dstaddrv6={0x20, 0x84, 0x8, @dev={0xfe, 0x80, [], 0x19}}], 0x138, 0x4000}, {&(0x7f0000001dc0)=@in6={0xa, 0x4e24, 0x3ff, @ipv4={[], [0xff, 0xff], @multicast2=0xe0000002}, 0xff}, 0x1c, &(0x7f0000002140)=[{&(0x7f0000001e00)="adbd0b569a63353324d1bdc2cce3d9160d60841f4d72a75e3e2dee1d259398e3ae5a8e9be59066a37ee35a72e9b47e7eab2039b0f2a94f326ce681300349e3776845d612c60085e8ee5b82fc2f08238b9d96c656e7e679fc4aea9ab4f4a62ada26f074d842a7cf4c77d5127d096d3e43100355b709089f41257c8250783cea1b9d924981ee6a7a2e55316eab0a6c806f04499decf68a59fc14e5bc939c318d14d746a6a29395b80e394d1bc3c59ced4ef9a47f981e1eaf9558a544b3c744d883678e22e2051686e86a88d7c656b796fb5bd4782e59c2d8eb51a167833e8518061a705a76bcee0503c6f2bac26ee7322141caaa2104", 0xf5}, {&(0x7f0000001f00)="4476d887c6808dc12dda8ec1b2975fc1a4ef763d7fcd8c6fb38f7664b3fe52bb9081c17ce7c6794801d72151d0355da4faa3db8bd610d30978d10c9a549302785bf5adc9c25a88c668eb1da8dada61896ba70f9b2793ce38977c85c67fe795c6f62eb664a7f21a22880b6fe5367a8f4aa01412cddf148535e4dd66ab79a538aaefd087be8d6e8a1aa6c7ce3e229b9660a57232c3bbbcfada1bb36a493e9a62d16038ef4b6447f647a59b4fa4d429015b2a257bb9d537ff851c1a64a6ee5f6b000199aecf7d", 0xc5}, {&(0x7f0000002040)="1a14a2187bcc3973bdd3bd98745d623d6cd16953d04e0dea591eaef0c16d9a9e5c028dc756ddca5be52cbdd8c86910b07507bd19b4070ff7be7c89eaf495a01d0553143049229a33c69551bf4dbe085afda9d006b60187ab5d8d180b7357622bae22fd941d9b5f645bda817726ed07618b4836817c098c13933fd5db6a1b87d84852b7ae8e86ece801266edc7982d40047cd78c8f23880b6a310c5a2be83dfbec3e65488dc61e31dc9ebc8ec78308acb302fe8908e32a822ed88cd032ff272ad68e43e6c0190090cdc29d32af9a741ec09c6c7007f31cbeac8cd8bf362c6059f7142608a7d103f1f4abfbcbaeb7a6c6a81e53b62a68cbba3fea614", 0xfb}], 0x3, &(0x7f0000002200)=[@dstaddrv4={0x18, 0x84, 0x7, @broadcast=0xffffffff}, @dstaddrv6={0x20, 0x84, 0x8, @remote={0xfe, 0x80, [], 0xbb}}, @dstaddrv4={0x18, 0x84, 0x7, @loopback=0x7f000001}, @sndinfo={0x20, 0x84, 0x2, {0x0, 0x200, 0x6, 0x100000000, r11}}, @dstaddrv6={0x20, 0x84, 0x8, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}], 0x90, 0x1}, {&(0x7f00000022c0)=@in={0x2, 0x4e21, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10, &(0x7f0000002380)=[{&(0x7f0000002300)="c81e3a96721403e1de6538f2e8bb170d93c715f0d2ca0ff92709f775c2765e384fac7be8fb65721f68a5b891f738f892175a328f9ed803baf98a1c61d092e3b22d77fff5a3fa10962d", 0x49}], 0x1, &(0x7f00000023c0)=[@prinfo={0x18, 0x84, 0x5, {0x0, 0x8001}}], 0x18, 0x40}], 0x5, 0x40054) 22:55:47 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) 22:55:47 executing program 7: syz_emit_ethernet(0x9, &(0x7f00000000c0)=ANY=[@ANYBLOB="0180000000aaaaaaaaaa00000d020000c00003002f45f28eeecd31d01d9e81d52c530bb02e88c9b0ece08d13e5a8ecf199c81f035c91b4f4db82b920ee096fa2a3a4223621af197a04388e6fa792407d5a221a559300"], &(0x7f0000000040)={0x0, 0x4000000, [0x1ad2, 0x3, 0x0, 0x1000]}) r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cuse\x00', 0x12000, 0x0) syz_extract_tcp_res(&(0x7f0000000000), 0x100000001, 0x4) ioctl$EVIOCGMTSLOTS(r0, 0x8040450a, &(0x7f0000000140)=""/210) 22:55:47 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x7], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) [ 797.542011] binder: 1239:1242 BC_FREE_BUFFER u0000000000000000 no match [ 797.564892] binder: 1239:1242 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 797.572066] binder: 1239:1242 got reply transaction with no transaction stack [ 797.579441] binder: 1239:1242 transaction failed 29201/-71, size 0-8 line 2759 22:55:47 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x1c}) [ 797.622176] binder: 1239:1256 BC_FREE_BUFFER u0000000000000000 no match [ 797.660222] binder: 1239:1256 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 797.667360] binder: 1239:1256 got reply transaction with no transaction stack [ 797.674735] binder: 1239:1256 transaction failed 29201/-71, size 0-8 line 2759 [ 797.794746] binder: undelivered TRANSACTION_ERROR: 29201 [ 797.800323] binder: undelivered TRANSACTION_ERROR: 29201 22:55:48 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) read(r1, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(0xffffffffffffffff, 0x540e, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000016) 22:55:48 executing program 6: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_getres(0x0, &(0x7f0000000180)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000588ff8)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$lock(r1, 0x7, &(0x7f0000002000)={0x1}) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) ioctl$BLKPG(r3, 0x1269, &(0x7f0000000200)={0x3f, 0x8, 0xf3, &(0x7f0000000080)="7ccc6c8c7bee937ebd4d5061660c07085d801cf968e8c6f65dc6d96528f37ee402c1eeb348bb30ae77c88e8a2faa01b53dcf528416d25588efb95816a292b2d3018f60d9bf7a1faaaa5ce7e135a7c92ea2cd4396aab668dd2a9c7612df696f6497d8c3f996a944103492a180a0cbc285a702d718228cbe4fde99be39a2745fe5ec8eb1e9a6551195ff665c21719b20af5648b9d726e88ece559f2554e0a1381c976cbaef0084cb7c0814649d844fb3db69423faf681e12aed4c7b7cc82281d33b4a9e5fca7da6cdc26f0c4a6336c95beb104f74679441d9ecb6ad1ba85a312fa50569000d877d1b1324c09748ba7eb410131f6"}) fcntl$lock(r1, 0x7, &(0x7f0000010000)) r4 = dup3(r0, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r4, 0x84, 0x7c, &(0x7f0000000500)={0x0, 0x50, 0x9}, &(0x7f0000000540)=0x8) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r4, 0x84, 0x6d, &(0x7f0000000580)={0x0, 0xda, "81529516b0cf771ccb78a31f2b757c95e9b8ed2951b6a0f4e00d90ecc36478fabd1918b72ebf397cda54af6157416309bf855b8a0e2db3cb06e37d73e63c0a4c44f1ce90e1cb9cd266002802fd67cea20c9373791c3e938210bcc74f94d6102a70756dbdaf0e0c6409740bdc12a98fffd0b93fed9559318c46f19648222abef45e5b869be6b45e2d4abd46effe53f82a2e9509f7fe01d1213b588f34e0eea50d078f27c3df805df81076244b8609c67693a118525e46dc685d30ea278f3d216b86d146ce1f18292f70635bdda576d88fa8d2b23bb63767dd40a6"}, &(0x7f0000000680)=0xe2) getsockopt$inet_sctp_SCTP_CONTEXT(r2, 0x84, 0x11, &(0x7f0000000840)={0x0}, &(0x7f0000000880)=0x8) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r3, 0x84, 0x66, &(0x7f0000001a80)={0x0, 0x2}, &(0x7f0000001ac0)=0x8) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r3, 0x84, 0x13, &(0x7f0000001b00)={0x0, 0x7f}, &(0x7f0000001b40)=0x8) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(r4, 0x84, 0x1b, &(0x7f0000001b80)={0x0, 0xa8, "632717c7e24560918fb90340ba04cdf60320840fe87bf081ac6884bd3bcde48c5805300c47386b829d3097cdb7f5197467e6099919f69cebdb252c4a5a373d0ad0d12967d418a463548f058c6048bcd86a498b7581614b357d26531fd64ca1549f232740cf19af7627f8e5eb422c2ae54398c6863896d348a46b916c81649b022353d28726018c71f0efb6fe44ad993bd076852402dbddae1d20f3ee7f78782f69cf0c48753642d9"}, &(0x7f0000001c40)=0x37) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r4, 0x84, 0x22, &(0x7f0000002180)={0xa384, 0x8000, 0xfff, 0x9, 0x0}, &(0x7f00000021c0)=0x10) sendmmsg$inet_sctp(r3, &(0x7f0000002400)=[{&(0x7f0000000240)=@in={0x2, 0x4e24, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10, &(0x7f00000004c0)=[{&(0x7f0000000280)="7db55bc5384cbdeada9d53167cf3b4a03a78ceec3aed514914f4bb489b735ad40efdc1197f", 0x25}, {&(0x7f00000002c0)="974d3a8e741cc45802f735f7053c22bede48ea730ffdc4ded5abc4e193a2c32b4729ff3bd6520edc814ccc9b5241deac8bedba92d1a94682a63e883e7da6399b22a808447f73022304ad54b0fc2f14bc53a6a604d9d179f8006f6cd7e4548443558e0ff844118969ad28aa53e097a67b9aaa5da94d387856744880e3004047e95c24b6988539f8cf8bd221139a2a40c43bd9220e841e7d53a92564f91250f35ed5a64d084ba889051378d8875e2f470c272b4e50e167c10574204ab8e2852193bb16e8233c3a046dde00450da3e870fb950473983530c127", 0xd8}, {&(0x7f00000003c0)="aab23a75a9acb06c34504d5f99b5d48a4b5650c3831ffdc48f8d6266352319856939f4c65687e8c905038b8b", 0x2c}, {&(0x7f0000000400)="8413d6c0e34f6846301f3e839145e3908df61515dc595b7551f03e14298ee81336689e40adff2e3e19daa8bd8826b474e98955291b6e3b469552e41858ab0e6e7625238a006b59815653577f0d0efd31cd066291804eb42b8fa82f96bd31e71c8bb2436d67452d44bd7438ba552cf2bf1077574d20242e513202878745c44a57bfe4ad17bbc339dd93a135ea2a27b9999b4d57c81571426251f92800a8435820c8090a5188c43a99b4e63b", 0xab}], 0x4, &(0x7f00000006c0)=[@dstaddrv6={0x20, 0x84, 0x8, @local={0xfe, 0x80, [], 0xaa}}, @sndinfo={0x20, 0x84, 0x2, {0x9, 0x8204, 0x100000001, 0x1, r5}}, @dstaddrv6={0x20, 0x84, 0x8}, @sndinfo={0x20, 0x84, 0x2, {0x400, 0x8002, 0x7, 0x8, r6}}, @dstaddrv6={0x20, 0x84, 0x8, @local={0xfe, 0x80, [], 0xaa}}], 0xa0, 0x40000}, {&(0x7f0000000780)=@in6={0xa, 0x4e21, 0x238d, @dev={0xfe, 0x80, [], 0xe}, 0x8}, 0x1c, &(0x7f0000000800)=[{&(0x7f00000007c0)="8145e7ddb7725402de77977df8c062d5165709aee5003944", 0x18}], 0x1, &(0x7f00000008c0)=[@sndrcv={0x30, 0x84, 0x1, {0x3, 0x401, 0x8002, 0x100000001, 0x5, 0x3, 0x8, 0xffffffffffffff01, r7}}, @dstaddrv6={0x20, 0x84, 0x8, @mcast2={0xff, 0x2, [], 0x1}}, @prinfo={0x18, 0x84, 0x5, {0x30, 0x2}}, @prinfo={0x18, 0x84, 0x5, {0x20, 0x6}}], 0x80, 0x4}, {&(0x7f0000000940)=@in={0x2, 0x4e21, @multicast1=0xe0000001}, 0x10, &(0x7f0000001a40)=[{&(0x7f0000000980)="2405ee053ffabc17bad222", 0xb}, {&(0x7f00000009c0)="76b5aede1bf3c25b5f18c3a9817fa1ac55bd3e388dbc33", 0x17}, {&(0x7f0000000a00)="c60bd3a24833d351c404607d35ad50b721ed7b98a72df4c7c5a3a0daa40b27c01c14983f4b005a4919737bb94a3fe3c90bb1b2a6bae81bf2f9ccda3c5e", 0x3d}, {&(0x7f0000000a40)="fd08af73062a36eae9332e331f943cccc5b84d6d29c0bf321048e621575b4a7e5ae04118f209ffb4d33108d7d8145749ddbe705346cddb573befbe0a520ed2fc7e94fe04ad2e865d75c8b76e7ebaaf1d06cb1ee2d89d5b32f87fd540043dc34629662159d42ad1cde89062c999dd2eb816cafb4a2b25a40dc5298cc1dc8b8fdcf8061322b39470aae10587d4682e3aad8a2632e8cb083c935882427ed4b4b50f15895355a26a37d74fa1f01951b9b90b23782ffef6dd6fdb09454690a9b7c5295c881ac1114f21ae3fc9375b77213e437505169faab273a448be82b46e8a99b6c4c3fe002427a6feae07b238fa0b305118566437c2fe405fb6cfb55930177789a10ffab0059ee516b1fbf0cadc0d7fb6178d3d9062ab373d7a11f60db47d8c4d43e903d377f03652d3299a456833c4a7ae4508d155137485861aff28ef0244c7ad389c15c91f5d8429ee2a7442baeb12a3e7499f775d7e05a46d9bdc038185c6364cc50f8a0540af6320324084c7f6fcdb047706bb14dbea4f2d783f810c3131978e627943eb887a241c333aa6dcc5d3329d54e6899eb9b244062801727f68e361220275fdf305574e362b870ffa235504efa2eea1a924c87f9e037db30a58319719cb63c88350025019515a03bb36281d53c6329bd279390cc37ac5a1449dd4899a6ba6e180f0dc2e99d4fdeca34b73a8c224042e3cf2ed64ba2bb826004b2b0e2f1037595916b61565add04cf373d6a165b97b2fa74b3bd3ef347e8610c6bd7d2260dfd8967e88027e71744361ce446e31649c7ba4e4fd1877c975e9735a84c4c3dd481d556ebd9ff996b9722fe60dd35eea43d0b13b4f7df6c966d2bd79e81b525b4fc9ad486838d3a0bb713f4e4b7e84baefcf4a3750f84942899cce4551dd1d1c6a0fbac9af1b58055053d9550ff008e1a9471f43c469e227854979d9436730a2021410fc2f7afb75a6bc229c6fae7f05db125826fdd623762fc4d2404dbc2649761872770d58e2689d5be2c36ffb9364f6886d90152bdcda2ee692982e2f31767ac70c7d5a3e9398e3f4dbf128fabc8336af1e14495f7018a9b2a1b361fcfc17c66e6513428e55d47c71e00c6ea33d2d0714c9341ffb5bf55788121ccf5fbc26caca50558b040b4bab9fc5533cc393c20b924b3ac7478533e0ffdd1793086c3189c422a39304cab0c4801ac573db29faa0465db5258d5553c7d0eab9871dcd0ef0e2b6c8ec4b6ec1a5745273917559e2bdfb01ebc2792fe15539fe8c9134825831df059c0b79938faabd6076f496e5ef727d84404fca1b81f55398a003478c1eabc8a4a36db293566940348c7c2bb1d0195f9315a19c15d8782842e9d3bb748e8fe05208891e0864faf6bbcf1c51332c058af45cc73bd121e9a98c135bfd5e0ca7e211e7b4325f17810bab65cbcc8417ff1980bec26167950b625dbe534afd31802ab475627f8af827a3d6f6b8519eebb870932d93e092d38787ca12a3876fa1f68a65cc85384db6f813bf3b3a2225efc29d438a614f7fd0ecef3d99ddd62e3aa38b832869601c821f844b50c0562c715fc5b60f084d3082d6c4cb45d3a3ec6154f95c14ca8a3b259fba43c15becd6493d972ef29bdc7fec47b53b0ff1b4d639bb54798aee41eba424b60742fbc2991ed3d6c403b4834308781d18e43bb8742d0cc8ec41df4960d4f42439a5746132d0ef5d03f420637bfa2826b91ca8cf86019ac7a8fb4e743dd149b8768d685775645ed918a300d3609200c93c0cad396e9e3cc053a37720402275c2ff9b0363de0753c625d5509759e460fae5efcdfc6e862c0f15af38bed70d522dfecc6dd350d844d950b24c86f6babcfae323b3de9a15032be7a08675482f2e694a390e36ec662a631b7af862137c9c8babee6a6b989fb6cf1b9ec9f5e762c5c7e165949a5965e9c1a0cc87da78c535c138ac4cbd6df2e0c4d9f89d5d21adf3b7d03ae911d1f4761e2e7b10258093aeb2d712201713a1148eedb9f7a6272a8c0d0977d28476e1cb078e41d17374cca401ce9b4a68f323e2f57957077f33078992e28cc065b31473697d11cf359c27a4dfddc0c2427022b2a525f03f8e24216f7a9a4a9202b244fc9bb36a757e55920a474507c2eaafa6436376241d94620a50614031a39228e11bc000a36d92a136750d6302e390818ad0f86a9287e4edc2259487621a7ecc88e6c025b64c4e974f359416d188e262dfb997e1d9d054eaf0b177c9ff75e70ba09ff787afdb579731d8ba7da5366c4393483b4bd0ac5779948848f076baee8398b9368ddd00308bf2c5228534b092cbd98f9e37024b12d2a0680bb8f0fdeba8266273f26dd82f30a934beca73c158b2c77fdbeab3b35edc79a66ded12354607d63e58184f097677131acaa6e74d01bf196d4e2ff8a2eef69451ef518ff176d953e8990482a537010acc54d8b62facc6080ed07e479c0b5b3ce2e8a038ad998badbae198c1ccbe7b6cd7aa8a8bff693b6e987625a1ab61237949128a41c95c09827c07662ba7609cda2869467ce917c035a90801e0edce66965aafb2d763156071e7d4ec8af503df16e9deb12f31a07f674f8ebc742a8a20e008ac227f29fd46c0b9d13ae2ad31e7ebbaed847739e4854760f39bffd01c7a0cf4d75680091573975a6e109b67053bda8f6d38bd722975afa7cee6c69cd73ede20c3eff308006a0fb2df50838941cc8f9a4c2e6bcf9800ac514a1378e3215f5f127ff7d8aaadbedc2b9a56e216c6da7904525c587ecde6bda55af7e145f0d93ddbfc303b81a766a8db0d1bb7d21bb32b55899b9e4c5e69b917c291a2dfc6e5f5c19d8fc1c700a03d263c4b8e6d1d9f09eebafbc150c13a9f3ca79a8f68f4e90879e0215d10754a077527b7f715202ec77b17add5a9bd7fec78f65f6eaada68256d0bf506e19c2c339f2619d11589f60b7538707519d33813170dc42b191a244e9083294431e4e57b0203f932f37f1d2a284eb3e469d8a489232ff557760f3c384cfb1f270962c5a007619709927252f01957d939118ba0438fc400988054c8616f16cf523b3fb15b70cd84331433277472379578d56ae024a794b921d874327d06644ca452da38a0a4d9faefd07a52371990252e44ed410618766a02398f5b63c2f5c9164601659ff43338f711d0e39f606131e0cd4d81f647131066c9a4bb1c370e79998af585cb2c092f6ad2106f19b38b11511979c8201910f0ffec49974677dccc3008579879f754f7a406e00804d220c86f5ecf8fb856a51f5ae50bb47fb6cca69e4c821068857c7804a6ace4357a45c125b3a8a53a041d6db6dd70c6d8f316711d0ea581f2f4afce91ea9586fbf91b0f28ad6d527df128a4a59316f9663db38f7d40735b21908a5a9db813ea65a19277083fc9976ea9094284d7f908ad9fcc2f3d4f72fc87177b4ff69b5f6ab13f204501f3bba601ea2c41afbd34142f2094b6bf751b2a99f6e1776652c05fed6b8bdb8688d721999440d9ca0b4a87470e70102e44b8849c752912d2087569ead0fab23c40bcb10d6ddbf9d4cf50ae0463505439e1385d34d5979699a895335569657948318ba2d7164082128b316f8298ab64bbffd756f4ba6ff207c6c7c39c98d3344afeee153ed3ee363c95e01de300025b4916c5786bc5715cf17599370a08516bf3fdb53c282a161e58ca8ba2a6d20906882654e5cb774fabdbd47c7ab593eed7c2df4944bd9a8f3f3785d49dffdb1a791f9df874c7a4a920b9c5c2dd747eea89383ac05fd417f0f8047721385870969958a56bfd3795c3da580ece057de60f42491187851394dca76810bfaefb35696577e6d837a904e35e342fda5f3d7ed37920981aa54ec8eb39ed768ef8ace88ab2e4e94d7828fa2c496b3c5d3ba19ee8aa21b9e4fc136075c19326d1d6d901a04dee7bf11821dbf20e0d08f6c4213bf8c829a4c15c04c88fb96f0ddb133ab9b60acc236a2c47b1102f528dde688912bddaa8a940de6e6a25712c96212b859162ea7b4c638d09710be6480d797f7d4431e3289698bbbf7ed6d8259530b66e1882ebf6e9828168315981f0683aa45632e35a2002ee74fedb684f98246bc2f1915f1fdf1978c23c12913345178dd96f1fa48ad8ee2db0ca6cc30306c57a4194412589d5ba4b28e45090f49eb15c56b39d32bc4c004aa601540379b7c8d4a6f893572d50ee937a7ac2636d91fd97bba817449112e4385628d2a988f24b28419df00d51ba93f43b36d82389f20161f3993f5f93f1ae81bc21313cb02165440bda6dce25f994b56c148faf6c5df3918216f947a241aa22f3024d1ca1cb421c26e4b6f2b83e45ce5a52e63ff60b2f6dc87ec5943c92a44404c0878ada3b9d142577fa23ec1e612ddc53977df77aa1000cfb80449e2a38fd71fbe46ae0b598bc7de2cd986bc460f3cc9156157081bbc98620d492cb1d818b5997a9b46c0c22d8bd3d01969e5af758e22e6dce6f1560e8075bc4c6aa1dce2eb6962b48cdc9253471d9727beda19d6698763cc9b479a0fd844ae6ad19868bf67353fb6fe8bf2a530329bda4bbe2a0e6161e5100de4d3443893ae76b190d9a3251140a029af3669b9797c290632f0b5900fad2f2634eb4299dc0887a458b7af3c85326d12800133ab96430d8b7395dabb852e40c94beef6ac2f1eab01737811ac901f036187d1da28db87f5fbe881ae1cbf7e6ac51d0a6a25aa4b82f125058ea1d233e1f2d6c9a2719b108787925e01c6dfeecd0f61699d8b5c460a445a6025e413dc959101e4b77d90d9ccd331a1c501f4cedf278e8ac5cddb9db95c20f85bdf894210f847e5cce043fd6de5eee88add20ba7d906f9eb8a62d0fbdb3f479ad6c64d54dffa06378b6d99bdaf42f7815b3827a21191db42a5b2b50b55a384395925164d14ef4aaa566c9cccd1a302090c5fa5ac7c6051f9cea9350c18c4bdd014e4f287a09903b9f6341b9a064b33855c6f63a63e47b1813f0ab73b4d68525cbc246dbed6f928c8f5bddee5114f00d6a3d718e41a6fd95d6aed5797ec25b88304ad0c555ec45d9396635649170005cafb948c645ec71614d84aa5fc1071a3c1700a9ea06e9e9df9e83f4bb109e9a6449420f547c7122fce8ec158119c6a27a69c3e9f3b9df25b5ba4b22392859ed95b6f72d1ec35b604b0ce8dd3543e0fdd3d0f526d698fbebb05d24193ab93d308dee00fded4171bb3eb254dcad4127102338c6e59958114a30d10025cf3e8faa175772a5ecb4c5a9c074387eddd5cd97af4f2571c9283c72997bf87804e7719047805eb7c2bbd95ab143076412e97ee248e63a409591988822ab70cabccab72bc16b34352c0f7b5f9ebc151f9e1442419623bf39aac74076de6f2197c3228ee06b8f4326036724f99264c3fa38cfe98dbf74af6d288cdd9992d6093abfc52cfc69e9a22fe0c34acf8a11cd04bc263249b381b109f8eff522eb1ac6f0c3560407dfcc16adc9004bd52c696a8c7c5f79564990ce846c66fc8266988f3f231c8d5c7d35eee23acd05ce1c61e959dd3aabd1ff32570630704b3d4a63e860d3213c729be08073919bb60655d5f77fac3bee32cf3fb044efe0284b6db05d756424e38511fa08b5b2a8c98ad7bc2d56200398efdffb7b4f3b7dc6ba614e15123bb1177f5ca143f450f0a6b73867478621611869fc2709a0c8caf3bf27918704d208d8676d1606e4be25f12730d8c8708870bf30d93dc019832bbfeec85595a0fa8233ba5759a6395ac3d4f491299a824d2d6ad275fde0b807525bdf9f092e90c752f01a2e756efa34fe81ed368d6959fc3c010a0db", 0x1000}], 0x4, &(0x7f0000001c80)=[@sndinfo={0x20, 0x84, 0x2, {0x6, 0x8008, 0x7fff, 0xffffffff80000000, r8}}, @sndinfo={0x20, 0x84, 0x2, {0x8, 0x200, 0x80, 0x80, r9}}, @prinfo={0x18, 0x84, 0x5, {0x0, 0x6}}, @dstaddrv6={0x20, 0x84, 0x8, @ipv4={[], [0xff, 0xff], @multicast1=0xe0000001}}, @dstaddrv4={0x18, 0x84, 0x7, @broadcast=0xffffffff}, @sndrcv={0x30, 0x84, 0x1, {0x7, 0x6, 0x208, 0xffffffffffffffce, 0x0, 0xf9, 0x80000001, 0x1, r10}}, @dstaddrv6={0x20, 0x84, 0x8, @dev={0xfe, 0x80, [], 0xb}}, @dstaddrv6={0x20, 0x84, 0x8, @local={0xfe, 0x80, [], 0xaa}}, @init={0x18, 0x84, 0x0, {0x1, 0x7, 0x10000, 0xde1}}, @dstaddrv6={0x20, 0x84, 0x8, @dev={0xfe, 0x80, [], 0x19}}], 0x138, 0x4000}, {&(0x7f0000001dc0)=@in6={0xa, 0x4e24, 0x3ff, @ipv4={[], [0xff, 0xff], @multicast2=0xe0000002}, 0xff}, 0x1c, &(0x7f0000002140)=[{&(0x7f0000001e00)="adbd0b569a63353324d1bdc2cce3d9160d60841f4d72a75e3e2dee1d259398e3ae5a8e9be59066a37ee35a72e9b47e7eab2039b0f2a94f326ce681300349e3776845d612c60085e8ee5b82fc2f08238b9d96c656e7e679fc4aea9ab4f4a62ada26f074d842a7cf4c77d5127d096d3e43100355b709089f41257c8250783cea1b9d924981ee6a7a2e55316eab0a6c806f04499decf68a59fc14e5bc939c318d14d746a6a29395b80e394d1bc3c59ced4ef9a47f981e1eaf9558a544b3c744d883678e22e2051686e86a88d7c656b796fb5bd4782e59c2d8eb51a167833e8518061a705a76bcee0503c6f2bac26ee7322141caaa2104", 0xf5}, {&(0x7f0000001f00)="4476d887c6808dc12dda8ec1b2975fc1a4ef763d7fcd8c6fb38f7664b3fe52bb9081c17ce7c6794801d72151d0355da4faa3db8bd610d30978d10c9a549302785bf5adc9c25a88c668eb1da8dada61896ba70f9b2793ce38977c85c67fe795c6f62eb664a7f21a22880b6fe5367a8f4aa01412cddf148535e4dd66ab79a538aaefd087be8d6e8a1aa6c7ce3e229b9660a57232c3bbbcfada1bb36a493e9a62d16038ef4b6447f647a59b4fa4d429015b2a257bb9d537ff851c1a64a6ee5f6b000199aecf7d", 0xc5}, {&(0x7f0000002040)="1a14a2187bcc3973bdd3bd98745d623d6cd16953d04e0dea591eaef0c16d9a9e5c028dc756ddca5be52cbdd8c86910b07507bd19b4070ff7be7c89eaf495a01d0553143049229a33c69551bf4dbe085afda9d006b60187ab5d8d180b7357622bae22fd941d9b5f645bda817726ed07618b4836817c098c13933fd5db6a1b87d84852b7ae8e86ece801266edc7982d40047cd78c8f23880b6a310c5a2be83dfbec3e65488dc61e31dc9ebc8ec78308acb302fe8908e32a822ed88cd032ff272ad68e43e6c0190090cdc29d32af9a741ec09c6c7007f31cbeac8cd8bf362c6059f7142608a7d103f1f4abfbcbaeb7a6c6a81e53b62a68cbba3fea614", 0xfb}], 0x3, &(0x7f0000002200)=[@dstaddrv4={0x18, 0x84, 0x7, @broadcast=0xffffffff}, @dstaddrv6={0x20, 0x84, 0x8, @remote={0xfe, 0x80, [], 0xbb}}, @dstaddrv4={0x18, 0x84, 0x7, @loopback=0x7f000001}, @sndinfo={0x20, 0x84, 0x2, {0x0, 0x200, 0x6, 0x100000000, r11}}, @dstaddrv6={0x20, 0x84, 0x8, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}], 0x90, 0x1}, {&(0x7f00000022c0)=@in={0x2, 0x4e21, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10, &(0x7f0000002380)=[{&(0x7f0000002300)="c81e3a96721403e1de6538f2e8bb170d93c715f0d2ca0ff92709f775c2765e384fac7be8fb65721f68a5b891f738f892175a328f9ed803baf98a1c61d092e3b22d77fff5a3fa10962d", 0x49}], 0x1, &(0x7f00000023c0)=[@prinfo={0x18, 0x84, 0x5, {0x0, 0x8001}}], 0x18, 0x40}], 0x5, 0x40054) 22:55:48 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295e273b5abcf477671070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_buf(r0, 0x6, 0xe, &(0x7f0000000000)="b9d6a8b6", 0x4) getsockopt$bt_hci(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000040)=""/160, &(0x7f00000001c0)=0xa0) semget$private(0x0, 0x0, 0x0) fallocate(r0, 0x0, 0xc7, 0x80000000) 22:55:48 executing program 7: syz_emit_ethernet(0xfffffffffffffe71, &(0x7f0000000000)={@link_local={0x1, 0x80, 0xc2}, @link_local={0x1, 0x80, 0xc2}, [{[{0x9100, 0x5, 0x4, 0x4}], {0x8100, 0x3, 0x40, 0x2}}], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)) r0 = syz_open_dev$mouse(&(0x7f00000000c0)='/dev/input/mouse#\x00', 0x400, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000100)={0x10, 0x8, 0x2, 0x4, 0x1, r0, 0x9}, 0x2c) rt_sigsuspend(&(0x7f0000000080)={0x8}, 0x8) 22:55:48 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x3b], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:55:48 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x1c00000000000000}) 22:55:48 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a00000000000000, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) 22:55:48 executing program 4: r0 = socket$unix(0x1, 0x5, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f0000000040)={0x0, 0x7}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r1, 0x84, 0xa, &(0x7f00000000c0)={0x0, 0x80, 0xb, 0x6a, 0x1, 0x7ff, 0xfffffffffffffffc, 0x20, r2}, &(0x7f0000000140)=0x20) r3 = syz_open_dev$admmidi(&(0x7f0000000200)='/dev/admmidi#\x00', 0x300000000000000, 0x200) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f0000000240)={0x8, 0x7, 0x8000}, 0x4) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") poll(&(0x7f0000000280)=[{r3, 0x200}, {r3, 0x204}, {r0, 0x4000}, {r0, 0x8200}], 0x4, 0x7) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind$unix(r0, &(0x7f0000003000)=@abs={0x1}, 0x8) [ 797.962523] binder: 1285:1287 BC_FREE_BUFFER u0000000000000000 no match 22:55:48 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x3a], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:55:48 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x600000000000000}) [ 798.010495] binder: 1285:1287 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 798.017665] binder: 1285:1287 got reply transaction with no transaction stack [ 798.025042] binder: 1285:1287 transaction failed 29201/-71, size 0-8 line 2759 22:55:48 executing program 6: r0 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f00000000c0)=[@in6={0xa, 0x4e21, 0x0, @dev={0xfe, 0x80, [], 0xc}, 0x4}, @in={0x2, 0x4e21, @remote={0xac, 0x14, 0x14, 0xbb}}, @in={0x2, 0x4e20, @remote={0xac, 0x14, 0x14, 0xbb}}, @in6={0xa, 0x4e24, 0x100000001, @empty, 0x100}, @in6={0xa, 0x4e24, 0x1, @ipv4={[], [0xff, 0xff], @dev={0xac, 0x14, 0x14, 0x16}}, 0x8}, @in6={0xa, 0x4e21, 0xd15, @ipv4={[], [0xff, 0xff], @multicast1=0xe0000001}, 0x101}], 0x90) setsockopt$inet_sctp_SCTP_HMAC_IDENT(r1, 0x84, 0x16, &(0x7f0000000040)={0x6, [0x5, 0x6, 0x4, 0x101, 0x200, 0x3f]}, 0x10) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f0000001140)) 22:55:48 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x800000000000000}) 22:55:48 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x3300], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) [ 798.166754] binder: 1285:1307 BC_FREE_BUFFER u0000000000000000 no match [ 798.178134] binder: 1285:1307 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 798.185310] binder: 1285:1307 got reply transaction with no transaction stack [ 798.192672] binder: 1285:1307 transaction failed 29201/-71, size 0-8 line 2759 22:55:48 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x4], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:55:48 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x6000000}) 22:55:48 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6000, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) [ 798.334414] binder: undelivered TRANSACTION_ERROR: 29201 [ 798.340114] binder: undelivered TRANSACTION_ERROR: 29201 [ 798.388391] binder: 1321:1322 BC_FREE_BUFFER u0000000000000000 no match [ 798.402432] binder: 1321:1322 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 798.409642] binder: 1321:1322 got reply transaction with no transaction stack [ 798.416967] binder: 1321:1322 transaction failed 29201/-71, size 0-8 line 2759 [ 798.438139] binder: 1321:1325 BC_FREE_BUFFER u0000000000000000 no match [ 798.447083] binder: 1321:1325 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 798.454213] binder: 1321:1325 got reply transaction with no transaction stack [ 798.461561] binder: 1321:1325 transaction failed 29201/-71, size 0-8 line 2759 [ 798.507100] binder: undelivered TRANSACTION_ERROR: 29201 [ 798.512697] binder: undelivered TRANSACTION_ERROR: 29201 22:55:49 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) read(r1, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(0xffffffffffffffff, 0x540e, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000016) 22:55:49 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x2c], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:55:49 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x8000000}) 22:55:49 executing program 6: r0 = socket(0x11, 0x100000802, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x0, @multicast2=0xe0000002}, 0x10) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x400, 0x0) ioctl$BLKGETSIZE(r1, 0x1260, &(0x7f0000000080)) ioctl$SCSI_IOCTL_PROBE_HOST(r1, 0x5385, &(0x7f00000000c0)={0xa0, ""/160}) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x1, &(0x7f00000001c0)={0xffffffff}, 0x106, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_MIGRATE_ID(r1, &(0x7f0000000240)={0x12, 0x10, 0xfa00, {&(0x7f0000000180), r2, r1}}, 0x18) 22:55:49 executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) r1 = accept$alg(r0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00003c1000)="0a0775b0d5e383e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r0, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000000)={0xffffffff}, 0x0, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r2, &(0x7f0000000100)={0xa, 0x4, 0xfa00, {r3}}, 0xc) sendmmsg$alg(r1, &(0x7f0000004540)=[{0x0, 0x0, &(0x7f0000004480), 0x0, &(0x7f00000044c0)}], 0x1, 0x0) 22:55:49 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6800, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) 22:55:49 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000040)="2f65786500000000000035abe1e80d903e0d717ac1889a45e581c9e14a5c8f95f5d2968ae8c767e9d18fd69a") mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x800000000004, 0x20011, r0, 0x0) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00') fgetxattr(r0, &(0x7f0000000140)=@known='system.posix_acl_access\x00', &(0x7f0000000980)=""/241, 0xf1) ioctl$PPPIOCSMRU(r0, 0x40047452, &(0x7f0000000300)=0xdcb) sendmsg$IPVS_CMD_NEW_DEST(r0, &(0x7f00000002c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYRES16, @ANYRES16=r1, @ANYBLOB="010025bd7000fcdbdf250500000040000200080005000500000014000100fe8000000000000000000000000000bb080008000100000008000b000a00000008000b00c9000000080004004e0e000030000300080004000300000039b6c6e6bb3baa2e9d350a080007004e220000080007004e2100001400020073697430000000000000000000000000340002000800090002000000080002004e240000080008000000008008000b000a000000080009000700000008000b000a00000028000300140002006e723000000000000000000000000000080003000100000008000400000200002c0001001400030000000000000000000000ffffffffffff0c000700300000000100000008000100020000000800040002000000"], 0x3}, 0x1, 0x0, 0x0, 0x801}, 0x0) utimensat(r0, &(0x7f00000000c0)='./file0\x00', &(0x7f00000001c0), 0x0) clock_gettime(0x0, &(0x7f0000000180)={0x0, 0x0}) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f0000000480)={{0x5, 0x4, 0x7, 0x8001, 'syz0\x00', 0x800}, 0x1, [0x81, 0x3fa32086, 0xf9, 0x81, 0x2b01, 0x20, 0x9, 0x1, 0x7, 0x21, 0x1, 0x661, 0xffffffffffffffba, 0x0, 0x200, 0x4, 0xd878, 0x4, 0x1fc00000, 0xbc6f4, 0x2, 0x7, 0x2, 0x10001, 0x4a, 0x7ff, 0x1, 0x40, 0x3a11, 0x8, 0x2c, 0x10001, 0x2, 0x58d1, 0x400, 0x400, 0x76, 0x63, 0x5, 0x12c, 0x300, 0xa000, 0xe000000000000, 0x3ff, 0xffffffffffff0000, 0x20, 0x1, 0x8, 0x7f, 0x4, 0xff, 0xa427, 0x2, 0x9, 0xa6, 0xfff, 0x100000000, 0x1, 0x6, 0x33, 0x1, 0x2, 0x91f9, 0x8000, 0x9, 0x8, 0x8, 0x3, 0x7, 0x1000, 0x4, 0x2, 0x1f, 0x1, 0x5, 0x80000001, 0x5, 0x3, 0x101, 0x0, 0x2, 0x1ff, 0x20, 0x3410, 0x2, 0xffff, 0x800, 0x190c22ce, 0x3, 0x1, 0x40, 0x7f, 0x4, 0x39, 0x0, 0x3, 0x3306cb38, 0x7fffffff, 0x80, 0x5, 0x6, 0x6, 0x8, 0xa0, 0x8, 0x7ff, 0x5, 0x3, 0x3, 0x4, 0x7, 0x3, 0x2e7, 0x2, 0x66ef, 0x5, 0x6, 0xfffffffffffffffc, 0x5fb9, 0x7, 0x66a3, 0x5b2, 0x8, 0x3, 0x7ff, 0x3a, 0x6, 0x3], {r2, r3+10000000}}) 22:55:49 executing program 7: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000009a00)='/dev/ion\x00', 0x800, 0x0) fcntl$getownex(r0, 0x10, &(0x7f0000009a40)) openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) openat$ion(0xffffffffffffff9c, &(0x7f0000000280)='/dev/ion\x00', 0x0, 0x0) r1 = syz_open_dev$dmmidi(&(0x7f0000000100)='/dev/dmmidi#\x00', 0x8001, 0x220000) setsockopt$inet_tcp_TLS_TX(r1, 0x6, 0x1, &(0x7f0000000140)={0x303, 0x33}, 0x4) r2 = memfd_create(&(0x7f0000000080)='GPL:system\x00', 0x2) ioctl$KVM_DIRTY_TLB(r2, 0x4010aeaa, &(0x7f0000000040)={0x3, 0xfffffffffffffffc}) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f0000000180)=r2, 0x4) ioctl$KVM_ENABLE_CAP_CPU(r1, 0x4068aea3, &(0x7f00000001c0)={0x7b, 0x0, [0xe0, 0x5, 0x9, 0x80000001]}) socket$l2tp(0x18, 0x1, 0x1) setsockopt$l2tp_PPPOL2TP_SO_REORDERTO(r2, 0x111, 0x5, 0x10001, 0x4) [ 799.007844] binder: 1334:1335 BC_FREE_BUFFER u0000000000000000 no match [ 799.042429] binder: 1334:1335 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 799.049514] binder: 1334:1335 got reply transaction with no transaction stack 22:55:49 executing program 7: syz_emit_ethernet(0x3e, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaabbaaaaaaaaaa00080045000030000000000067907800000000ffffffff2100907800000000450000030000000000000000ac14ffbbe000000121a3627741065cc96e4b25bd85c630285ce7c38d2f339960705aeb36db643c369bfc6a4e39375290f92f361366fe502312f339e71b60662244c94afc8dfe0d2ad4c34377c127d545cb267c562bd2178c910500b95f3a06f504a5067be03a974f11c3d1d00b7bd6f774a877d90eddd8387359306356e4d4f465db90d0b6f7d6401fbad14d05eb4e9e0699547a892f48201da65d"], &(0x7f0000ea3000)) 22:55:49 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x4}) 22:55:49 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0xffffff89], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:55:49 executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'cfb(blowfish-asm)\x00'}, 0x58) io_setup(0x9, &(0x7f0000000180)=0x0) r2 = eventfd2(0x46a, 0x80001) r3 = syz_open_dev$dspn(&(0x7f0000000300)='/dev/dsp#\x00', 0x6, 0x1) r4 = syz_open_dev$sndpcmp(&(0x7f00000003c0)='/dev/snd/pcmC#D#p\x00', 0x2, 0x2) r5 = syz_open_dev$vcsa(&(0x7f0000000680)='/dev/vcsa#\x00', 0x401, 0x0) io_submit(r1, 0x4, &(0x7f0000000700)=[&(0x7f0000000200)={0x0, 0x0, 0x0, 0xf, 0x7, r0, &(0x7f00000001c0), 0x0, 0x4, 0x0, 0x0, r2}, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x3, 0x10001, r0, &(0x7f0000000240)="01c5593fcb1a207765e2b42e1f7f8fd101e3876b91330e765bf268f951a5496edfd2603278f13b39272c0b74bca3c288379b52f1e7055c2b490cff0305f118ec827e55a7451efb04d091a36396edfa3decfa2ac61f3322ea0551bc3bb3fe1a527d51ec146a70ec0fce755b3f97e990275c5229022bd4212e3be7df4328b1f62a6c6dc81ec1ef91fe31024f7c0d4a526918e329f7", 0x94, 0x8, 0x0, 0x1, r3}, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x3, 0x0, r0, &(0x7f0000000380)="18f1240978", 0x5, 0x100, 0x0, 0x1, r4}, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x10000, r0, &(0x7f0000000580)="934c7b97d5df669df48792875a7aa6811141c571a4266892b1343ffb371a7260b117577b0abc4926879c29e8823aa730c12a73d822ff50924908bdb3433c97c56586dc1403e4351eabdba79da7f40843f1dd0099ed0a1174bf20c42693c4ef8e79577e230a73f822c56731ae509f5eca18b6a81fb0080ac42d9aa41b9b29499dfb2310c3339ed3c0f3f0dd5c6853ca1b128e906e348cc07cb1c8bb69388e13a3f04e98f35d3908c26277fc365cd51a26eeb76973d1a28ab3fc7f40739476189d4841b92000278b9066edd80aec0e6ede38c0d7c2746857cb9b", 0xd9, 0x800, 0x0, 0x1, r5}]) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00003c1000)="0a0775b0", 0x4) r6 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r6, &(0x7f00004f0000)={0x0, 0x0, &(0x7f0000e46000), 0x0, &(0x7f0000967000)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) ioctl$EVIOCGKEYCODE(r6, 0x80084504, &(0x7f0000000000)=""/70) sendto(r6, &(0x7f0000000100)="2240faff00310f21", 0x8, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="18845f3d56978163ddeedfb64cba9f5942a6b163c1b8543dc179b717f10e5f6d446b07fc9ee8b13e957213c9bf8577299158d08e0e775ed6b4db317b78a3ea9c644baa3efab69da86f21c68cd8998383e69dfa885032ebb6cf4687b882111d693ce8a1519b59d9ffca25a15b60c5a63295d48af7c6b2b0010923c909d7b38dd006d70bab18171df73b121d4778560cc4b8edf3dd4f7bb95e263ca03436ddee4149c04e7d92f174f88dfc060884c9303b0fdddfb95d15f5296a39384b38318a32f1a2a3ff40280cb2563c000000000000000000000000", @ANYPTR=&(0x7f0000000140)=ANY=[@ANYRES16=r0, @ANYRES32=r6, @ANYRES64=r6, @ANYRES16=r0, @ANYRES64=r0, @ANYRES16=r6, @ANYPTR64], @ANYRES64=r6, @ANYRES64=r6, @ANYPTR, @ANYBLOB="8f07e571fd2266cc5c0a92ab64362fd68b40ca1b003f7bf5e077a86904"], 0x6) renameat(r4, &(0x7f00000001c0)='./file0\x00', r4, &(0x7f0000000740)='./file0\x00') recvmsg(r6, &(0x7f0000d43000)={&(0x7f000076c000)=@hci, 0x3, &(0x7f0000ae0fc0)=[{&(0x7f0000b9ff8b)=""/117, 0xa5}], 0x1, &(0x7f0000837f57)=""/169, 0xa9}, 0x0) io_setup(0x6, &(0x7f00000007c0)) r7 = semget(0x3, 0x4, 0x208) semctl$GETVAL(r7, 0x4, 0xc, &(0x7f0000000780)=""/37) [ 799.056856] binder: 1334:1335 transaction failed 29201/-71, size 0-8 line 2759 22:55:49 executing program 6: r0 = accept4$inet6(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, @ipv4={[], [], @multicast1}}, &(0x7f0000000140)=0x1c, 0x80000) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(r0, 0x84, 0x79, &(0x7f0000000180)=0x401, 0x4) r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x400001, 0x0) getpeername$packet(r1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f00000000c0)=0x14) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000004fc8)={&(0x7f0000016000)={0x10}, 0xc, &(0x7f000000b000)={&(0x7f0000000040)=@ipv6_getanyicast={0x14, 0x3e, 0x200, 0x70bd25, 0x25dfdbfe, {0xa}, ["", "", "", "", ""]}, 0x14}, 0x1}, 0x0) 22:55:49 executing program 7: syz_emit_ethernet(0x0, &(0x7f0000d53fc1)=ANY=[], &(0x7f0000000080)={0x0, 0x0, [0xf7ffffffffffffff]}) r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x441, 0x0) ioctl$EVIOCSCLOCKID(r0, 0x400445a0, &(0x7f0000000040)=0x13) r1 = fcntl$getown(r0, 0x9) ioprio_get$pid(0x1, r1) ioctl$BLKREPORTZONE(r0, 0xc0101282, &(0x7f00000000c0)={0x150, 0x1, 0x0, [{0x59a, 0x5, 0xffffffffffffffff, 0x8, 0x8, 0x6, 0x7fffffff}]}) [ 799.165623] binder: 1334:1367 BC_FREE_BUFFER u0000000000000000 no match 22:55:49 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x3b00000000000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:55:49 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000280)="295701010014f47d672080091199ea3eb811435dab0034e16c9d6bc9ec1e3527bb4a26ab8043b17e3c8c2fba9e243a2efabf77ce10157da7e28d5f99f26af0289b8e18d7865de5a8db9356ce428ea04d6d84dc60af2be3d21b3bac53df31356e6e3d36a6e7") unshare(0x2000400) r1 = syz_open_procfs(0x0, &(0x7f0000000240)="2f65786500000000000489004bddd9de91be10eebf000ee91e18f0c76fbb232a07424ae1e901d2da75af1f0200f5ab26d7e071fb35331ce39c5a0000") ioctl(r1, 0x1, &(0x7f0000000100)) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f0000000000)={0x6, 0x8000, 0x9, 0x4, 0x0}, &(0x7f0000000040)=0x10) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000000080)={r2, 0x9, 0x7, [0x9, 0x7, 0xffffffff7fffffff, 0x9, 0x2000000000000, 0x10f2, 0xfffffffffffffffd]}, &(0x7f00000000c0)=0x16) [ 799.209620] binder: 1334:1367 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 799.216770] binder: 1334:1367 got reply transaction with no transaction stack [ 799.224121] binder: 1334:1367 transaction failed 29201/-71, size 0-8 line 2759 [ 799.309131] IPVS: ftp: loaded support on port[0] = 21 [ 799.375650] binder: undelivered TRANSACTION_ERROR: 29201 [ 799.381261] binder: undelivered TRANSACTION_ERROR: 29201 [ 799.817456] bridge0: port 1(bridge_slave_0) entered blocking state [ 799.824468] bridge0: port 1(bridge_slave_0) entered disabled state [ 799.832273] device bridge_slave_0 entered promiscuous mode [ 799.860284] bridge0: port 2(bridge_slave_1) entered blocking state [ 799.866728] bridge0: port 2(bridge_slave_1) entered disabled state [ 799.873895] device bridge_slave_1 entered promiscuous mode [ 799.903882] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 799.932540] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready 22:55:50 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) read(r1, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(0xffffffffffffffff, 0x540e, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000016) 22:55:50 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x6}) 22:55:50 executing program 7: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x101000, 0x130) stat(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000100)={{{@in=@rand_addr, @in6=@local={0xfe, 0x80, [], 0xaa}, 0x4e21, 0x4, 0x4e24, 0x7f, 0x2, 0x20, 0x80, 0x73, 0x0, r1}, {0x3d, 0x470, 0x80, 0x3, 0x1, 0x5, 0x5, 0x2}, {0xf5, 0x75, 0x80000000, 0x4}, 0x20, 0x6e6bb1, 0x3, 0x0, 0x2, 0x3}, {{@in=@rand_addr=0x2bd3, 0x4d3, 0x7f}, 0xa, @in=@remote={0xac, 0x14, 0x14, 0xbb}, 0x3502, 0x3, 0x2, 0x9, 0x0, 0xaf1662a, 0xf344}}, 0xe8) setsockopt$inet6_dccp_int(r0, 0x21, 0x10, &(0x7f0000000200)=0x3, 0x4) 22:55:50 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x2000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:55:50 executing program 0: openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)="2f65786500000000000409004bddd9de91be10eeaf000ee9a90f798058439ed554fa07424ada75af1f02ac06edbcd7a071fb35331ce39c5a00000000") tee(r0, r0, 0x8, 0x1) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syncfs(r0) 22:55:50 executing program 6: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/snmp6\x00') getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000600)={0x0, @loopback, @local}, &(0x7f0000000640)=0xc) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000680)={'veth0_to_bond\x00', r1}) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000000)={&(0x7f0000fff000/0x1000)=nil, 0x1000}, &(0x7f0000000040)=0x10) [ 800.097886] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 800.176468] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 800.298692] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 800.305878] team0: Port device team_slave_0 added [ 800.331059] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 800.338308] team0: Port device team_slave_1 added [ 800.365357] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 800.394547] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 800.423783] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 800.452680] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 800.698828] bridge0: port 2(bridge_slave_1) entered blocking state [ 800.705266] bridge0: port 2(bridge_slave_1) entered forwarding state [ 800.711958] bridge0: port 1(bridge_slave_0) entered blocking state [ 800.718410] bridge0: port 1(bridge_slave_0) entered forwarding state [ 801.644660] 8021q: adding VLAN 0 to HW filter on device bond0 [ 801.733783] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 801.824562] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 801.830818] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 801.838387] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 801.926192] 8021q: adding VLAN 0 to HW filter on device team0 22:55:52 executing program 4: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc8106d345f8f760070") r1 = socket$xdp(0x2c, 0x3, 0x0) getsockopt$XDP_MMAP_OFFSETS(r1, 0x11b, 0x1, &(0x7f0000000080), &(0x7f0000000100)=0x60) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x8000, 0x0) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$TUNSETFILTEREBPF(r2, 0x800454e1, &(0x7f0000000140)=r3) 22:55:52 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) 22:55:52 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x3a00], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:55:52 executing program 6: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_SIGNAL_MASK(0xffffffffffffffff, 0x4004ae8b, &(0x7f00000001c0)=ANY=[@ANYBLOB="920f333e9780c144413896366ddf68e679badf79bb9592fa984dbd4c055e7c715615cf30db7b58dd596b7f05195106c0e05240aa5cf6bf05bd9326703b2d7c93ad62a2e55aaa1c86d43fe252a1c8677add3024c66105be24798ed8d328854daf155a13703b1bed3e70e5b9a04fd7760a19f0dd4b11cf1df1c886bef9935aa80f7302f43fe0ba03e99b07aaf56d63d16e58c089ddbc544fe2821b8c58cd091d4c2ccb85aa62432dd3b59ae637e760e65abca1984cd82b24d442c4dfd6ea3a2328e178bd8b1c2b76086f356038a43dd91fcf979f5fa15674b9492c82"]) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/mixer\x00', 0x10000000280400, 0x0) syz_kvm_setup_cpu$x86(r1, r3, &(0x7f000000f000/0x18000)=nil, &(0x7f0000000000)=[@text32={0x20, &(0x7f0000000140)="d940490f01cf0f20df67660f3880900030c7442400fa3c0000c744240288990000c7442406000000000f01142464f40f01c866b852000f00d80f01df66baf80cb8ff0ec788ef66bafc0cb0c5ee", 0x4d}], 0x1, 0x48, &(0x7f00000000c0), 0x10000000000001bd) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000001000/0x2000)=nil}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 22:55:52 executing program 7: syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000040)=0x0) r1 = syz_open_dev$ndb(&(0x7f0000000080)='/dev/nbd#\x00', 0x0, 0x80040) pwritev(r1, &(0x7f0000000440)=[{&(0x7f00000000c0)='O`t', 0x3}, {&(0x7f0000000100)="7554a834ba56d702cb1479649e853c78b67951af43b80c7ddf0b96fd416d0bc633be6517c93e18e745e589a8669cb2b6cab6be1ea8f7364b48d37051eeb7033f2be92c9ac5370e8abb0f43a334a39272fbadc973d0e1853110744f3f724540b637d710f9067583c86e219c16c8b8e0ce38aa626009194564f2a2b6f698b758bfbcb9c8ae08b49a44afd970f839f48198e63a3b465931833f7640656307628a77114756448020595005d8e62fc97b45e44e64ab3852a66b5ec4c6df81e13ab6e36ec7194830a6a60bd29ada298557c1545fe27f673b291e579bcb99457ec293471f67eb8dea3c9895e8c0a8f2a8203c715ff73bfce24cb718ab6660610c74", 0xfe}, {&(0x7f0000000200)="bedd087d76aa16af989d9efd1bfdd545288760ba5244a729f810f11d399bf8ae9f5d8d38288140f2b15efac94a2eb563387a37dab3eef0c318aefb8e376a2b0bdb43a1055a5712b027c2ee190170d62c164817f26dc749c2c818b8c439a5de2b8913a270bc7cf0844c37bd48a2c29ff03e7668dbb7bd57116d4193d4edeeb2e09680133adc831413e9f5f267618368b8bb0e5ee21736b9e031a8958a28fac836dbaf6981813cc1332984b867a1c17381a2c7d0c5e8ae481065e5c6ec", 0xbc}, {&(0x7f00000002c0)="9c14dda5ec755d090c2325d36fd8d6ed75870684eb21d80ee8ea8f59ed2ab0ab8396b1b685d28d065d1c538f5aa783d784d16b0bce860b87efc5b7a3299597d0353a5f57cb594657fc642d8c806c225445fb72cb33", 0x55}, {&(0x7f0000000340)="0aa289a24605c96532c0f43918c99428579286ab22ed2f326984a2fc2b41d9bc9f2918111d3079f7c7511021a812d362424d8a8aaa7e33d790b9b6f3ffcab7205849a5ed2b124f8dd76e4b81be7cd14944c915d6417d574a761d95a5dbc2e629c8f9cf90e335feb5ad89d2afa38e311acfa59cf7f7eafa719fa57c97549fbc3113cf5ce65947e11e65c394a2e8a9241925c074f0744cca2dba6cc3e4a4233a62066dd2a778c42bade177ab58b2c0d73a6b77b63101fc8ea57423d4bf3f06f58fa26efec6dcca088f2fac3140cf33f3d5725297c4ff51271f32446ad1ecfdde031146d35cb9f3620a0e4f9619c2504fa665d8f49d9ed2f210", 0xf8}], 0x5, 0x0) r2 = getpgrp(r0) syz_open_procfs$namespace(r2, &(0x7f0000000000)='ns/uts\x00') 22:55:52 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x20000000009) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") getsockopt$inet_sctp6_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000000040)={0x0, 0x1, 0xc7, 0x9, 0xffffffffffffff01, 0x9}, &(0x7f0000000140)=0x14) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f00000001c0)={r1, 0x9}, 0x8) r2 = socket(0xa, 0x2, 0x0) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(r2, 0x84, 0x4, &(0x7f0000000180), &(0x7f00000000c0)=0x4) flistxattr(r2, &(0x7f0000000200)=""/143, 0x8f) getsockopt$sock_buf(r2, 0x1, 0x28, &(0x7f0000000000)=""/62, &(0x7f0000000080)=0x3e) 22:55:52 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x600000000000000}) 22:55:52 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) read(r1, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(r0, 0x540e, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000066000), &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000016) [ 802.502830] binder: 1700:1702 BC_FREE_BUFFER u0000000000000000 no match [ 802.541555] binder: 1700:1702 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 22:55:52 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x2], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:55:52 executing program 7: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x18000000004200, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller1\x00', 0x2}) ioctl$GIO_UNIMAP(r0, 0x4b66, &(0x7f0000000240)={0xa, &(0x7f0000000200)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}]}) syz_emit_ethernet(0x3e, &(0x7f0000000180)=ANY=[@ANYBLOB="0180c2000000aaaaaaaaaa00080045200030000000000067907800000000ffffffff21f06ec125c85fb6f34224bdf33314eb00907800000000450000030000000000000000ac14ffbbe0000001"], &(0x7f0000ea3000)={0x0, 0x0, [0x25e]}) chdir(&(0x7f0000000000)='./file0\x00') setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000140)={&(0x7f00000000c0)=""/120, 0x1000000, 0x1800, 0x200}, 0x18) [ 802.548768] binder: 1700:1702 got reply transaction with no transaction stack [ 802.556245] binder: 1700:1702 transaction failed 29201/-71, size 0-8 line 2759 22:55:52 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x1c00000000000000}) 22:55:52 executing program 4: r0 = inotify_init1(0x80000) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000200)='io.weight\x00', 0x2, 0x0) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/vcs\x00', 0x404000, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000440)={{{@in6=@mcast2, @in=@rand_addr, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in=@broadcast}}, &(0x7f0000000380)=0x29fa4a9) ioctl$INOTIFY_IOC_SETNEXTWD(r0, 0x40044900, 0xd5e5) ioctl$sock_inet6_SIOCDELRT(r3, 0x890c, &(0x7f00000003c0)={@mcast1={0xff, 0x1, [], 0x1}, @loopback={0x0, 0x1}, @dev={0xfe, 0x80, [], 0x21}, 0x10001, 0x4, 0x3, 0x400, 0x0, 0x100086, r4}) ioctl$KVM_IRQFD(r3, 0x4020ae76, &(0x7f0000000280)={r3, 0x19de007, 0x20, r3}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000240)={'gre0\x00', r4}) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0)='IPVS\x00') sendmsg$IPVS_CMD_SET_CONFIG(r1, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000004}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x38, r5, 0x100, 0x70bd2c, 0x25dfdbfb, {0xc}, [@IPVS_CMD_ATTR_DEST={0x24, 0x2, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x80000000}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x8}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x40084}, 0xe04ce0c7836793a8) write$cgroup_int(r2, &(0x7f0000000080)={[0x34, 0x3a, 0x37]}, 0x3) 22:55:52 executing program 6: r0 = socket(0x10, 0x802, 0x0) write(r0, &(0x7f0000000640)="240000001a0025f0006bb4f7fdff141c0a0b5aff6e10b500000780cc08001b0001000000", 0x24) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x141000, 0x0) ioctl$KVM_GET_SUPPORTED_CPUID(r1, 0xc008ae05, &(0x7f0000000040)=""/225) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f0000000140)={0x0, 0x8001}, &(0x7f0000000180)=0x8) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f00000001c0)={0x2, 0x8005, 0x1, 0x7, r2}, &(0x7f0000000200)=0x10) unlink(&(0x7f0000000340)='./file0\x00') ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r1, 0x40045532, &(0x7f0000000240)=0x5) 22:55:52 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x2f], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) [ 802.692526] binder: 1700:1735 BC_FREE_BUFFER u0000000000000000 no match [ 802.732099] binder: 1700:1735 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 22:55:52 executing program 7: r0 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x3, 0x40040) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x0, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x21}, 'bcsh0\x00'}}, 0x1e) getsockopt$inet_udp_int(r0, 0x11, 0x67, &(0x7f0000000080), &(0x7f00000000c0)=0x4) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/sequencer\x00', 0x20440, 0x0) setsockopt$inet_udp_encap(r1, 0x11, 0x64, &(0x7f0000000300)=0x5, 0x4) 22:55:52 executing program 0: syz_emit_ethernet(0x6a, &(0x7f0000000180)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0xf, 0x0, 0x0, 0x0, 0x0, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x16c, 0x0, @local={0xac, 0x70, 0x14, 0xaa}, @dev={0xac, 0x14, 0x14}, {[@timestamp={0x44, 0x2c, 0x0, 0x0, 0x0, [{}, {}, {[@loopback=0x7f000001]}, {[@broadcast=0xffffffff]}, {[@multicast1=0xe0000001]}, {[@dev={0xac, 0x14, 0x14}]}]}]}}}}}}}, &(0x7f0000000000)) socketpair(0x19, 0x7, 0x4, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$UFFDIO_ZEROPAGE(r0, 0xc020aa04, &(0x7f0000000080)={&(0x7f0000ffb000/0x4000)=nil, 0x4000}) [ 802.739157] binder: 1700:1735 got reply transaction with no transaction stack [ 802.746536] binder: 1700:1735 transaction failed 29201/-71, size 0-8 line 2759 22:55:53 executing program 4: r0 = socket$inet6(0xa, 0x7, 0x5) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") ioctl$KVM_PPC_ALLOCATE_HTAB(0xffffffffffffffff, 0xc004aea7, &(0x7f0000a1cffc)) r1 = syz_open_procfs(0x0, &(0x7f0000dec000)='smaps\x00') madvise(&(0x7f000092d000/0x400000)=nil, 0x400000, 0x10200000008) mlock2(&(0x7f0000bbd000/0x1000)=nil, 0x1000, 0x0) sendfile(r1, r1, &(0x7f0000b58000)=0x200000, 0xffff) [ 802.788502] netlink: 'syz-executor6': attribute type 27 has an invalid length. [ 802.875285] netlink: 'syz-executor6': attribute type 27 has an invalid length. 22:55:53 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff7f00000000, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) 22:55:53 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x3300000000000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:55:53 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x400000000000000}) 22:55:53 executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000300)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4543(gcm(aes))\x00'}, 0x58) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x2, 0x0) setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f0000000140)={&(0x7f0000000040)=""/227, 0x4000, 0x1000, 0x1000}, 0x18) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, &(0x7f0000000000), 0x0) 22:55:53 executing program 7: sysinfo(&(0x7f0000000000)=""/88) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x0, 0x1]}) 22:55:53 executing program 6: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="020800000300000000000000000000000000000000000000"], 0x18}, 0x1}, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0xbff, 0x100) ioctl$SG_GET_LOW_DMA(r1, 0x227a, &(0x7f0000000080)) r2 = openat$mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/mixer\x00', 0x2, 0x0) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r2, 0x80045301, &(0x7f0000000200)) socket$key(0xf, 0x3, 0x2) [ 802.966824] binder: undelivered TRANSACTION_ERROR: 29201 [ 802.972525] binder: undelivered TRANSACTION_ERROR: 29201 [ 803.050530] binder: 1783:1784 BC_FREE_BUFFER u0000000000000000 no match [ 803.078283] binder: 1783:1784 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 803.085394] binder: 1783:1784 got reply transaction with no transaction stack [ 803.092826] binder: 1783:1784 transaction failed 29201/-71, size 0-8 line 2759 [ 803.117731] binder: 1783:1789 BC_FREE_BUFFER u0000000000000000 no match [ 803.179908] binder: 1783:1789 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 803.187154] binder: 1783:1789 got reply transaction with no transaction stack [ 803.194521] binder: 1783:1789 transaction failed 29201/-71, size 0-8 line 2759 [ 803.217463] binder: undelivered TRANSACTION_ERROR: 29201 [ 803.223169] binder: undelivered TRANSACTION_ERROR: 29201 22:55:54 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) read(r1, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(r0, 0x540e, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000066000), &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000016) 22:55:54 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x3000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:55:54 executing program 7: sendmsg$alg(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000001340)=[{&(0x7f0000000340)="d2d2b7bf3c547ca55b450a644a37857b2f9bff4e396c33167db2d8bf001a851c6e16b60c822e4198df9c6c648c52c87c6fa0a3f1040e1a1737263d96938142152040ececd644274603d1ab4f7097267aa1db8803d6eccb5780b4f28986dd9fce416007dd58736289d698a35aaf37f515e3c52f77b6d6dda5a41ec9d5a594465e984a7d40251b74c78b01bc9a69946e3f69b27b6655ee980e440d0306d0edcdc9d99f93229b62f4ec56826b43a331b1fe3d29c68f458761c0527610a00b12a2b8ec4e26f63745038436d3817e8590250170d46bdf7196fe94c1c862d8f68ff3f096e2e8a86d506a3c5719ab9f665ed30530d3c08b6c4966f77fe13c51aa640a4a4ac6109424b72ee2280b8eaf000e18c67b6fdf479800b6f0b79707a7f49ae0a2c9867ad155b314b3a771752284b3c46dc0eed6af666a1f48c212b0acef45ca6fb4fd4e2121ab7fd4cf5179fea647f01b395b13b6e15ba547bd8a0d50f93cf2b3104a84a4783da0a96156b8f70559a50eccf33302706af387a408db5660c934c6398ed7463dfd1f218294f3798e499092a8837d25a243b29a9c2fc7ef1c51e956075b9d2e7c0bbbd9dcf6e1e79164472367fa5252cfcad312b9cfe2cdfab319a5cc9c794338ad8f8cbac04c627129990fdb2670ede015de9808d06188af8967398a55804ce019131bcbdebc30647c526a0e7cc3c45360a0cf793815a9a34af98901a6bf1500af7f7de7fc0e567bade21ac1d74f26da08584a0f7d77b1ec5d74808253ecfba43222abe84e4b5a24aa162d150a75ccc5c16949f09602e09e6d01cbdedfcade5776ce87d313d5d1811a1a362b2f4847fd676c91bf539259209bd8c3eef11b500a5d00018cc8ee58877fb7214e0f98be10ac541d5c3a15b8118b7614248300b530b103d324106d68a92946a467dc80dc5558145647bf2b87fbd15fb0d3946f5469ca89b66b477f378743cb8a31905f731a48633c8dcf7f68c4313288836fd8aac63254aaaa5d2a9105efc9fd6afc142f1a165333ab8395f1f6b78831595967960955dd6999c46bca1c1ec9d0ec06bbd53a78275728cee58c1e31452b09a29f5e26484cf752e47cb9db554837b3c835049d626fd2f3f79d1a691e66cf68e7cd876bde8c8e1d91fbfd41125fe455ed335e91a2c7e4734b2742ea189bac10feb3e21c2ffdc1639b36693e7273319e9f6a3628be6e4e6810647f368c6565fc3bc36dff2c49959d4e03926739625332cd38b450c14eb8989470e3f2672281a8c9e1ed71255ffb8fd15c9a6cd6f83602fb33661f4ff9c5e6d4bd5cad7398faa1b5fea188d42ce3a8c1bed1ceecec990ce64a51af0f114740799779747af6dcd4b534d7b1bbf1c49246c685c16a3fff7cb6724815bab9f8b386b48b5a39b6028b4243522d3937d5c89ffd243b864a30b4d77e0adabbef799960b4881b0574d02c8a3438e1f651044e09b676f06654ad265bf56e29fa5a06c634b1776cf4fb15d32c0b6eb22cee2a9240590e44032d42f6d9d5ae9d4976945f7e19ab86a84ce939d63a1377a5be92c2307b8bbe3c83a929d3c20742bdff76f97944d9b438fc75d75db46be5a73c554a7767df2d19a7273c4c629e755776591215fff0f0dbbae5a71fc9dce7736c3706e4ef958e0995388b1e96a6aedb6f4f9292b1fb076da1d715cdd98addeed6cdd9bba63f77c8aac429eafdfc09f466eb373a1ade6da6b0db8a283755afb0109e102fd21ff82c9c45ec6d74458305d94dffa8ffd810377e64827d6ca2fa188ddd0920ef5db4a0dd1ddf0c1f98aa42907f95f326f8f69a371dc5242be8d464725bc118983ccbe790a6618bfd4f804432dfd3cd727aa723efd81dfe06bba17da40563f0c5b66636f26612e85c268405609aad283150c6cc34879b5d70df037ab20f59ca4935c94f7939f0f5ac748b9ffce661a7bc9abd04678c4cc832e94f8fb4515a7632202efd70af3d0d6151cd55792f4ce792d0fe93e80f0f0ad4cd7c01e594ea0e1241024fc00fd2da7e5b7fae57e0822e26d9ae29b5a6363f00b3d6ac9cd2ebc8fcf06e7b9f40767f0302484b3c3fdd3d3bddccdd2da700ed57fc29528903393bcd8218d0fae2a8c2dc8816fd68a9338112c5861bae450ecd5be56be201681f5b426bae096d815fb5e38cf2f3de73b2c77d9dd14d9b7fd3ddada76cd626384153c4f4e4e33343030f75dbf7e6abb3d458910cb6c2c4655c9662af0a7209c4259a5333e5e7236b8f8f471c755b76578c187c20f01d387ea9563a8a5fbcda2839ab4d6cd710fce95e19674a9bf3f44b700d52653b3e20a5c3252d8d6adda34af0171ead0011b18de841375be3a9957b850ced9e152a1244dc497c137dbc7f0c6fa5f5d6d32bd5dfe9e5b97116f396441304b999ea4e39f9e60cedf6003e411910feb9e51531d2df7af9464370d522964b2fa1b0286af0779d2beae9a984a086b7441d68f673046af4628bcd54a0ac9c18392bbd5ed2b5a102729fc4fb83356f8d2216a0ce1c533a63a5740ac0da3293fad0574ad94fe1834e393fc17ac9c1b72f5907f5667c11c46ad1dab69cd2c25d735b32329b94bebe6b3b65248b0885bce2a6778a395307b0d2d0dbe6b5e3c0086c2472636b634ba5e9fb32413503397f787b7530c1ce3b178ac8eee4ccf03b701b5fa343070e2dc10d8a013cae0d4eb564084a1e4dcce48130c174aed19dbc76186292c6d1efeacf8ceffdd9d988aef86b4bc354d50790252c396f0119de562c35a1f5bba208b3703c59c4bdecc903ef0f5c3a83e9638829ee92817995fc24a2c1cd9876e97dbe1ea8ace395d224267d0c7d50d0ad991a2e85ff7cb83e23b4ec6e49151bfcdf831375c82f08ce393497ab2b7a2d0d1ee2887c81cd1f735264b79db4fcc5c984c28a7963584ab65dac1d5bf6c0c5c5788f5702523b880cb6099ef56a36d3d2942412b2c2cd030926d6fc9841de4b029677678148c37b22f3b2b83ef56bfea6e798167d2db547c8b64cdf64af90206dd8e5ab5acc8724351377eb47f619477e5c4d0ff537705abbf2297cc3e05488273b5230d18365f9225ac0220ef51501e11131401893707f20da62e2116b9677adf45b795fd40b73344fdf3b11e86cb3720e86397b66c3cfbdf30690d7820ecccb9ff1128aa4a35fb0e01573fd62c275c109094b4e1c1fec56384715badf7b99889b0ba660e008c63f67a0ac8afa1c65fac0ddf7780113fa74bd302492631fe847d1be6cf82e3a46fb657e479b64c4647c4617c9956a77cd5db46c74b5579912f69c633d84bfa7c81fd9f3f84dfda7e930b6f02d82ed3be50cac3dc0e313d32d47d7ff18743d8f21a3b6c3ee35c4ff3c1eb7387ad9210cbeff58623fda5496391bfa21fbbcf2377621fb4a47b0bbf969704e5c34e49a8e02eef6cba6454eeb7fc38f21b8e0cfee0d2d7d4f9dd8f612f01de5f9be6b36a8f101a717a3c986804f54e9c10411f3792563e0e2cf0783cf01dbf8994475911640766dce58b787182d81ad2510026a4b8fbff96322f07bc616dbf861ff9c8ce0526cfe96797c48800f41a68b3a0cc3caf18913af60784ca54c89726a97965db9e24fee600bf74d4ff16d8ae60a31e7022cd8cbea65c5881fc2f1fa42fbc6bdeb2610fe558da4d6e8adc80470065b17e30dca82572d424ecd838fb4bb0cea67557aed465600759dcd55824ae4752dffa67908c099ab0af82ecf0ccaeb74e1a4455e5bd84d6e19aff10c5b0040b4fba6407f10630ffff4d71a5fbede849b5e143ceed4ce18a53e7181bee200a65e8620229ab8f795c0107b22be14e8a2d47aaed3f833037ae8deb7411486944d7a062fb2cbe5b360559835852636ec003f31c73b42dcafc0477e97a43cdac0a3f411fcb64c54ed59164ed0ce968acfbc1b4872c40682e97627034504ed512d293282028503ac2d21a56f9249622173e7a3cd7d42eacbebf6c1cb0ec35240e4ecca6ca1d0ee312f2971f36400c1fff3c36270f4b7bf20df5cc2e7d455eb61e20dcda0691c9c07257252ef674caab6d14fbf227b033a461298110cbde7561e9a5b1cecf32e94e28df2e1fb9202c71560425d7640fa1b3738e52b0f29e176a1cb37e4a31beb41c3d920e9d3de136e5273cad51e73749e347cd8c4578ee911fc211b085b06dd5cc7c8c765a2e55ab175d22e284cc2052e46f6b879d3e4a96995130016110ad077aef6f2afacdef45fccbe0f269b13edb12347f33aaa2e6fa12058e7bc31693d5d3d26f670027701158b36f5888e9ffea4421f949e643a509226ac879deb377ff284d2864e1d163521d24bec95692bf487abc3d1eb2cefe19d4be377f89747a3a5cbaebafd449b109f4bda29615b82e1475b0087e0f80c91826e2503c5ccbc8477b983024c3dadea30e4c2e2aa5981bc899b9d9fee9a70778e51420b5c82ec6c8d4ef672105eb10a70c98932f179a6d57d824299ea2e4a846f52fc6a7345786dd3e6219eaab42eecd270e3c7fda18f41fb3f1867c4bfbb8bdc72c37925ec01803e218ba91a13241179c5b82e0570b080cba31ec93d026f3addfc5a475b28f23c0eefe0a1c27102b3b5348187e1bb57682b4ffb640c5f9eea4f600d720bcddc92fe143247e812c48e2d7fa4f446d06e5712", 0xcc4}], 0x1}, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_SIGNAL_MASK(0xffffffffffffffff, 0x4004ae8b, &(0x7f0000001000)=ANY=[@ANYBLOB="920f22"]) openat$autofs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/autofs\x00', 0x1, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x8) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000000), 0x1000000000000040) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000001000/0x2000)=nil}) ioctl$KVM_RUN(r2, 0xae80, 0x0) syz_emit_ethernet(0x42, &(0x7f0000000000)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [{[], {0x8100, 0x8, 0x2}}], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)) 22:55:54 executing program 0: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x100, 0x0) setsockopt$inet6_MRT6_DEL_MFC(r0, 0x29, 0xcd, &(0x7f0000000080)={{0xa, 0x4e21, 0x7, @ipv4={[], [0xff, 0xff], @multicast2=0xe0000002}, 0x6}, {0xa, 0x4e22, 0x3a4b18f2, @loopback={0x0, 0x1}, 0x5}, 0x2, [0x1f, 0x2, 0x3f, 0xfff, 0x4, 0xfffffffffffffffe, 0x5f, 0x1]}, 0x5c) ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(r0, 0xc0a85322, &(0x7f0000000140)) r1 = syz_open_dev$dspn(&(0x7f0000000100)='/dev/dsp#\x00', 0x1, 0x0) ioctl$int_in(r1, 0x800000c0045009, &(0x7f0000000000)=0x10) 22:55:54 executing program 6: shmctl$IPC_RMID(0x0, 0xffffffffffffffff) shmget$private(0x0, 0x1000, 0x20, &(0x7f0000ffd000/0x1000)=nil) 22:55:54 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x1000000}) 22:55:54 executing program 4: r0 = socket$inet6(0xa, 0x7, 0x5) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") ioctl$KVM_PPC_ALLOCATE_HTAB(0xffffffffffffffff, 0xc004aea7, &(0x7f0000a1cffc)) r1 = syz_open_procfs(0x0, &(0x7f0000dec000)='smaps\x00') madvise(&(0x7f000092d000/0x400000)=nil, 0x400000, 0x10200000008) mlock2(&(0x7f0000bbd000/0x1000)=nil, 0x1000, 0x0) sendfile(r1, r1, &(0x7f0000b58000)=0x200000, 0xffff) 22:55:54 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5000000, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) 22:55:54 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet(0x10, 0x3, 0xc) sendmsg(r1, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000010707031dfffd946fa283000a200a0009000100030000000c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) r2 = getpgid(0xffffffffffffffff) ptrace$PTRACE_SECCOMP_GET_METADATA(0x420d, r2, 0x10, &(0x7f00000000c0)={0x800}) uselib(&(0x7f0000000080)='./file0\x00') 22:55:54 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x600], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) [ 803.907904] binder: 1800:1803 BC_FREE_BUFFER u0000000000000000 no match [ 803.935412] binder: 1800:1803 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 803.942565] binder: 1800:1803 got reply transaction with no transaction stack [ 803.949922] binder: 1800:1803 transaction failed 29201/-71, size 0-8 line 2759 22:55:54 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x600}) 22:55:54 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x4) sendmsg$nl_generic(r0, &(0x7f0000000040)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f000000d379)={&(0x7f00000001c0)=ANY=[@ANYBLOB="14ff070014001e001e0600000000000000000000"], 0x14}, 0x1}, 0x0) [ 804.052094] netlink: 20 bytes leftover after parsing attributes in process `syz-executor6'. [ 804.065988] binder: 1800:1830 BC_FREE_BUFFER u0000000000000000 no match 22:55:54 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0xffff000000000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:55:54 executing program 0: r0 = socket$inet6(0xa, 0x41, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket(0x1e, 0x805, 0x0) sendmsg(r1, &(0x7f0000000140)={&(0x7f00004f5000)=@generic={0x10000000001e, "0200000900000000000000000226cc573c080000003724c71e14dd6a739effea1b48006be61ffe0000e103000000f8000004003f010039d8f986ff01000300000004af50d50700000000000000e3ad316a1983000000001d00e0dfcb24281e27800000100076c3979ac40000bd15020078a1dfd300881a8365b1b16d7436"}, 0x80, &(0x7f0000447ff0), 0x0, &(0x7f0000000400)}, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0) ioctl$KDGETMODE(r2, 0x4b3b, &(0x7f0000000040)) close(r1) ioctl$TIOCGLCKTRMIOS(r2, 0x5456, &(0x7f00000001c0)={0x0, 0xffffffffffffff09, 0x58e, 0x8000, 0x40, 0xa7, 0xfa6c, 0x793, 0x5, 0x4, 0x7fff, 0xffffffffffffff3c}) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f0000000080)={0x0, 0xcff2}, &(0x7f00000000c0)=0x8) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f0000000180)=@sack_info={r3, 0x9, 0x20}, 0xc) 22:55:54 executing program 7: syz_emit_ethernet(0x1, &(0x7f0000d53fc1)=ANY=[@ANYBLOB="0180c2000000aaaaaaaaaa00080045000030000000000067907800000000450000030000000000000000ac14ffbbe0000001000000000000000000000000"], &(0x7f0000ea3000)={0x0, 0x0, [0x0, 0xa40, 0x0, 0xa90]}) [ 804.107158] binder: 1800:1830 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 804.107956] netlink: 20 bytes leftover after parsing attributes in process `syz-executor6'. [ 804.114242] binder: 1800:1830 got reply transaction with no transaction stack [ 804.130216] binder: 1800:1830 transaction failed 29201/-71, size 0-8 line 2759 22:55:54 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x7}) [ 804.224578] binder: undelivered TRANSACTION_ERROR: 29201 [ 804.230205] binder: undelivered TRANSACTION_ERROR: 29201 22:55:55 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) read(r1, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(r0, 0x540e, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000066000), &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000016) 22:55:55 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c000000, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) 22:55:55 executing program 6: r0 = socket(0x2, 0x7fc, 0x80000) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vga_arbiter\x00', 0x4ff35b1a8e77115e, 0x0) r2 = mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000003b00)={0x24, 0x0, &(0x7f0000003a40)=ANY=[@ANYBLOB="08631040", @ANYRES64=r2, @ANYBLOB="02ebffff0b6300000000"], 0x41, 0x0, &(0x7f0000003a80)="535b5a42c82cddac0a19db45e1fdad854da417700d21c2d2da623f536b7a28c5a120205bb3eb899190373b1248746524476c2c10fecf02eb2572054d690bb04c00"}) sendto(r0, &(0x7f0000003840)="f203e7345c4968095ecc4eb6d8b8b253dadbb273ae4158e64932e003f78a3107a6f240601b8a79fd44bc7b5d04db98709696f79beeee9bfcbed779cd7f1c51a540d0f28c7d4c4a2d84735f57811136e005dde1bd60021f650a37009dad40f40697288ad664578b6b410322b9735edaebe29cea96bf145442446896abffc7e07bbc17ba259d08e41fb0c77236018d5f0ae360bf7f11ba7ab88d3ce3e5c94883e069fcd0b604eeaa820e14beb422b52eb362a7741f633780a27310e5ab8bf46d778a75d89e06750d1cc0", 0x12, 0x20000040, 0x0, 0xcb) recvmmsg(r0, &(0x7f0000003780)=[{{&(0x7f0000000040)=@in={0x0, 0x0, @dev}, 0xa88, &(0x7f0000000200)=[{&(0x7f00000000c0)=""/247}], 0x398, &(0x7f0000000280)=""/4096}}, {{&(0x7f0000001280)=@nfc, 0x0, &(0x7f00000025c0)=[{&(0x7f0000001300)=""/50}, {&(0x7f0000001340)=""/78}, {&(0x7f00000013c0)=""/81}, {&(0x7f0000001440)=""/67}, {&(0x7f00000014c0)=""/62}, {&(0x7f0000001500)=""/188, 0x276}, {&(0x7f00000015c0)=""/4096, 0x196}], 0x96, &(0x7f0000002640)=""/56}}, {{&(0x7f0000002680)=@pppol2tpv3={0x0, 0x0, {0x0, 0xffffffffffffffff, {0x0, 0x0, @remote}}}, 0x0, &(0x7f0000003700)=[{&(0x7f0000002700)=""/4096}], 0xa4, &(0x7f0000003740)=""/30}}], 0x40000000000033b, 0x0, &(0x7f0000000000)={0x77359400}) ioctl$sock_kcm_SIOCKCMUNATTACH(r3, 0x89e1, &(0x7f00000001c0)={r0}) recvfrom(r0, &(0x7f0000003940)=""/237, 0xed, 0x1, 0x0, 0x0) 22:55:55 executing program 7: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x2, 0x0) ioctl$SNDRV_TIMER_IOCTL_GSTATUS(r0, 0xc0505405, &(0x7f0000000040)={{0x0, 0x1, 0x7fff, 0x2, 0x10001}, 0x80, 0x6, 0x20}) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)) 22:55:55 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x2b000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:55:55 executing program 4: openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x0, 0x0) r0 = syz_open_dev$vcsn(&(0x7f0000000080)='/dev/vcs#\x00', 0x1, 0x400040) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000280)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x5d, &(0x7f0000000580), 0x0) ioctl$KVM_SET_CPUID(0xffffffffffffffff, 0x4008ae8a, &(0x7f0000000000)=ANY=[@ANYBLOB="0000ff29000000000000"]) ioctl$KVM_RUN(r2, 0xae80, 0x0) 22:55:55 executing program 0: r0 = socket(0x10, 0x80803, 0x8000000) ioctl$sock_ifreq(r0, 0x89f0, &(0x7f00000000c0)={'bridge0\x00', @ifru_hwaddr=@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}) 22:55:55 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x30}) [ 805.385214] binder: 1875:1876 BC_FREE_BUFFER u0000000000000000 no match [ 805.420144] binder: 1875:1876 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 805.427215] binder: 1875:1876 got reply transaction with no transaction stack 22:55:55 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet(0x2, 0x2, 0x0) getsockopt$inet_int(r1, 0x0, 0x13, &(0x7f00006ed000), &(0x7f0000000000)=0x4) 22:55:55 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x4000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:55:55 executing program 4: r0 = socket$inet6(0xa, 0x1000000000002, 0xfffffffffffffffe) ioctl(r0, 0x8912, &(0x7f0000000040)="025cc83d6d345f8f760070") r1 = socket(0x10, 0x803, 0x0) getsockopt$SO_BINDTODEVICE(r1, 0x1, 0x37, &(0x7f00000000c0), 0x10) setsockopt(r1, 0xf258, 0x80, &(0x7f0000000080)="411836a845b42da9a426d94eae6f9b7c816019faab4c5ace0fe04d9833ea0927a64438eee3a00b4f688d071e5940cc4aa55eba347e36d4b634412e", 0x3b) 22:55:55 executing program 6: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f760070") mmap(&(0x7f0000600000/0x4000)=nil, 0x4000, 0x0, 0x44031, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x3ff, 0x80) ioctl$TIOCGSID(r1, 0x5429, &(0x7f0000000040)) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x0, &(0x7f00009ecff8), 0x2, 0x3) [ 805.434549] binder: 1875:1876 transaction failed 29201/-71, size 0-8 line 2759 22:55:55 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x100000000000000}) 22:55:55 executing program 7: syz_emit_ethernet(0x1011, &(0x7f0000001600)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@x25={0x805, {0x2, 0x80000000, 0xfb, "bfdd770a0245430668330efd89c173531d7ab79f1821fdbe2baf99f41b13c3de866d3d9b9b028355d35934bed51248fb90728a575de2a602886f4fab3de4b96d2a9196be82ebafb447f9ce30b3e023c50f2ac091ebed27da3a49fd6db77b8c87fe52dbfef48819e9eb1c8556f9bfa4e6674b3a4b6ffc4a1a86dfe5ac85edd93c28a3ae8312a45063281481e9a28fb24e621822ed99c645da02ecb385956e69eb199f1eacc7c7819d82d7333c2a9f51f790962799d19ac83f8ed7f995dc7acce4a20c3dfe7ba15771fcbcfc1b911fcbe02c87707a0c4d4f53bf762f0b9a4740c267f71a1dcddc043239f9c2e481184dafb747bda3b132e53dcfcb4586508062bad56c51739a866bf9789a53564acd2ba70c742c9b00fab592fdbc098661530e7c37ab914437ecce4303bb0fe408d3581df20985a442d80203f27f2b49ba59ca8a3e607e6eabffe447c5f453d3ea5c33d6ca321344cedae48bff8abaadb6bb21294455caacd22b02955f3dd4bd0810fb53f9ca6f575b55e5f58754f67fdd8e67c6665610dae93aff01133e257876cfbccb66b6b69a44d0ff85e1d59d3e2d98566f237fdb96da97eadc20ea71125d34b045dcb22b8817340c9cf34d666df81794e0a7f72d2882413dfea2258758da708302ba918b337f9c4ceb66ea976e81164c23042d5b1f23b9e4fb789056a8efc348828b47f5929f565f1a1b3e3236244360fc98f17f006c38d1a0f5eeaa9deda6b1465538077ac503424d0c82bd2adb403137803459d2eac8bfa7e6952d51688a81d929f09991c2f5eaec28960dc629bb5934a754763a4088262066b663f4460f9c302fc8aabc15441af619d296a1760e8df2b3413c158a12e04dbe0d88446e290e3ea3fcf4e3cdcfea2d44f831f0d1ccee82c037660a59deaab84fbc13cc91268af838f0ae6dbc8f3c877062ea635c2f3de65cfc753986f384477eaf05511e515e6699e410c684027224261d57288eeabbae97b8b02010301ef8b978a4602d9dfefc2be2429c24cd5cc4de88d20c46b3adaca569159dd7cfff74ffe8d43afe3365ae3c271bf5e66993e7e82c16ec1658af6221aaf4bc5921f3e1f14e7b5cd5753bf192bf8a509a35785f78ee848718ba8b53539237821c1c753f09089e4f49a6205ebef1ae651f391b7f1e16a1c799a94de8d0440e666ec72724e5ea7a8ede766b117b64f7276d26c6f5ecab3cb374a9c9719c813c4543803e92906d29e16ea2b69967e0dd3d0f3fa4dd09c893e9987ca546e935412ccf9c13eee954dd3ac42aeae08b45dba8e35be29d387a05ce265bb0c858b75e596da0d7027bc336d5bf900507186f4144136a7e84d1395cbc0c3f7aa2bb6490e3f28698d161fbdb6038893db478070f0c75f526a64db0f882ee956464523bbc2bd723ce6f02030048dc027e13635c04596ed755e04a9d2601d255a3892d17bdf68cd045b3d1593e7420c69d8b154c320bf166bde62e58bc74746a55e3e8c0e70d92d8331a85ff475ef89cbc46e4dec5b71f6808dc29a0771f6695ca248c1a10d21e0335941074be918be22bd830c6d7aebccde2426218219ed23f730302fb6464603ec7bbe497492a5a25ef1faaa3fc024986cd4a154e970522a0d936cec0b2c705cfe78b733719fb741955cf3682c60421b9883b84f61a07f51d5e913401801c30097c48539b6f4cddc38ce0910374749d8797f1d51265ace44c83b8495585cc56f3b73c915a7dcae51b7d1e9fb0475eb2ddb4dcca93ebac2c260bfeecde1169eb20ae7562607c8aa8788d9d5400a978bb14aa3fd1ec665d7819e8db10d8968a4df31ed39050ef445331bb3c6d3ede42f9fff46cd12981cd5fdb743543c66d423c0f5e775fd3b9e911726680c52b5d0bdaee9c12a2570c8e11a54862aff97b9c871edc07c4fdda7553cb43074ca70ff63bb1ea1dc02660d4e93a444c82258230cfb0afd491de74f7140d3006c28d4bff9ad89e3fa9681e61e4e57842b1e226191fbec5d752b39de0ac42fe98287d25d100204e05a115feb3a5c102261445e935cb49dd6e26fe85f97e612fdaf52c29ee42f6ff69f3904ee3f5a7352862cd48b8f4db19285efef4d34e9ae6ea982692940bfbd1c105244415478b616754e0dc16fac5cb9e30a8cdafd716079744c887f5c5cdbee6f0682fa3e65941e654b35a16199216260207c226ed7d21014a511ca9f4cb77f00cec0cfb83cdd477a1fe21d1c891d15667ac89ba569d90ed3c52d2e33862b6ab275855a87e76d6b8bc8156342fa85d9f15a3a0e89190b8abbeb353ea74dcff27a5eaffadcbf654711f099e9cc78165bc76ff9b809b87c55999b43174978d96de2d4e52e96169f119c6a99addd7cef3233ef1c716fda02b5d21769a4581279aef77c9d3037676678ab3385044d536b45e795fa68995d09a33ecebf3a502ad8c4086479d5839f16431d55a918a2d09b1e3003dbaa908e5c6e0cc5ed0923ec2262f76f503167428d1b4aa4bed9763f28645f81f20b82f9d5b98e91be4fed083014f954bafc3cd36a73c99c5e4b7ff411512815fb50d66723ad2e9c927f89eb083eb3967b3a67371366a56cf1d739dac08084a8ab7f21701ec7327e85dd4ae7d6d9bea5359b6e0619b7ccc4ebcbd03e6d7190ca4e2fd210c132bb965fa1249d9e72f8c7b0018027a6bc983553da0dd92b08f77952f52df8633c2affe4c979bbcee36e5f8ccfa5c10bc081f06f76d84f504f6b1e637645bc7eab64423b474cc73e0967b4a80d8bc4502db579c1321645e2f5fed523f26cfba7eb432c32f8cf6c0537585da3490c3da1d1c586f1cc256b2821d1efb3fb26569f726be215a2c63cb495b4c1f9e9e8e812878c2f277ef50049978e314d5af5972c0f931d01deeb8b2f7285bf7d2c57a32c470ded250b047aef1274e1a452e24fd109d68c2b327aefeaa09a2d042aab49b9a9ca032811cd3b8d8e1ea2d3b0240595ccf90e864296f6f6e0d2d8ea0fe7e7968415303ff5899791b9e43b70230cce7f9e0445343818ac1ccc8813c47c85662f268df137c14a45f00ea364ea2ee96247bb61ba0fe326c5583bc7b8491b320b3fdd4c0d1cf14286d1355e36fb22298ecfdf95bf1e92fd03aa12c4e068eb6da3280a7389b58e41d2913f6391b33116975f1c18fab8788fe6385d54aed000b1d242b9dbed15ff60d5b7dc974215bcf178934b7d189e3b350ed90af6b70e4a01b5782becf59ff31fb57ef874d13369c3fbadf49ef5d38f917ebf31142b6184c26c1fd74318115f3246d117187028168961465b15bd178535ed3ee786feb737e1f882ee6f8fa4de13160e2ab465d794b907b7c67fb70c4c0dffae74fd6ee44af2a110e061a7e80c81cf6b5672c4e47cf9bda11525c3802d0db9bc8b1eaf37bd067742492a5290b42c2a0d34e273749ad3b9134dc31070b1ac4284b3952eaf4155fcc8ed18539149cdf755ecd473276a8b40d2625bd1da57d929608fda83c2593843369c94817afed16a853aed03004afc2ed5e3a0d33ada2bd04589f713a34368bd43e7516cd4b641aaef3fd6a793fdf9150e6db9b0a68fbb2fb9262c2411cb7dfd49253bdc8f767a954e34195a3d44068060dc7e284cdcba5dbed6ad1cdecf2e2429537e6037e9c58464be16482dde706a5753037610d0bb377e2974cbc924543b430bd207894ce05e0f10d73ae9dd8e817afed085226b1ac7abc2ecae5fb08cdb8f33f5a736015c47972ca63ac9e9d22ea0a40d7386c397a141e105eff14c201604aef25ade8497ecdc216cc2f219fcd77128c555950b9416da9761e6ae2fe49d62dd40eb323dfd29d0a35678eec346ebb9c1fbaea62830b4d838b5ce731f5211d4e7928bc763ff6ae354cb5ab6df27b7d13ad1d8c9839afe270d5ea17f95b11b5553e4d89475201beef8fed1428ca5a068a591515ffb8ba9d6a6f81fb2c60928f25a7ac6a1f9168c65175d17464b4a4ddcdee45a7f8c7a24a8131472359ae73e9ae46623b68eaf5b8d1278605de5567d30425e26d8b7c00de1c95ce648dfa0c3242330197571b67304157b8a78ba9ce776b0147042ce4bc958f5d7d584fb9306bd67f47088421089c01094201813bc2ad01e39c926c7701b78ab5807bf9c45f205f3cc1ec2b90a68c86a612df68abd66711a6c19d00461d6c4532023fae4128fc5e0a87a23a821a2319efd398b57279c53d2845d37302d9b9ece124ab3e16467dc2b79d3ab27f79c1b4b0daa4b7cdd0336fabb22a8c51dabf5f2040307bd4669f10b9d728ce5bd98230970c33c534ec4591874559a40b7b4df84279e1298897e8d7109229b2df2d186bb2a2f8a4e16db9b4e2c552e8b12871c3f9b2f707e8e80da61605f4950e6ff5f851624cd21c9cd123bb7910dd26ef4e574361ba3b6a2aa6491bf22ed2a62bf4db860e0d441f4bf20dde3d6a930a17f9930398d45f6a7d61ca29ca3e6cd5399fd724015298b7c03d32b80314d329fdf507d3d72ff3647d58e4e8e61b2fc4be4c99ef385e63ff6ad450969dcff8df078923d262a524ab5f0724311f566c05260f79b8e1a0189659d7ea675cae53e7fcd652e3d5cfa0822a6d04979ba5e9387b4c84508dc249600151bd9aef09732d9397d113afee66b92d1a2394589a740b1e9dd62b4f61cf494c782b651228e210c983f84f01ee310e0a191aa03a683976a985835fd065169844330892faf5adbe2cb0a4c899d3eec6febc33dd9f3b91df5f5ebe78a51fe98266fbbbc4a29e2e44f0e0cae3685ca7e4d1f2107145c063dfe5dfdd455789849570b4005e30f2e78c4496635d823b6ed7af709aba495cfbfcd1696e6578fc8904484b4f10d0c2050e20bad11f475a010ba16f8495f46cffc9e2cf1d8dd8b6845b38817dc75571982fa2dbe16753c5586f31ad08512df5eb5f0f49e0dc7aed4ef322ca096b364b3a289bb56df711305948012f56316fe0cf5c83fee095e5570a632f2c50a029081debf0060205cb8686a881608e7f871a9a1aba193de4f218993d203ec1e53259e1927764cfd86afea3f845ab83b3084caafc33e273cce7b760abd348425f73ae6b13309566a70b0e7c5c1507eba5ccad74277fe1607e6c51a1bef96e68e5082c8d6c9fbe7efea920f44f2176b592ec71fa08c72178d6172d909329627955cae9ccde2cdd21572681111b7d48c59288e3d114a4af480655261cdc9064535f0d320e246d9462205c7fe57111ee61550466d17503190c346b1a769dddc42afda6d193ef173a137e471320ae02819c70f62817c3247e61f07598e4a4623f8b45bcc1000359a34d78b1d958cc54edf3d4aaa22074c872da6e4aaae81a8633e85a45420acd528ad2b7c4d9bb88bc141436bb59cddc3789f53a632f86f17cd1f62c4e7ff9a2a3ddeba08917c3f9454570e03b9e5f07a2f11db0788294fccf2f12e0615b33a6d386c6489b873a8b18d8dfde055de6e75fb4e5f469546f7daed2a1daae40db07bf51f4106cd20bced91d02c17f7d37ab0975e9ce60796a41c84ddcc7bace81c48bc07079c5493c9bac4402b4be04607563b03df2bc3d19564f85dac08836a1fec54877e2da44ec1b99c341f29b9e116d822b0d074045024c6ccdb304f433aac255cefc759012fe4890ed3570be09b078cff57f6b08cca8916302dfcd62ddb45b5988dbe42be36f9414fdf9d5a2b7bdd16cc708c5753adda017a4fdc497afb0402e999122c94bb589890ac9dcc6450ced9c6f17aa6e4935f3093adb6aa8538970b719f049ffbc9fb79e842324223ade09eb83b9658dd80be6c44fb0a62c76c7fabd0fe92ee0d2ca952c256081"}}}}, &(0x7f0000002640)={0xfff7fbffffffffff, 0x4, [0x0, 0x0, 0x84c]}) 22:55:55 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x4400], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:55:55 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000000)=r0, 0x4) r2 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vsock\x00', 0x101000, 0x0) setsockopt$inet_udp_encap(r2, 0x11, 0x64, &(0x7f0000000080)=0x4, 0x4) [ 805.543224] binder: 1875:1900 BC_FREE_BUFFER u0000000000000000 no match [ 805.586152] binder: 1875:1900 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 805.593313] binder: 1875:1900 got reply transaction with no transaction stack [ 805.600981] binder: 1875:1900 transaction failed 29201/-71, size 0-8 line 2759 [ 805.743363] binder: undelivered TRANSACTION_ERROR: 29201 [ 805.748978] binder: undelivered TRANSACTION_ERROR: 29201 22:55:57 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) read(r1, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(r0, 0x540e, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(0x0, 0x1000000000016) 22:55:57 executing program 4: socketpair$inet(0x1e, 0x1, 0x0, &(0x7f0000000080)={0x0, 0x0}) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f00000001c0)="98340e138893c378df973e5779242cb908267b8f4c7de2ac1a086e57520bef2dc3459f5a671d63ac002402e38ddfce6f186d1bce9c301db4442d0f1b5e5038dde78faca4827a17e50ee5457984ea0d2b45a0214bdddec786feb5b8ae14615ade9cbf5b3d5d8ef738fd1b8c476d6f49c569beea1871fd4b7a2e8e5c040c92ae2c0e96008b68966094893f50f698b88611e08271eee020b2f4292b255bc8adb5056b89889299ba655f5e1ed46851c4acdfa3333e4aaad561bf3c8c813aa18f68269bc9719b61629355bc45ae5fc2ceb0d1a76bc94e4bae88f54f3b33268534c9ed57", 0x206}, {&(0x7f0000000040)="f2"}, {&(0x7f0000000400)="63d9cd8b3b51f6447b51d08cc1034ebea4dbac8b2831dc16e6c925b3936d7479918b5c90525adf1c24f232176018172d52a08f5034a991b1c8bb0cf12b47533ee4ceb34fbfead18cbb8ae369b73a7c8b9a03e95f3b5cc3476fcae8081ee2457407bd100fcfac6947003baf029d597976ac15941be3c69560fc8c086493d9c589141f4f1da09fcc4e3e26d9e5e0ab6218141530e9c2c9f209a83c0d7d9bb1b0a14f5b89a28c05a41ad36327f0ceb07dfd308e1e90976ea5107e234b977119d31c9912d66060dc0e25c7e29ff6d6cb89d40eeafce0c92fa8c5aa49b375de0b3b7e23a05093f2"}], 0x557, &(0x7f0000000180)}, 0x200000000) recvmmsg(r1, &(0x7f00000020c0)=[{{&(0x7f0000000380)=@ax25, 0x80, &(0x7f0000000180)=[{&(0x7f0000000500)=""/242, 0xf2}], 0x1}}, {{&(0x7f00000009c0)=@pppol2tpv3={0x0, 0x0, {0x0, 0xffffffffffffffff, {0x0, 0x0, @rand_addr}}}, 0x80, &(0x7f0000001cc0)=[{&(0x7f0000000cc0)=""/4096, 0x1000}], 0x1, &(0x7f0000001d00)=""/97, 0x61}}, {{&(0x7f0000001d80)=@l2, 0x80, &(0x7f0000002040), 0x0, &(0x7f0000002080)}}], 0x3, 0x0, &(0x7f00000021c0)={0x77359400}) 22:55:57 executing program 7: syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)) r0 = memfd_create(&(0x7f0000000000)=']vboxnet0}keyringem0!keyringtrusted\'::\x00', 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r0, 0x28, 0x0, &(0x7f0000000040)=0x1ff, 0x8) 22:55:57 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x800000000000000}) 22:55:57 executing program 6: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="025cc83d6d345f8f760070") mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000e4c000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000043fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000000c0)={0xaa}) r3 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cuse\x00', 0x406200, 0x0) write$fuse(r3, &(0x7f0000000040)={0x28, 0x0, 0x0, @fuse_notify_inval_inode_out={0xfff, 0x5, 0x800}}, 0x28) r4 = dup(r2) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000004000)=0x1000, 0x4) ioctl$UFFDIO_COPY(r4, 0xc028aa03, &(0x7f0000003ff0)={&(0x7f0000011000/0x3000)=nil, 0x20014000}) 22:55:57 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x3c000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:55:57 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x500, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) 22:55:57 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000000)=r0, 0x4) r2 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vsock\x00', 0x101000, 0x0) setsockopt$inet_udp_encap(r2, 0x11, 0x64, &(0x7f0000000080)=0x4, 0x4) [ 806.823044] binder: 1926:1935 BC_FREE_BUFFER u0000000000000000 no match [ 806.856683] binder: 1926:1935 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 806.863814] binder: 1926:1935 got reply transaction with no transaction stack 22:55:57 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000000)=r0, 0x4) r2 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vsock\x00', 0x101000, 0x0) setsockopt$inet_udp_encap(r2, 0x11, 0x64, &(0x7f0000000080)=0x4, 0x4) 22:55:57 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x89ffffff], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:55:57 executing program 6: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000003b00)={&(0x7f0000000080)={0x10}, 0xc, &(0x7f0000003ac0)={&(0x7f00000002c0)=ANY=[@ANYBLOB='(\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\x00\x00\x00\x00'], 0x28}, 0x1}, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x4000, 0x0) ioctl$KVM_SET_ONE_REG(r1, 0x4010aeac, &(0x7f0000000040)={0x400000, 0x100000000}) 22:55:57 executing program 7: r0 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xfffffffffffffffb, 0x101000) ioctl$VT_RESIZEX(r0, 0x560a, &(0x7f0000000040)={0x2, 0x7, 0x0, 0x6, 0x3, 0x66}) r1 = request_key(&(0x7f0000000140)='id_resolver\x00', &(0x7f0000000180)={0x73, 0x79, 0x7a, 0x0}, &(0x7f00000001c0)='/dev/snd/pcmC#D#c\x00', 0xfffffffffffffffa) r2 = add_key(&(0x7f0000000200)='syzkaller\x00', &(0x7f0000000240)={0x73, 0x79, 0x7a, 0x0}, &(0x7f0000000280)="cbfe0941776be0855b2ea77ecca03462b4ff805fe29c1ee101e179c2d468a0a7efebfe720c9dbffeec0055707d7b3ed47a68b2a12d89c7d660ff40dfff2c6240470b9e3c6e4727e06bb10de8c3cca8d449107645f1bdc19c71b64801fe15dae849041c71d33734b73e4adb048cc228c855d4142616cf8a3093765e719fe91a6ef7b3c73154476a5cdfbd516cadbd0104b9004b8d92e209e3057037acb5e91d9e5131b7a283836875f86358c3395af8a5191e5f5774d729aa47a718bc427ded35d52a7b83", 0xc4, 0xfffffffffffffffd) r3 = signalfd4(r0, &(0x7f00000004c0)={0x7fff}, 0x8, 0x80800) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000001c00)={'team0\x00', 0x0}) bpf$PROG_LOAD(0x5, &(0x7f0000001c40)={0xd, 0x5, &(0x7f0000000500)=ANY=[@ANYBLOB="180003000000000000a5093600e4dae3427c34cd72d85d571affffffff00000000000000460d482869527fb4633283c5847e51603b28f4644c0710138efb84cfbd243fa1a02711c3fb097d085170de5cf6071d73ce5b79e81a42cd500d1636fdd3a72330aee654f7faf68769229f2b63029e9f21f4e04b66b8e06821f1c3de8b2cc8089f9813d0a3b50e813c83afaac8c5dfad18bea60f7f97b2113d69a67bc87c6df39e2be1bd40be343387f2bf40e5e745b992"], &(0x7f00000003c0)='GPL\x00', 0x6, 0xba, &(0x7f0000000400)=""/186, 0x41f00, 0x1, [], r4, 0x7}, 0x48) keyctl$unlink(0x9, r1, r2) syz_emit_ethernet(0x1, &(0x7f0000000080)=ANY=[@ANYPTR=&(0x7f0000000740)=ANY=[@ANYRES16=r3, @ANYPTR=&(0x7f00000005c0)=ANY=[], @ANYRES32=r1, @ANYPTR=&(0x7f0000000600)=ANY=[@ANYRES64=r3, @ANYBLOB="459557f18ba611763b41fc8de22362d6d5c3438ad8e9c80de68de5415fd7640db9f86a3b928ffdd3a67754f9c535cc88b246a01f18e3e4159d1ef62e53e3781d934ccef4c4f060300b5b93d59ddc09233650eb8f3778629093c6323d06d0e041c6883751acc8bad76d2f0d814b3bb06eed5c76715942aa952c7101e06114aa38549c213bd326cf5011c5897468ca59b4ea087c4dab313d045509310fe3a4234f297bfc72250d87675de447897d2c185198db0f250fceddced9fd5ffab2839faa355d83a2c2bd5c0cf23cd097f96d77f883876681b755df77873dc285fe4d52312bd316722e7b994a966259913354af6b60", @ANYRES64=r2], @ANYRES32=r2, @ANYRES32, @ANYRES16=r0, @ANYPTR, @ANYPTR, @ANYBLOB="a5e1ffc21effc2fcfa98f931cc174e306de0d5e2f3b94863e2c468bb423b2941e2f5b458bbaad63732c185158b396c8fa00b5710b68d4987f393d58a7e45328b9e75d8e66086c9ea3afa1d24d3d8b164cacc99fdd638474f8c20b58a98eafd360f09231821de46e00462f1a4815dc1ad95bbb0ac414ebe130dc50858e88237ab124c10e9e0ccbb7f2fb1754ceb8634a7fb507004f4dea2e63ba7c778c35bf35aa657d5bd95416669a8cd7adc389a1a72d46e6df8d68402fbd576d77daf4c2092d9d75605b06a90df96b253d152fd3ba6774fbf8cddae2f6a4a9fa6b714680c4cda6d0fa7e42529b054d0cbf50a537ae1522aff834b5511e0dc3369bcb49f53da851b94348aa1bed8d14325e5139af3451558f23c2cc57b8b78678c985dadd58eeea1135cd4b3fa2d4b277efabd8164e77a8238b0cc10dfedcd622850b20b1ae2ad2645eb21dbf7377ac28ee4cdd078e8f258c113043b5bbb2fd0520eb079ea27a00bc926e0f99a1e2450643f6382b30b1c9cee6577f843549afccc2c37115b94530d0fa972761b47c553652870cc664d4931433e3dc345d8137b7f6910dbe664b357e345a2d1e8c51d8c9357b03cbd84ed6d8913c36521a72f3105cc880055f2e0047bee44113570e931ec49d6f1f7b6be4ad93666c415c83432d38ea478cd8cb73cd834f5a707e455521bf36246a510a2e49f1e8a884879dad0cc3d1b18dae13f36728901776d6378b8428ecb827c21b3827a8ee70d41680d2ec6c7a8d1f6003852288a36993c730e00ce0e50b28d4d162c63985b21052b591f3ef129381bae7ddcdbcae321c04a4dea7db4d3e9db27f4a62c37fe31e75bae481782c8934e1ecaf21ae013c638565429021e26feaa570875eebce0285d7ce38d0ba67b8dc49501d1f5aa0f4d3075151f125766a3a1fba0ab1dc637bcfe0eda9bdee46da35805c22117a3c406ad80d330a05342c140b1304c54b97dea2175e5d2172b41ae72cd8e1086aaf10a46260a20d587294aaeeaad90b1bd3d02244235f189d5cb0e9d0902ce34b90322444579a97ebe15d820c8dc2741cd13978e438b1ccbdf4f56a04c6778a2345ff1f2f04754ac05d7368aaf50ac2e480e037342da5035f1daec1456f90a882bf977ecd71a600019c4e3776d4ff7df063966048713b5b7e3765cff68ba25d448be85d25afb24144844a31a6dd97d60271ff5019d7eb6a6325326c3604288dbb6d9bc09b89ed32d2b1cbcd96476bc2f47a58e52b1bde0c15fccfc8d99f81cd2c26fda56a8a46188c928df743e173981c1bbee3bfdd73e70c46380854e22e6963fa22ff379d1697fabb4e68b4a5d84351bdf20c2dc50253f50cc2ce9e0bdf97335b2170946c54a127aaef4ba8f6a7c75fda3355fe023d74d0d9984df01f8bd3a23345849ea969b19faa2315be63b460d717c48fa57c0f9128f9afb3dd31fbf6de39ffb5dabcf1f737c1b0dda8db9f08b6599819921224d2034062c286bb3cc9b725943745c74c69a0be3d2a2d3a1d340efef0e3f2109eeefa492916f2fa9282cd4ad404a59d92fa919291b6ca14c5a445ed107ffac2ac86130611e8459a34c06629f8d597a55c14572b4d04877e3bd17c2c31a2517e7659ad6fd13bd11b69f4765e0e20261b18bee11125a49a4c55cb52ee47506afc7e252b101438ef11bf30464e27b3989e855f343ad3ea87af54e1e9471898aa1c1e9ec483e0205563d786448e2177616055244664f7784f155abb6545d0f94edd3d1f08e07728abb606027854bd4aa7500352eb4b03a807fad158471df32672486747f879dfa371d0752e9d17829c9cd88614c5550daad6d207478eacec170437de74bb42a8eda689e3f9b7c70e0a8a342f7d54a7eb417d5fb6489d9757e86aa4efd9c651a80dca5a1d58c44113453b9ca88ac047db25a4c57ebf63f6b3c83d675a50ef870ca67d31aee8ea34fc3f84700d6ce3966ebced406d295156612d033cb8bb21f5ec92742816be81039b0f24077e77f5fb974800d0995a580cce5691516686e656d11c204ca99a473b3b6cf02d3dc2b97541bb0686f7c1b235ae419b8408f874769719eeb03d005f7517a422875ef14080518667c136cbf0ad634c833f7c7b21163dc107c0d286e252eb4b8384e5b9a186d7bb1a2f4e121e27486d282b370fa91353689a266435526a0d2ac388d0520346e294494a13d6ec9f23a0619f3c7b219823aba6a6793a92b01d807368d9061f9a9e41e45e5143d3eb1cfc1cb7a90046ecf5eb60f923588bd32bf691d4568f83e97756617ebaf47098d0c8b14b3dd174600ba86790bc4cf963bc9e753f5e9212a054b5721c3a5542825e8e51a94210bd4668e5781a0a145ef58da6f44fa659796f1019dc815c25bd81f79d2fc2e678c11f129a32a35356a53c1163e4344c0829880d9b30e5f0ef8767ab262facb350c8cb6d87554b476debab1b35f6e7985013c17b2e881a91a93c9127791298e10c5111cc2291d1b5ad1a0ecd99579bfe5d8c46bac80d6d9c256529a3563801ba10d9b5bfc6dcc96f846045dad10bad8a6b3a7d0deb07ef184d8c6b02a746d217a4e5f36737f820d068550e168500c6b382e0191062c10161ee8073b95c5db077d1e696b339f7fa50c9988125c44c101a944b5a850de632516a767f099e3ef92c5ef9639ce936e6ad580bf3356da147600326820ad28a6ee84ae9d57ab0c653b409e4cb8e0b4f6605f22c509ce8b2811696c8a887e6352e62a7bbb6dde84bd4196cbb116cda63e9ea1066d0c72339c84da6c0ac34b75fa162c74d68f45edb4e853b8f262e7adcdfdedb2483a72fa63d0996e727884ad7b274a8b44cd81e72af92ca560053ef46aed922acd7904b709110d6f7f869dcf32b3c1da9e8555eeace22e4a46d62db14a707e3609086a38365c463861b70c65dd48b11ca1e9776650495fed1d186ec9b34ff67b2940f253e95d368253779df093eecd105c85a99c47d31d4991dea1833a38844416bbf4ce1437a1968ce51cd69461c7ee0d0fe5dff831fb3b7aeb32f244a67a3d483a9cd171f5b2f95ebf7e6335abd89e73f9396fcedc2819b5a3db18903a97b0b0755fe199f69d3a4730d6259a0a9e9dd495ca9906b816d83ce83e8ef6886ee7ad7ad7fcca263ad562267ce591ede5aa94799887e6799c216cc549c581bee5c2af9f7798e39d0a7dbe3eba0870735216d8311f8c8e85dc6dd400cf054e1d6d39e31f3cc5e19090c29761a307092d486a49464c00e5709d1e61a929c705671d149cb5c498336c64c6cb1f8a3c105868f4b0bc6a64036c69d3ef3a2c601a53276bcd5548e5dfd54a9b05d001f073cde3bf8da0d21ce2fa22479f15a0bb0cedc06dfc351a235c2dace2b43e5f775cfd8fd6de4c1e74e9b6443df28952e96c8da8cb4cbb1f9fb79fe5a20b589cb1e4c87e40ee72ae0af3eb431130d23f00713b31297fdc4a46db060a2aaabbcfeb2fae229fec453b3ae9171406a57bd055caa6a426b031da8b9baffdcc808cc6a2b30d30d5d8465ec68e9016d00e31b9eb4f676ea5ddea54acfde6ac05421aedf0b3066d83195bacddd4243b56359ff2b069cf95171fa6bd489ef8f167f5526422eb789828a7c2a4fa07785b41d86507e2a5ab34b577bc79e884c0dca8e2ac1e24de31dcf4a4e1a2788187245728b2cc5839fe0ab02f22b7cd359cdadb4c73e7a88864df6b394f3c73df0b7aaba144c46cdd05f8b0399158dc2df06aa1ce3ce5d36ecdc85ef35224c6058a78f2b8e2efa9e7da3399df498455d130eea5f5feee2f321daa49b5c3216fe8178d03bb7a214f01da44a881e1c69867296e9689cec2d2ee3e4b8dae2979911af9509b084c3f0924b3f3395ae0134f718baea0ebc25165b69195b2369510d2bd96ea77b8b37f0b482e4b78107518cfbb408a74908d95ee962706e29e175a2289260062a81d337e2b4bb61df9783d45d3715e83870cc48cbb076d69ace940c300b5d02d4f34e05bab5a6046a27ebe6e20414ebe68554a99d08a56c82f0f44606221e2496d2c72a0e3c3f38c931b7a86168b04e395e2bb3dcb8b14e2e14faf4653120aafdc1b7835c6f59dc38a75141d0370cd110c444bce99266f41f785923e4dcb0ecb4af704ea3a8ce26413b7ea58326a504312421e000250cfe35649ad88c13a04dedf225f08835989789efea9014533b292d3bd6a951de499d14954fda99289710dac2989cfc0aeab48c3c94cd5bfc6db05da68c39b06b38ad1867954fd05b5c8a0293eacbef35e5de26e5535c871a339f5d0546463d3c76e39ebbe7f0cbbff52bb47cf8d0629c85185bee95e35299350ab1e7809622d4deaa26334b3265de77704fe58628f33602e1e9a8675db72fe8151b916d69468db2f388c00444dff36115df0214099003e2f34b383bc41470f2624635b1d26a651460de740f84eaa52e23a828892240d60a334899e974d3e4479ff02413e64ae5f1d44852e701b965fb2a6761426f179cedce6fe716d17fe2a73f178691ce21c17818645b6306bdf57c178f6de9b58fe0d01fe060d17e3249c165051c7cbe76c62c5c2c7db71890cc0de54d7982a489a1695d363a2302b99fc2b3f4a92fdf89c890c9f9ae790525f37b994e7c911ab76394c691b0ace252ef45abe9f186ededc9da812a68fc51ddffea6f56ff2a4663d1770f01ab157e7352995db8a0aa27b44755500af377b782f792f59f75d812d1520874583778324b20b8863c650bd1921c91264b4ab5932715c76390538211fc2b35340ada5d0008d8aaba1ea8510d7c10620ce4c0da645684771cf4296d948715d6e3f862585ccbf08d6694647154e2c7bca4f1dc96298020f72c834e39ceabe0ea5c0c3449d915ce41d1afcc1adf67ccf960bf642d1d038e173e11dea0a00a50fa315a2c03c47f7e33b575bb11c66e313f0e24db5536af52e4bf26ccafd91dc0a255038dbf975f9dad2eb992366c46e09588c58f5e07df7a8c876374e7c37857eed20578540c3bcb07bcbd705ca14fb451da2b3c892906032d23ae0ff20f1386515471150900b5192917ab2da87c24ad7e9ba44185be971a737420514d9622af0be19cafc0c3a3f0b7e09c1bbf988e19ff20dbed87489d97bacb2a1730fb0787eac81bae973cbd5ab52468d699cf5e731ed3efe2db18bffdf45f271778c3a9f128cdfb8aa43cfd9b9f390474bf807955c00d173394ce3b3370cd5c1a9d648ae5a9a65d692a4d49683612bdf0b7705c5ee4631c107919dc86e410e3c3d5aae35ab04498fb28418e05f05d73c3b10b051ec1d8b559a0ee69ad91ebde0eed62ac786477981e40292af6e2e4d33aa2fabf0fa4fab7fa9f78fd4ac8149ffbf14df924af056fdc60cdfa76a9940df5430994e060533d688f11f1b7e2971aa725dc822fc4323afcbabb72c76822302abe68d54fd28dd2282d99dcb2fe66812dd2221d8dfaa4d5c7543f4e69ce781d4020c75eb369059015a4e6c72f8a065d3d3676fc22d090d178dfea27d34394bca0f51eb4d20915210800753c97ba0c23832cfd90d572207f05514e7b595bacffc13f3d1aff5133c16332372490813ebedc9790e281da18349f75efeef3c9ad3257fc2f712c1bf4e102fc516310dbd6664012a3ab9192ef4d791081f2773102b934c141cb5567a505736f7ec60512e486e1683820ec02ba4b0db66cdef70436504f53c02a592d66543e37c04a121376331d094edba95ba12f01d3b5474f2c67d0aadb690af2956e698cf9645c01b4bb72be955d6a9f21ba7f312cfe80256d68422c6d941dc12df90d80335a1e67869eeeeff3dc398"]], &(0x7f0000001780)={0x0, 0x2}) [ 806.871201] binder: 1926:1935 transaction failed 29201/-71, size 0-8 line 2759 22:55:57 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x30000000}) 22:55:57 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x2900], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:55:57 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000000)=r0, 0x4) r2 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vsock\x00', 0x101000, 0x0) setsockopt$inet_udp_encap(r2, 0x11, 0x64, &(0x7f0000000080)=0x4, 0x4) 22:55:57 executing program 7: syz_emit_ethernet(0x1, &(0x7f0000001340)=ANY=[@ANYRES32], &(0x7f0000001380)={0x0, 0x0, [0xf2f, 0x0, 0x0, 0x3]}) r0 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x30000000, 0x40000) ioctl$TIOCLINUX7(r0, 0x541c, &(0x7f0000000040)={0x7, 0x1}) [ 807.006950] binder: 1926:1961 BC_FREE_BUFFER u0000000000000000 no match [ 807.079580] binder: 1926:1961 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 807.086751] binder: 1926:1961 got reply transaction with no transaction stack [ 807.094124] binder: 1926:1961 transaction failed 29201/-71, size 0-8 line 2759 [ 807.160740] binder: undelivered TRANSACTION_ERROR: 29201 [ 807.166408] binder: undelivered TRANSACTION_ERROR: 29201 22:55:58 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) read(r1, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(r0, 0x540e, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(0x0, 0x1000000000016) 22:55:58 executing program 6: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect(r0, &(0x7f0000002000)=@ethernet, 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000006000)={'vcan0\x00', 0x0}) ioperm(0xffffffff, 0xfffffffffffffffd, 0x9) sendmsg$can_bcm(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x1d, r1}, 0x10, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="01000000000000000000000000000000", @ANYRES64=0x0, @ANYRES64=0x7530, @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYBLOB="000000800100000000001000000000002b56ec1a9deb1448"], 0x48}, 0x1}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000000)={&(0x7f0000004000)={0x1d, r1}, 0x10, &(0x7f0000002ff0)={&(0x7f000000afb8)={0x1, 0x0, 0x0, {}, {}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "8e07000b0001abab"}}, 0x48}, 0x1}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000011000)={&(0x7f0000010ff0)={0x1d}, 0x10, &(0x7f000000eff0)={&(0x7f0000012f80)={0x2, 0xfffffffffffffffc, 0x0, {0x0, 0x2710}, {0x77359400}, {}, 0x1, @canfd={{}, 0x0, 0x0, 0x0, 0x0, "68759a67d8602d3e4b207446a705148d03f1f86e60b22a6ec7e5b35afc19cd0ed506fb9cdba948697c01f3ec6bc0f8f98290b0198d30bde485753f80c203fe81"}}, 0x80}, 0x1}, 0x0) 22:55:58 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x8dffffff], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:55:58 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x300000000000000}) 22:55:58 executing program 7: syz_emit_ethernet(0x3e, &(0x7f0000000180)=ANY=[@ANYBLOB="0180c2000000000000ffffffff2100907800000000450000030000000000000000ac14ffbbe000000162f8f9e66266567ad1ca65411b9d3226df1bac3b507f0925ec924997a08e9988d9864967b999f9f6fda32166df06e9c43a35c1f95d9947f1fe45101fd7dbd37ffa985eb2258b0786c4f4df7a06f2b76689ce0238797bdc45c4a425587a87c6061a3d175ba23ebfd85c6f948a7d82a4ef4b32ec0329af537b99e1496cccaadb2394a1bf57de5317974a7ae1511b0e732b807891c55848c9c8438c56af6a10bf99db8d1330778e3edac2227e0fa3ad4a5975a556b9d4ff81a70aff602a0b1aeccab80e20ceb08e90157ac1614cad27287f6b986463eced9754bed0f3eac2377331e93a3c180f2b5a36554a6b0962541debe600fd3206595a251978850ed208c89f4b442e3eac873ef338942b49292696619b27ade2bdec0c01e765804159d9a6ec125f22afadfee7ca7abf30a7b355c9e4130a63e0bb60a17e5524bceb682045e2242814"], &(0x7f0000ea3000)) 22:55:58 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000000)=r0, 0x4) openat$vsock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vsock\x00', 0x101000, 0x0) 22:55:58 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7400, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) 22:55:58 executing program 4: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="0047fc2f07d82c99240970") r1 = socket$inet6_sctp(0xa, 0x200000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r1, 0x84, 0x6e, &(0x7f0000961000)=[@in6={0xa, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff}, 0x4}], 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f0000000040)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r1, 0x84, 0x73, &(0x7f0000000240)={r2, @in6={{0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}}}}, &(0x7f0000000300)=0xffffffaf) [ 807.863489] binder: 1990:1997 BC_FREE_BUFFER u0000000000000000 no match 22:55:58 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x300], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:55:58 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000000)=r0, 0x4) 22:55:58 executing program 7: r0 = syz_open_dev$vcsn(&(0x7f0000000240)='/dev/vcs#\x00', 0xffffffff, 0x2441c0) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000280)={{{@in6=@loopback, @in=@loopback}}, {{@in6}, 0x0, @in=@rand_addr}}, &(0x7f0000000380)=0xe8) r1 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x4c3b, 0x1403e) ioctl$SG_SET_RESERVED_SIZE(r1, 0x2275, &(0x7f0000000080)=0x2) ioctl$SNDRV_RAWMIDI_IOCTL_DROP(r1, 0x40045730, &(0x7f0000000040)=0xe9) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)=ANY=[@ANYBLOB="0180c2000000aaaaaaaaaa000800450067907800000000ffffffff2100905b0f000000450000030000000000000000ac14ffbbe0000001"], &(0x7f0000ea3000)) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(r1, 0x80045700, &(0x7f0000000200)) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f00000000c0)={{{@in6=@mcast1, @in=@rand_addr}}, {{@in6=@local}, 0x0, @in=@remote}}, &(0x7f00000001c0)=0xe8) 22:55:58 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0xe000}) [ 807.903787] binder: 1990:1997 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 807.910919] binder: 1990:1997 got reply transaction with no transaction stack [ 807.918325] binder: 1990:1997 transaction failed 29201/-71, size 0-8 line 2759 22:55:58 executing program 6: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f000001a000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x5d, &(0x7f0000000040)=[@vmwrite={0x8, 0x0, 0x7, 0x0, 0x0, 0x0, 0x2, 0x0, 0x3}], 0x1) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000340)='/dev/vga_arbiter\x00', 0x204000, 0x0) setsockopt$inet6_tcp_TLS_RX(r3, 0x6, 0x2, &(0x7f00000004c0)={0x303, 0x33}, 0x4) ioctl$KVM_RUN(r2, 0xae80, 0x0) 22:55:58 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x700], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:55:58 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, &(0x7f0000000000)=r0, 0x4) 22:55:58 executing program 7: r0 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x9, 0x200800) ioctl$BLKIOMIN(r0, 0x1278, &(0x7f0000000040)) ioctl$BLKSECDISCARD(r0, 0x127d, &(0x7f0000000080)=0x1) [ 808.034305] binder: 1990:2022 BC_FREE_BUFFER u0000000000000000 no match [ 808.058207] binder: 1990:2022 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 808.065351] binder: 1990:2022 got reply transaction with no transaction stack [ 808.072743] binder: 1990:2022 transaction failed 29201/-71, size 0-8 line 2759 [ 808.166915] binder: undelivered TRANSACTION_ERROR: 29201 [ 808.172550] binder: undelivered TRANSACTION_ERROR: 29201 [ 808.775287] syz-executor4 (1999) used greatest stack depth: 13096 bytes left 22:55:59 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) read(r1, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(r0, 0x540e, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(0x0, 0x1000000000016) 22:55:59 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x3000}) 22:55:59 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) 22:55:59 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x700000000000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:55:59 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, &(0x7f0000000000)=r0, 0x4) 22:55:59 executing program 7: syz_emit_ethernet(0x3e, &(0x7f0000000000)=ANY=[@ANYBLOB="0180c2000000aaaaaaaaaa00080045000030000000000067907800000000ffffffff2100907800000000450000030000000000000000ac14ffbbe0000001d60968e24341530cf8f85cb5937826714ec1c1b02f87538c0114aca6df480f9d5f9ae9683f53b848225cd30b714a3ca3b73822a827f71fe4e3d3b27c7ba3e5ecb88cc706a320e9f4fb8d"], &(0x7f0000ea3000)) 22:55:59 executing program 6: r0 = socket$unix(0x1, 0x1, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x22, &(0x7f000018effc)=0x1c, 0x4) bind$unix(r1, &(0x7f0000003000)=@file={0x1, "e91f7189591e9233614b00"}, 0xc) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f760070") listen(r0, 0x4) connect$unix(r0, &(0x7f000066fff4)=@file={0x1, "e91f7189591e9233614b00"}, 0xc) accept4$unix(r1, &(0x7f000046f000)=@abs, &(0x7f0000937000)=0x8, 0x0) 22:55:59 executing program 4: r0 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x4, 0x80000) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX(r0, 0x84, 0x6e, &(0x7f0000000040)=[@in6={0xa, 0x4e20, 0x7, @ipv4={[], [0xff, 0xff]}, 0x10001}, @in6={0xa, 0x4e22, 0x8, @mcast1={0xff, 0x1, [], 0x1}, 0x5}], 0x38) r1 = socket(0x4, 0x1, 0xfffffffffffffffe) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f00000001c0)=@broute={'broute\x00', 0x20, 0x2, 0x670, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200007c0], 0x0, &(0x7f0000000080), &(0x7f00000007c0)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x1, 0x0, 0x0, 'veth0_to_team\x00', 'ipddp0\x00', 'bridge_slave_0\x00', "7465616d5f73ff5e76655f30004000", @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], @link_local={0x1, 0x80, 0xc2}, [], 0x130, 0x2a8, 0x2d8, [@stp={'stp\x00', 0x48, {{0x0, {0x0, 0x0, 0x0, @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0x0, 0x0, 0x0, 0x0, @link_local={0x1, 0x80, 0xc2}}, 0x100}}}, @helper={'helper\x00', 0x28, {{0x0, 'H.245\x00'}}}]}, [@common=@RATEEST={'RATEEST\x00', 0x20, {{'syz0\x00'}}}, @common=@SECMARK={'SECMARK\x00', 0x108, {{0x0, 0x0, 'system_u:object_r:usb_device_t:s0\x00'}}}]}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'bond_slave_0\x00', 'veth1_to_bridge\x00', 'syz_tun\x00', 'eql\x00', @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], 0xa8, 0x1d8, 0x308, [@mac={'mac\x00', 0x10}]}, [@common=@SECMARK={'SECMARK\x00', 0x108, {{0x0, 0x0, 'system_u:object_r:var_spool_t:s0\x00'}}}]}, @common=@SECMARK={'SECMARK\x00', 0x108, {{0x0, 0x0, 'system_u:object_r:bsdpty_device_t:s0\x00'}}}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffc}]}, 0x6e8) 22:55:59 executing program 6: r0 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vhost-vsock\x00', 0x2, 0x0) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$VHOST_SET_VRING_BASE(r1, 0xaf01, &(0x7f0000000000)) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r2, 0xc0bc5310, &(0x7f0000000340)) ioctl$sock_FIOGETOWN(r2, 0x8903, &(0x7f00000000c0)=0x0) perf_event_open(&(0x7f0000000040)={0x5, 0x70, 0x100000000, 0x0, 0x7, 0x5, 0x0, 0xffff, 0x80400, 0x1, 0x5, 0x6, 0x8000, 0x799, 0x9, 0x7, 0x7, 0x6, 0x3, 0x4, 0xfffffffffffffe01, 0xf2, 0x7fffffff, 0x8, 0x8, 0xc19, 0x8, 0x76c, 0xe4, 0x0, 0x6, 0x8, 0xffffffff80000001, 0x4, 0xef, 0x8, 0x7, 0x7fff, 0x0, 0x7, 0x0, @perf_config_ext={0x4, 0x9}, 0x200, 0x80000000, 0xff, 0x5, 0x9, 0x4, 0x3}, r3, 0x9, r0, 0x8) 22:55:59 executing program 7: syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x0, 0x2]}) r0 = accept$inet6(0xffffffffffffff9c, &(0x7f0000000000)={0x0, 0x0, 0x0, @mcast1}, &(0x7f0000000040)=0x1c) getsockopt$IP_VS_SO_GET_INFO(r0, 0x0, 0x481, &(0x7f0000000080), &(0x7f00000000c0)=0xc) [ 808.930920] binder: 2063:2066 BC_FREE_BUFFER u0000000000000000 no match 22:55:59 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x700000000000000}) 22:55:59 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, &(0x7f0000000000)=r0, 0x4) 22:55:59 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x2c00000000000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) [ 808.980409] binder: 2063:2066 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 808.987608] binder: 2063:2066 got reply transaction with no transaction stack [ 808.995104] binder: 2063:2066 transaction failed 29201/-71, size 0-8 line 2759 22:55:59 executing program 4: sysinfo(&(0x7f0000000300)=""/194) clone(0x0, &(0x7f0000003300), &(0x7f00000022c0), &(0x7f0000004340), &(0x7f0000001200)) r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) write(r0, &(0x7f0000000200)="1f5ad5d4faf1f6410415299970bd1525ed3cee8bacd2725ceac11904b383f4e056a8352e28be75f2aabc7c026b793f47c8c6c4143a33cd50a9c179c0aa294b38e1ce56948899beeb56ddf7baf2d395512a94e23f74640a1c58b33cc4c36de34ff79aa397c78f0e743e690463a2fb34345a810c0b058927369ff18b14089d8d500886f8512ead97fedded33869f3024bcef0de862fbc9789ebe58317f543ebc35d443bb5fa6b0b0dd07469646862928d9f799777a2af3ea0aa8a3fcc0fd3d8ad213e66e142c08338786aae3ff486dab1f1da70d6ec51d5c5e71733ecb", 0xdc) clone(0x0, &(0x7f0000000080), &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000140)) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='children\x00') pread64(r1, &(0x7f00000001c0)=""/12, 0xc, 0x3b) 22:55:59 executing program 7: syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)=ANY=[@ANYBLOB="0180c2000000aaaaaaaaaa00080045000030000000000067907800000000ffffffff2100905500000000450000030000000000000000ac14ffbbe0000001"], &(0x7f0000ea3000)={0x400}) 22:55:59 executing program 6: mount(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='.', &(0x7f0000000180)='cgroup\x00', 0x0, 0x0) [ 809.143284] binder: 2063:2102 BC_FREE_BUFFER u0000000000000000 no match [ 809.202204] binder: 2063:2102 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 809.209392] binder: 2063:2102 got reply transaction with no transaction stack [ 809.216760] binder: 2063:2102 transaction failed 29201/-71, size 0-8 line 2759 [ 809.292430] binder: undelivered TRANSACTION_ERROR: 29201 [ 809.298147] binder: undelivered TRANSACTION_ERROR: 29201 22:56:00 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) read(r1, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(r0, 0x540e, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x0) 22:56:00 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x2f00000000000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:00 executing program 0: r0 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000000), 0x4) 22:56:00 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0xe0000000}) 22:56:00 executing program 7: syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x10002, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_NEXT_DEVICE(r0, 0xc0045540, &(0x7f0000000040)=0x8a) 22:56:00 executing program 6: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) socketpair(0x10, 0x80003, 0x200, &(0x7f00000000c0)={0xffffffffffffffff}) ioctl$EVIOCSABS0(r1, 0x401845c0, &(0x7f0000000100)={0x8, 0x0, 0x2, 0x0, 0x9, 0xa4}) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_PIT2(r2, 0x4040ae77, &(0x7f0000000180)) ioctl$KVM_SET_PIT(r2, 0xae64, &(0x7f0000000640)) ioctl$KVM_SET_PIT(r2, 0x8048ae66, &(0x7f0000000000)={[{0x1c06, 0x3ff, 0x5, 0x2b10, 0x5, 0x4, 0x100000001, 0xfb, 0xb68, 0x3, 0x8, 0x5, 0x6}, {0x81, 0x5, 0x7fff, 0x1, 0xfffffffffffffffc, 0x6abd53cd, 0x7, 0xffff, 0x0, 0x9, 0x118c, 0x6d1c, 0x7}, {0x5, 0x800, 0x6, 0x3, 0x3, 0x0, 0x8000, 0x4, 0x5, 0x10001, 0xc5, 0x5, 0x7ff}], 0x3abbfc76}) 22:56:00 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) 22:56:00 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x22, &(0x7f0000cb9ffc)=0x1, 0x4) shmget$private(0x0, 0x2000, 0x1008, &(0x7f0000ffa000/0x2000)=nil) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) bind$inet(r0, &(0x7f0000c16ff0)={0x2, 0x1, @broadcast=0xffffffff}, 0x10) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r2 = socket$inet6(0xa, 0x1000000000002, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup2(r3, r3) ioctl$KVM_TRANSLATE(r4, 0xc018ae85, &(0x7f0000000040)={0xf000, 0x2000, 0x9, 0x5, 0x7}) sendmsg$netlink(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000019000), 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000100000001000000", @ANYRES32=r2, @ANYBLOB="fdfaff00"], 0x18}, 0x0) sendto$inet(r0, &(0x7f0000fa0fff), 0xffffff8d, 0x20020007, &(0x7f0000e97fcf)={0x2, 0x1, @loopback=0x7f000001}, 0x10) ioctl$UFFDIO_WAKE(r4, 0x8010aa02, &(0x7f0000000080)={&(0x7f0000ff3000/0xd000)=nil, 0xd000}) ioctl$FS_IOC_GETFSLABEL(r1, 0x81009431, &(0x7f0000000140)) 22:56:00 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x33000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:00 executing program 0: r0 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000000), 0x4) 22:56:00 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x700}) [ 809.917537] binder: 2135:2136 BC_FREE_BUFFER u0000000000000000 no match [ 809.942176] binder: 2135:2136 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 809.949237] binder: 2135:2136 got reply transaction with no transaction stack [ 809.956799] binder: 2135:2136 transaction failed 29201/-71, size 0-8 line 2759 22:56:00 executing program 7: syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)) socket$bt_hidp(0x1f, 0x3, 0x6) 22:56:00 executing program 4: r0 = syz_open_dev$mouse(&(0x7f00000000c0)='/dev/input/mouse#\x00', 0x80000001, 0x101000) bpf$OBJ_PIN_PROG(0x6, &(0x7f0000000080)={&(0x7f0000000000)='./file0\x00', r0}, 0x10) syz_emit_ethernet(0x1, &(0x7f0000d53fc1)=ANY=[@ANYBLOB="0180c20000000180c20000000806307bc9a0270ddabc0000000000007f0000010180c2000000ffffffff"], &(0x7f0000ea3000)={0x0, 0x1, [0x0, 0x1, 0x0, 0x95c]}) 22:56:00 executing program 6: r0 = socket$nl_route(0x10, 0x3, 0x0) getsockname(r0, &(0x7f0000000080)=@pppol2tpv3in6={0x0, 0x0, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, @dev}}}, &(0x7f0000000100)=0x80) setsockopt$inet_sctp6_SCTP_RECVNXTINFO(r1, 0x84, 0x21, &(0x7f0000000140)=0x1, 0x4) sendmsg$nl_route(r0, &(0x7f0000000040)={&(0x7f0000000e00)={0x10}, 0xfffffffffffffd1d, &(0x7f0000000000)={&(0x7f0000000dc0)=@ipv6_getroute={0x24, 0x1a, 0x1, 0x0, 0x0, {0xa}, [@RTA_UID={0x8, 0x19}]}, 0x24}, 0x1}, 0x0) getsockopt$inet_sctp_SCTP_RECVRCVINFO(r1, 0x84, 0x20, &(0x7f0000000180), &(0x7f00000001c0)=0x4) [ 810.069575] binder: 2135:2158 BC_FREE_BUFFER u0000000000000000 no match 22:56:00 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x3a000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:00 executing program 7: syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)) r0 = accept(0xffffffffffffff9c, &(0x7f0000000000)=@pppoe={0x0, 0x0, {0x0, @link_local}}, &(0x7f0000000080)=0x80) getpeername$packet(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, &(0x7f0000000100)=0x14) [ 810.145842] binder: 2135:2158 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 810.153061] binder: 2135:2158 got reply transaction with no transaction stack [ 810.160407] binder: 2135:2158 transaction failed 29201/-71, size 0-8 line 2759 [ 810.282331] binder: undelivered TRANSACTION_ERROR: 29201 [ 810.287938] binder: undelivered TRANSACTION_ERROR: 29201 22:56:01 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) read(r1, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(r0, 0x540e, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x0) 22:56:01 executing program 6: r0 = epoll_create1(0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r0, &(0x7f000001aff4)) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0x4040, 0x0) getsockopt$bt_rfcomm_RFCOMM_CONNINFO(r2, 0x12, 0x2, &(0x7f00000000c0)=""/33, &(0x7f0000000100)=0x21) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x100, 0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r1, &(0x7f0000000080)={0x30000002}) 22:56:01 executing program 0: r0 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000000), 0x4) 22:56:01 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x8}) 22:56:01 executing program 4: io_setup(0x44, &(0x7f00000000c0)=0x0) r1 = socket$key(0xf, 0x3, 0x2) r2 = eventfd(0x73) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x10000, 0x0) getsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f0000000440)={{{@in6=@mcast2, @in6=@remote}}, {{@in6=@dev}, 0x0, @in6=@local}}, &(0x7f00000001c0)=0xe8) ioctl$LOOP_GET_STATUS64(r3, 0x4c05, &(0x7f0000000340)) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r3, 0x84, 0x1d, &(0x7f0000000540)={0x6, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, &(0x7f0000000580)=0x1c) getsockopt$inet_sctp_SCTP_MAXSEG(r3, 0x84, 0xd, &(0x7f00000005c0)=@assoc_id=r4, &(0x7f0000000600)=0x4) getsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000240)={{{@in6=@mcast1, @in6=@local}}, {{@in6=@local}, 0x0, @in=@multicast1}}, &(0x7f0000000040)=0xe8) io_submit(r0, 0x2, &(0x7f0000000880)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f00000000c0)}, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, r2, &(0x7f0000000180)}]) getsockopt$inet_sctp_SCTP_RECVNXTINFO(r3, 0x84, 0x21, &(0x7f0000000100), &(0x7f0000000180)=0x4) 22:56:01 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x2c], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:01 executing program 7: syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)) openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x20000, 0x0) 22:56:01 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7400000000000000, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) 22:56:01 executing program 7: syz_emit_ethernet(0x46, &(0x7f0000000000)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@llc={0x4, {@llc={0x42, 0xfc, "8d12", "cdbe66761764739b551f1b58f9aa08133ff307986bb48f6a6ad277905dc0a2800f7b301eb5ac7266fa84753b51c4b50ba245f2a9"}}}}}, &(0x7f0000ea3000)) [ 810.976632] binder: 2193:2199 BC_FREE_BUFFER u0000000000000000 no match [ 811.011281] binder: 2193:2199 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 811.018477] binder: 2193:2199 got reply transaction with no transaction stack 22:56:01 executing program 6: r0 = socket$inet6(0xa, 0x41000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f760070") socket$kcm(0x29, 0x2, 0x0) socket(0x10, 0x3, 0x0) 22:56:01 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x0, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000000)=r0, 0x4) 22:56:01 executing program 4: r0 = socket$inet6(0xa, 0x2000000000001, 0x0) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f0000000040)=@fragment, 0x8) prctl$getreaper(0x2f, &(0x7f0000000000)) setsockopt$inet6_int(r0, 0x29, 0x3, &(0x7f0000000080)=0x400004000003, 0x4) bind$inet6(r0, &(0x7f0000402000)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r0, &(0x7f00007a8fff), 0x3a7, 0x20000000, &(0x7f00000001c0)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) getsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r0, 0x84, 0xc, &(0x7f00000000c0), &(0x7f0000000100)=0x4) 22:56:01 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0xe000000000000000}) 22:56:01 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x2c00000000000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) [ 811.025938] binder: 2193:2199 transaction failed 29201/-71, size 0-8 line 2759 22:56:01 executing program 6: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_GET_MSR_INDEX_LIST(r0, 0xc004ae02, &(0x7f0000000280)={0x40000000000001ca}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x2040, 0x0) 22:56:01 executing program 7: syz_emit_ethernet(0x46, &(0x7f00000005c0)=ANY=[@ANYBLOB="0180c20000000000000000009100010081001600080045e8b030000000000067907800000000ffffffff2100907800000000450000030000000000000000ac14ffbbe0000001836e0b0783f053c8c8140a33df411662915858d28889b8786aa787bbf80fb9bfaad703d51a8874c0845f137b6ca07367afca9d529b59ce13f265f5837430a7bc14e3dc84950e0a5b4f13d33fbfa2963271d3a8daf11dd0e9e8d0240ac21b78cfed5f19eeee8a947276cd8395ce89b2415d8bf96ac3359d88cb6bfe4eecd9e1ac5048d9c75f6915f4bf25cddf74aa13bcf286f14f1d4c7868c348f7be55175ee3c95fcda3f138cdc3457b0d0ae60fe8a0151657b0d98817809f60988b09723ecfc55b04000100e56ec63b5bcdfb7fb836670235d9e9f6da88c03df067f175938c02af9f1f8af6db2f45fcf902b52eb5bfcb0a6f95c166f763555a09540e69f316a95ef10c30feac917bb2f651619fc93b1e2a216971082565e305b0589ed91300c488970a3b687ab4faf856cdf93715fe1e37676009ed57a478b868c23fd5de585750a13845e5b25f4c44e25916aabbb222c90ecbe2952becd27128aeb72f0a03bdb7fbfa4e6b91965dbe4d0be43739576fffec0ac3998c32b2381974300d6d13d4fb47c4dafa15a05996c9b330c0ac7ee98ac9abc140b421679b3271be2557ebaaf0754af43ea54fd5d94d0fa821009a21e3cedf996f9413b3458be0305398e84ae88afd085c4b44933a99226c5cbe6096227f5b31a87c8f56ebf4f02af27ab5a63ef36f4ff90a29524a5de1601738829de4447b0b5b957f0a5180bc7ac24391af1e5c7057e059d223b983426f0e1182757f31"], &(0x7f0000ea3000)) r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x2, 0x0) munmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000040)={0x0}, &(0x7f0000000080)=0x8) ioctl$VT_RELDISP(r0, 0x5605) r2 = semget(0x1, 0x3, 0x400) semctl$GETVAL(r2, 0x0, 0xc, &(0x7f0000000180)=""/36) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r0, 0x84, 0x1a, &(0x7f0000000300)=ANY=[@ANYRES32=r1, @ANYBLOB="bd0000007b679cccf7c8197387aee1ef1b486813e675f33a804fde8fc3792d866636554dfac1790f515e70d638c5c7f0bf69beef4dbda91be9a5599dbd7be58d180d9376b8bf4e8f868f0d5f4a8cc643246894e056c0c34ab517d830e9f1f3050a15c6da0238090b59a53c9a515ede6ebad95da2d3f1d76cb3ef13a53d460fed0e415210ade58147e66171f3dfef9d3c3880d0cc8e46df89ddb45c933d1ae31783b3ef98319fdd202a066b727926e3a105699b259dafcd66e0"], &(0x7f0000000400)=0xc5) ioctl$TIOCGSID(r0, 0x5429, &(0x7f00000000c0)=0x0) get_robust_list(r3, &(0x7f0000000240)=&(0x7f0000000440)={&(0x7f0000000140)={&(0x7f0000000100)}, 0x0, &(0x7f00000001c0)={&(0x7f00000003c0)}}, &(0x7f00000002c0)=0x18) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000280)={r1, 0xaa3}, 0x419) [ 811.185853] binder: 2193:2227 BC_FREE_BUFFER u0000000000000000 no match [ 811.196117] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 811.210901] binder: 2193:2227 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 811.220931] binder: 2193:2227 got reply transaction with no transaction stack [ 811.229139] binder: 2193:2227 transaction failed 29201/-71, size 0-8 line 2759 [ 811.312242] binder: undelivered TRANSACTION_ERROR: 29201 [ 811.317989] binder: undelivered TRANSACTION_ERROR: 29201 22:56:02 executing program 6: r0 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'veth0_to_bridge\x00', 0x0}) r2 = msgget$private(0x0, 0x4) msgctl$IPC_INFO(r2, 0x3, &(0x7f00000001c0)=""/250) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000080)={0x10}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)=@bridge_dellink={0x28, 0x11, 0x3, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x1a, [{0x801}]}]}, 0x28}, 0x1}, 0x0) 22:56:02 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0xffff0000}) 22:56:02 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) read(r1, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(r0, 0x540e, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x0) 22:56:02 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x0, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000000)=r0, 0x4) 22:56:02 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x4400000000000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:02 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c00000000000000, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) 22:56:02 executing program 7: syz_emit_ethernet(0x37c, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0xac0]}) 22:56:02 executing program 4: ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_INFO(0xffffffffffffffff, 0xc08c5334, &(0x7f0000000040)={0xffffffffffff0000, 0x6, 0x1, 'queue1\x00', 0x6}) ioctl(0xffffffffffffffff, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f760070") r0 = getpgrp(0x0) r1 = gettid() rt_sigprocmask(0x0, &(0x7f0000032ff8)={0xffffffffffffff7f}, 0x0, 0x8) socketpair(0xa, 0x3, 0x1f, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SCSI_IOCTL_GET_BUS_NUMBER(r3, 0x5386, &(0x7f00000002c0)) connect(r2, &(0x7f0000000300)=@pppoe={0x18, 0x0, {0x4, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, 'ip6gretap0\x00'}}, 0x4a) rt_tgsigqueueinfo(r0, r1, 0xd, &(0x7f0000000000)={0x0, 0x0, 0x6}) r4 = signalfd4(0xffffffffffffffff, &(0x7f0000000ff8)={0xfffffffffffffdb0}, 0x8, 0x0) socketpair(0xe, 0x800, 0xe6, &(0x7f00000001c0)) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000380)={{{@in6, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in=@local}}, &(0x7f0000000140)=0xe8) ioctl$SIOCSIFMTU(r2, 0x8922, &(0x7f0000000240)={'dummy0\x00', 0x2}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000200)={'ipddp0\x00', r5}) fcntl$lock(r4, 0x4, &(0x7f0000000180)={0x1, 0x80000, 0x67, 0x9, r1}) [ 811.957220] binder: 2258:2260 BC_FREE_BUFFER u0000000000000000 no match 22:56:02 executing program 7: r0 = accept(0xffffffffffffffff, &(0x7f0000000680)=@nfc_llcp, &(0x7f0000000700)=0x80) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000780)='/dev/rtc0\x00', 0x40, 0x0) splice(r0, &(0x7f0000000740), r1, &(0x7f00000007c0), 0x8, 0x8) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)) membarrier(0x20, 0x0) 22:56:02 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x3000000}) 22:56:02 executing program 6: keyctl$join(0x1, &(0x7f0000000080)={0x73, 0x79, 0x7a}) keyctl$session_to_parent(0x12) r0 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x4, 0x0) ioctl$SIOCSIFMTU(r0, 0x8922, &(0x7f0000000040)={'bcsh0\x00', 0xd40}) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r0, 0x2) keyctl$session_to_parent(0x12) 22:56:02 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x0, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000000)=r0, 0x4) 22:56:02 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x3300000000000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) [ 812.003268] binder: 2258:2260 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 812.010411] binder: 2258:2260 got reply transaction with no transaction stack [ 812.017771] binder: 2258:2260 transaction failed 29201/-71, size 0-8 line 2759 [ 812.073990] binder: 2258:2280 BC_FREE_BUFFER u0000000000000000 no match [ 812.099175] binder: 2258:2280 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 812.106317] binder: 2258:2280 got reply transaction with no transaction stack [ 812.113668] binder: 2258:2280 transaction failed 29201/-71, size 0-8 line 2759 22:56:02 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/net/pfkey\x00', 0x2000, 0x0) ioctl$SNDRV_TIMER_IOCTL_TREAD(r1, 0x40045402, &(0x7f00000000c0)) ioctl(r0, 0x4000008912, &(0x7f0000000040)="295ee1311f16f477671070") r2 = socket$inet(0x10, 0x3, 0xc) sendmsg(r2, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000040807031dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) sendto$unix(r1, &(0x7f0000000100)="ba8351aa3f48b9e57b4ed808debdcbf60552529d6909b1f4f8999c011eaa2eca7c711e7c35e2b11cfcbf235e13d601634bf18786191d032ea55f9fe68909ec44af6f34feb784ed0a808880aa80528efaf7c8ce6888142b41ff0fcd0b21fc70ccbbde7aaa272e09f0f1f30d45925cd1b265c294bae070c78ce71d30e4bb659c040260fbafe9e9a7faf4170620ef27505a1048bc790c803cc96186235c9db1882b413fad000ca2da5811e95e1f3b010d25e325c3b4b478df978738d5cfa343202579400520a8af2b742b3bd2996c0f7b3832b858f4ad02f1d97af9aa0cbbcfd679a7cc9a38f651", 0xe6, 0x8000, &(0x7f0000000200)=@abs={0x1, 0x0, 0x4e24}, 0x6e) 22:56:02 executing program 7: syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x0, 0x0, 0x2]}) r0 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000000)='/dev/urandom\x00', 0x80000, 0x0) ioctl$BLKREPORTZONE(r0, 0xc0101282, &(0x7f0000000040)={0x3ff, 0x7, 0x0, [{0x52, 0xfff, 0x313e, 0x100000000, 0x9, 0x5, 0x31b}, {0x1f, 0x2, 0x101, 0xfff, 0x7, 0x1, 0xfffffffffffffffc}, {0x8, 0x0, 0x7, 0x5, 0x6, 0x8, 0x7}, {0x1800000000000000, 0xffffffffffffffff, 0xd2, 0x7, 0x9, 0xffffffffffffff1f, 0x5}, {0x3, 0x8, 0x1, 0xffffffffffffff81, 0x1, 0x3, 0x82d1}, {0x8, 0x2, 0x13, 0x3ff, 0xa62, 0x7, 0x5}, {0x8001, 0x0, 0x7, 0x1, 0x5, 0x8001, 0x3}]}) 22:56:02 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) 22:56:02 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x0, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000000)=r0, 0x4) 22:56:02 executing program 6: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0xb1, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$getflags(r0, 0x401) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/nat_icmp_send\x00', 0x2, 0x0) [ 812.166921] binder: undelivered TRANSACTION_ERROR: 29201 [ 812.172534] binder: undelivered TRANSACTION_ERROR: 29201 [ 812.229467] netlink: 20 bytes leftover after parsing attributes in process `syz-executor4'. [ 812.262352] binder: 2299:2302 BC_FREE_BUFFER u0000000000000000 no match [ 812.306424] netlink: 20 bytes leftover after parsing attributes in process `syz-executor4'. [ 812.315179] binder: 2299:2302 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 812.322415] binder: 2299:2302 got reply transaction with no transaction stack [ 812.329772] binder: 2299:2302 transaction failed 29201/-71, size 0-8 line 2759 [ 812.400685] binder: 2299:2319 BC_FREE_BUFFER u0000000000000000 no match [ 812.409601] binder: 2299:2319 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 812.416783] binder: 2299:2319 got reply transaction with no transaction stack [ 812.424234] binder: 2299:2319 transaction failed 29201/-71, size 0-8 line 2759 [ 812.442123] binder: undelivered TRANSACTION_ERROR: 29201 [ 812.447702] binder: undelivered TRANSACTION_ERROR: 29201 22:56:03 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) 22:56:03 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0xf5ffffff], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:03 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x4000000}) 22:56:03 executing program 7: syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)=ANY=[@ANYBLOB="0180c2000000aaaaaaaaaa000800450000300000000000679078002100907800000000450000030000000000000000ac14ffbbe0000001"], &(0x7f0000ea3000)) 22:56:03 executing program 6: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x0, 0x0) getsockopt$sock_int(r0, 0x1, 0x27, &(0x7f0000000040), &(0x7f0000000080)=0x4) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000011c0)='/dev/snapshot\x00', 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r1, 0x80083314, &(0x7f0000001200)) getsockname$packet(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, &(0x7f0000000100)=0x14) sendmsg$can_raw(r1, &(0x7f0000000200)={&(0x7f0000000140)={0x1d, r2}, 0x10, &(0x7f00000001c0)={&(0x7f0000000180)=@can={{0x2, 0x6, 0x8001, 0x8}, 0x6, 0x0, 0x0, 0x0, "3ac432b324f7b58d"}, 0x10}, 0x1}, 0x80) 22:56:03 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x0, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000000)=r0, 0x4) 22:56:03 executing program 4: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = timerfd_create(0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000340), &(0x7f0000000380)=0xc) timerfd_settime(r0, 0x3, &(0x7f0000005000)={{}, {0x0, 0x989680}}, &(0x7f00000000c0)) timerfd_settime(r0, 0x0, &(0x7f0000000000)={{0x0, 0x1c9c380}}, &(0x7f0000000040)) socketpair$inet_udp(0x2, 0x2, 0x0, &(0x7f0000000080)) ioctl$KVM_SET_CPUID(0xffffffffffffffff, 0x4008ae8a, &(0x7f0000000540)=ANY=[]) 22:56:03 executing program 5 (fault-call:5 fault-nth:0): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) read(r1, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(r0, 0x540e, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000016) [ 812.997715] binder: 2327:2336 BC_FREE_BUFFER u0000000000000000 no match 22:56:03 executing program 6: r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r0, 0x10e, 0x8, &(0x7f0000000000)=0x6, 0x4) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendto$inet6(r0, &(0x7f0000000040)="9248edf6218324704958c18e28df11a2d2566cf5d97794a4f2f25bd394960d3de40f939097632c508ceae642c6e80d7cf74a149078826a7606629bc1e7cd512af165299f73332533a9dfb03045c9a2f3f8f3fa6f3b2dcd539570ac105bb6f696dfbce497a61b8e4cc83a85a51b5b4192430e5912b8203f9b76be3831fb7264a23f118585d1a891a9d47861513b89626468891e330c635c507db35fb6af10cb1eca518c37c252be925baed701e9a085a636abf75f2eae094c277fdee7728f34195d85b2dceff90d3ea6a668b9", 0xcc, 0x4, 0x0, 0x0) r1 = socket$inet_smc(0x2b, 0x1, 0x0) listen(r1, 0x0) shutdown(r1, 0x0) 22:56:03 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x0, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000000)=r0, 0x4) 22:56:03 executing program 7: syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)) socketpair$inet6_sctp(0xa, 0x0, 0x84, &(0x7f0000000000)={0xffffffffffffffff}) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x5, @ipv4={[], [0xff, 0xff], @multicast1=0xe0000001}, 0xfff}, 0x1c) 22:56:03 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x8000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:03 executing program 4: socket$inet6_udp(0xa, 0x2, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000200)='/dev/hwrng\x00', 0x100, 0x0) ioctl$KVM_GET_DEBUGREGS(r1, 0x8080aea1, &(0x7f0000000240)) setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x30, &(0x7f0000000380)=ANY=[@ANYBLOB="000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007425dfd66600030200008ec33b1f5769852538fafaab0ae9b35a33ad4cc3abedb52f02cd2d754291fe61d43e55cd7a6d5404ab4114b074bd2cd285eb2506e6017cb79e49704da757e945abc5485279d8dd56e9fc319ffe08c58d677703976f86243636c5faff19fdabaab1b8a973abedf22340d54825da1dd83f0e3316dc1130d1fa30a8784ad3f85d01c90c057dfbdfe3037623a60419a740d62bbffaf0ac9c511f5beef31557fd8fd09272826f235adb74dd7b8ed789ab22a4bff34e91f156b66c2020b3d3"], 0x15d) r2 = syz_open_dev$sndpcmp(&(0x7f00000002c0)='/dev/snd/pcmC#D#p\x00', 0x7c2, 0x20000) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r2, &(0x7f00000000c0)={0x15, 0xfffffffffffffca3, 0xfa00, {r3, 0x8fb, 0x0, 0x0, 0x0, @in6={0xa, 0x4e24, 0x4, @mcast1={0xff, 0x1, [], 0x1}, 0x1}, @in6={0xa, 0x4e24, 0x500000, @remote={0xfe, 0x80, [], 0xbb}, 0xfee}}}, 0x118) [ 813.051468] binder: 2327:2336 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 813.058674] binder: 2327:2336 got reply transaction with no transaction stack [ 813.066132] binder: 2327:2336 transaction failed 29201/-71, size 0-8 line 2759 22:56:03 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x1c00}) 22:56:03 executing program 4: r0 = socket(0xa, 0x5, 0x0) r1 = userfaultfd(0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$SG_GET_SG_TABLESIZE(r3, 0x227f, &(0x7f0000000080)) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000000)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000280)={{&(0x7f000090c000/0x1000)=nil, 0x1000}, 0x1}) madvise(&(0x7f000090b000/0x3000)=nil, 0x3000, 0x4) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000000040)={0x51e}, 0x1) 22:56:03 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x3], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) [ 813.200078] binder: 2327:2363 BC_FREE_BUFFER u0000000000000000 no match [ 813.300956] binder: 2327:2363 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 813.308061] binder: 2327:2363 got reply transaction with no transaction stack [ 813.315498] binder: 2327:2363 transaction failed 29201/-71, size 0-8 line 2759 22:56:03 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x3}) 22:56:03 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x0, 0x0) ioctl$KVM_GET_DEBUGREGS(r1, 0x8080aea1, &(0x7f0000000180)) ioctl$SNDRV_CTL_IOCTL_HWDEP_INFO(r1, 0x80dc5521, &(0x7f0000000140)=""/18) r2 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x8, 0x800) ioctl$KVM_HAS_DEVICE_ATTR(r2, 0x4018aee3, &(0x7f0000000080)={0x0, 0x5, 0x1, &(0x7f0000000040)}) getsockopt$sock_linger(r1, 0x1, 0xd, &(0x7f0000000400), &(0x7f00000003c0)=0xfffffffffffffdd8) 22:56:03 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, &(0x7f0000000000)=r0, 0x4) 22:56:03 executing program 7: syz_emit_ethernet(0x3e, &(0x7f00000000c0)=ANY=[@ANYBLOB="0180c2000000aaaaaaaaa5000800450000300000000000670a907800000000ffffffff450000030000000000000000e0000001983696dddfed618f676a89f6723d0efaf0f8c4a1c06c06227618120000004f721d10a90c61d5f82aadab70fe335a523771d12c64940a87db461bc021455d804aedf6e61fdc01d2e1415765be4c11d107d84dc558ca67db92d2d8caa11fb660c680933d96d87de3faa9c7868a28fffacf9a2efbeac31a84f5c6858d8cc9bbda4ccd1dccc8a11cd94427182025284034f18eba7514b572d83a0fb6715d4103a98486e974261d5d34a3fadd8b3cd8f47cff9cf312e9a31926501a3510d33f40ba4c5e985d10cc7f413868550ef95fc6cc1f66c0000000000000000000000000"], &(0x7f0000ea3000)={0x0, 0x0, [0x0, 0xb60]}) r0 = syz_open_dev$midi(&(0x7f0000000080)='/dev/midi#\x00', 0x7, 0x6100) fcntl$addseals(r0, 0x409, 0x4) setsockopt$inet_opts(r0, 0x0, 0x4, &(0x7f0000000200)="1a7f41de6699513129a6d42f47b3e7eb9f720d7bbcc095c2d15c160396b2a817073c5d4e04fdc68a2c08fad295877f9a57c6c869730d07d572c7036fe69c98e5448afabc4ad1c5b0f4285d38e7bb1bbe292b463f6b7394929956ce6e28a07b3493f1ef94470871bf645ac2df69255c180b8b3c1da1eb3d39584553eda5babfee69d7e12805af3384ca29f9af5ec60bd76b6a934bcb37532ee4574ab162b5f3498fdb0b6448ad4c103e0cd59ed90d493b695d16a0f73a6074c8a2ee05c6104846e9459a2dc17264aa8d360098816d436eb1b422d5e94b32cb35f1270a49c5abfafaa80d763e071a3fd812b97f4acd4fdfe7060596562f5434343abd909a7cc1867b6532a3d3363a7525860f2cb10f2556ef4b29f67ff4fecb33b8dc692f6e6b20e7129a88caa67885ae9ecb2ea20f9f06324ac83910392c16555a3dbd1f11107ec27dc0539d6070a60779566773fcf2dfeca747d099e3075b8dd415bec84e25a4b49c69543a5b6c59335ac2d5919fb9114514f43e0664b53af27403cfc02677fa308304968a51db439b2d3e7d9b512bbe22c32a199ad6dcb4d5adf817ca34985f5d2de1d88fec425e4337471a15f7bf7b25d6f6cb858d0acc5b2c02bcbdb50e1c1daab57b5f444b317ba1efb35d907824d9bc1e65cfe028c4700ec93e2f5aea27695a7ba860124b2c9bcf1f23f40ce02fefc12d9b0308c3f48ba6308647ebea28240f1f25bb7f708826c3f432a450ef9ac18a1ba401143ae4f9ac6f8353ce6c59f9ea28b53258e97bcbd0abee53d28892710247ab5b0ae733d20d37293e6e8ee03f9aa0d63270fff835bb1aa53a9ab2d84d096c67aa2f0f6e301e05b79c0a7c0c5e2e86ad69ea15310262035c71af3ac516c2172615cf1e3db6495d59873ab6c14ea362f93ccdefe242ed46995640c1cec0f8ec78a392274d0a9e9d241a33366f491c8075ea5f87d0dc32e5dfd2e5f3c28ba46c4c4b247edbb411a570bb912b536d146a3dd3f74c6f261e0b6be119ce1aa85ac857679c7da476cf8f946e1d7fe1fcbae523140264f2ee6abd28043a315691fda647e0b4412f84e68082d8e756700afa2576484f19020161450993912753863ab0175f1bf3382a14c8bb43ed96d8e05bb8dc1665bfc71bf944f1f1973d1e0e1bbf120064231e6cf2daf4b4fecc833b7e7886b27549c0458b8c81f78d4e76e74431f70686a53433f34cb522fc202d3d80ad409de5a435f43f4bb7c6c1616c57882405a267b649e9dfcc33cbddd021d7b14be2cc8d55ccdc827800682741e80b16dc733268e3453d7faa65aa66be844b814b89d814392fc6610610200c13231790ec1959f2bb14a5f2f1ae2ef889a85ef4f9a6a8b87eb23677e7370f74a27167615370a289313fe32aedcb925813fe9dadf053a842e019d2b54c2ae599dba1a526d47ffaf1b73aa0e681885d9c998f8373d5363322128467cb00957998637c4601c6aa04531b752e041e02bea2ae45fe3bb60f5bab4d6fda19c8264cbb116f95fec188bc3e2a2fd5e538744bdcbea77989c420254c91beed8c15ce01952ebc44681a7b8e756ad5667511d46de1b672850769ec76760ecbf72825f0051196e2b85924af54d7ca9ee163c39f85331a5a56803d575d8be3811995cd1f05537041231f5ca6ecb3c127da13abb66ef7088083abed0fe4326119015725e5005c3f0b8db8e8f6b9e782694ecc18a21b9d1972519d3d56046e23bd77a94f635d69bd9f6b761a0e76c7f634fc94d16f71c535f115ca5b903e926c732c29c3440b5427d4f6892594e6d090eab76fd9675e1c0924be259cbedf81c2936d86c6546d505f2433f0c0215bb2fec7960c3bbb26a5ebd091b13f9aa151c242933970ff1c8dbc569fc6921eacd94fc43f6aae3643cc9d0d2a7a21d68a2131189a930d3cae7d3250a41fd1a5d4677c15a46e0eeeb5580538b769df63cba7776c37ab7ea56694343cad361ec9086aaf39e0c0e369dd9bea773e71353a14149fe5982655b436c252287616933ebb80aa4f74f38a821dd2d6abc09ca50e1c357306b26695a243bd6defc4b4a3f3958966940c4d0c47e1208a7c8b3bf886dc5e1d77a99983df637d0971fa76a3e0bebbb70c9c43dc1b402e8b9551b659e79ccb94d2b674943a96b2ae4108f23e8df921d7a9f3d78f6eaacad873554213fda81f00564bbe80fa73714020b4ab3ff5b09a9667865e34f54df7f9be192c9669d9d964353e7d444b2fc9175332e522e124d290a56d80050258308b59048f1a3b618cf221798b9494d01f6e4234fefa1cc7415cd1ff1c1b6ad9480cb5c37a5604c7e6ebe3e0a503888719d44c3a7d14e3b6e61ca67055ae3d4714d9327864467a7555da8a52a9e63024ef0b7f75fff9f2793f4474cad09aa090f56acbb23a36b98a4d3f97db8ac18b174b8f1b14db183484870ada7bc43b0283fa30f3f72ea1196aa4555ebc323d1159780243d5b0ea4d5ea6fcffdb6c3909127ed75ff237cd006ba13dd1a26a62e26fb170afb5ad5d459a5df26ee6612a03319e3331edf50122bf5a3ad80119bc8fcbead5662c3e38cde52b894e2363619c978de392bef2014463d3580d10d5c1925e0b976435333b0d30cf0e61ca0fecb51165bb2d1e8d7560739146bccf31c41156800482e32924010cf176aa9152f3f3b1d9432c68d0bdd99d89d5c957c57189bb396d40a5839bb1b7c6ad82f01c602a2e73e965fd7918b5347929b0e0e054caca046b79f90b82f354c51a19f401e029fcc1fd36fa97d58414aa58de08d80c491dc3450eeb84df0a200762e405ea7877e31c844684f33ee3dbfcf34185fa6aa197b737dd2a16f8a98419de361ea09b1bad43f041b40bebff61fd8c942530216fcc65a74d758675898116f0b2c42ced80b4465c304b5abc797b0e63a5d57b046ec19f8ef7e690e997ac26ef47250e619eb0566661a125c4152b03a232e8a643c519a0fede0861d2bf001be0f550ecf102c0e9a0e81a8e1ad7d8c4a2c4d55e498368bfa6c31f5c1a6f824a3a3a945e9f6fdb2ef35ac4f727cc210c48c269114d6665f1f9f8d8a8c56d7434f05c278bbbbe80b5f7866d3cec758b1cfcecff346790f446c61b4b205a3c88c41e9631e5e2adfb565e70091347e47f47e793a58895b0496b043134f4b39dc6707c57fa2343e6912a7808894188a7f00ceb438909730090b869bec398d6f5caf8a263973338b2b671eaaf4270916dff5fa331df05d1bf0bb9c36540aefe653fa6725764c0d0b26536305a88ab3f00d6c1adcc3c86b704cc4361700c648e400086e8df6a107d8769f192852687aa533c0284ac79631fba17b3993c128c7323bb28027d9f21af5643f000f115d6623e603eed8360b2ce60b33098569577d4b534ca32882600627b229cf193b8207fd9cabc233c5451ee6b59b1952098fdc40df7aa5b6b26caade4f44883b8ead9ed2941cc410032e91d19c917192cb9a8491d45997dc6fbecea78f5af73e5a8c180cecdcf81eec7f6f7392dffd941992d1553d5f6f278e6987c46898d986c02f1ce51279c39d31d6cacff1ffe6b1e8c24f3406e9e8edb5fea34a2737a1e6737dc4e0a6ef3a98243ecfe03b622eae3bbc563e53219799732bf2fce8108efbefc1632120f97847b2f7109ed75aa451bde68b5600839a5b3b7b5fe9b21508ae6634a476a3df3c86edad4b2143fa0cfbc9c1e312e6d1a38a34c147fcdfe07f44e48fd8bd52148bc28aec0917bbbeb3e75778b5fe35451f0b1af4d3383a61061e4b051f14fc3977007032a6f231ab094d723a2b82c00b903484ab5ef9fc1c01336455d12f0119add4412698fc785f2268b19bd98ed4522c291ed23ecde03690034bbd38021e1e75e5324457053389c739241c3300219080a154d6765d36821599d39c1f936601eb85b8a33ffe13783857015c75f438517f8615fd82a2db41784d95b799a7e5c6a8a8e10c77b29e83a9569879218d7ce8d89da682699f9591492f3f702a9e32d19ad1f20c8707839853a24b3b0b3f9838bef7f9e73589b18eeb3ce5d6710a66cf37c2fbd2ab58f548b0f4e7e3a3f1163df575fa2128668852950112d2d8c318e114b18a81dd38a86c26d35fc4663ca7b949f21e87e72f6b2eb45c721b68c36a4021d2c386752ffc708806d483f92f2d6ac77da1881b2d814ad36ba5fcef6f42e84657dac6a7007525afd25c3b880ce1813187c66c2bfd3b785e33c617bfbf92b32a52244bc83a00e9cbf96ac8f89b4ec1470845386c192ef292f2cb3c19dfabf3c445e663cd2bf84fd41f19afdcff1e0bb89df253817f32abb3b704902f1a110c6182a4b7df2f345cd443e81a496df17d930867bfa3f70d85b1f3e2a0760e5a7507b51d06060c7f932562c200c557fd91f9293b89d0ef905d1f23c158201db95bd5f0ceb4b727899830c40f350a77e45fbcedc1af2cc280972f2472acd44ae050c629a4ba0153d8a700d0bd79012be4b07a97ed8d7eb559375806a4b2f597262ff0fcf93f26ce7a1f7072430d716946f4ab6d5e13603745051eee4b890aacfe69e1a51afca95f179e46ad2d991fd630f6728b2912c376f0f47a845234f8da116d53cc63df73e7bbef6fb5ac8c15f504a1be45570773f2ab0708070e89ddf4c4c5d1c73afc3aadc42830153ce6bed9db3c3858e1356db93809834874eadeee08cbeff9c48b5ff9de65146552ee2ef37c4d258064e375bf55c4502ff1102c677c7752c55cceb4e780c4bee61025a0a79eeb166c9b93633c8e852d08fee1a43b69d927a1cc6b77e467d8a41070475c587f38e1ebfe51579268f1e5c67b98dcf03e8cf89dfa3951bb4629fdc79da42a5133b8fe7cbc1e59a6f521d63040d80733fd8f827ca46485025dacd99341aff29dcfe517fae42ec8d84d654c6658b407e8388ec7a73ff97c657ff609f6d1ef8a10eaf3dfebc6436331b1bc9f5970065c28b745b7fd0d064b6bd317c7ca58c861a0836b5f72544afeef06604be1d1154f7035368481cbcc277073231ddc9b07a90b5f9c33734f5619bbe89793e6021c45f1b22194031f8845e2dee7dbef740cf7b06f4a43a655e0888b722ca8da8d02adb1b696af59dc2d2d86a911cdbae8f9ab6b38c37fa80dc8d7d3ea13c77a1229f55cab6320fcc058bf5b7c62a446b8dbd0c23712771a055deaba901b9fb8a09f517d54d0cb9693cd708bef4d45cde0c4f6ce7dd195605dae306f31082dd06813a284c63b7e0b82b21ac93a2a949841163004d5f6a8bdf67554255f6cd09afb61cdabf995e5d6af9b5642708e294b9b532bec37e57c89465ccc0cfc9f1a7c93a63a6a71b12d8495d7a73bd8b28d5cd2712230e931ed958a8bcba4933b2e6c7d4e5f97c0845848b17b19790e86e28eef428e9674e093d2a53c037c758201696595b4a76531315e7fe8a5315a2f44c17f21f286e824accd15e30f36d7496c3e146cd7191dc306a775d9c8347ae1e24556a2f7a25364dbf651502fc89da128dc34c6ee70210a8aba9438669c0c2a390460c103c088d3bc12323e01f7650fbb193187b9e98e271c3ba55547b91fa480e296cf92ddba8a61207a197cc6504f6d36ee0d3c7335c096e22f0285b133ffee3df618bb416fdca809aee5eea95e67339379f54199de0d9875297e69bbfe037d50d257ba3cd4db81d428072dbf445654a4e468536a79308366b2a8181236ea56a810cdf77e23602dd992ff7eac6daef2de34d9b52fc06bae820a1f8e19417cde601c7fdc2f8cd87f3c777a5356de5aed3b42e73ab7153c87d3cc119173628f88e358efb6afab351d07a1d31a66fde988b4c", 0x1000) iopl(0x100000001) r1 = syz_open_dev$amidi(&(0x7f0000000000)='/dev/amidi#\x00', 0xde, 0x8000) ioctl$PIO_UNIMAPCLR(r1, 0x4b68, &(0x7f0000000040)={0x7f, 0x7, 0x8}) 22:56:03 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x89ffffff00000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:03 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68000000, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) 22:56:03 executing program 4: r0 = syz_open_dev$sndpcmc(&(0x7f0000000240)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f00000004c0)={0x10}, 0x109, &(0x7f0000000180)={&(0x7f0000000340)=ANY=[]}, 0x1}, 0x0) r1 = mq_open(&(0x7f0000000500)="2f7f65762f01fc642f70636d432340236300bf343511ff05de345e07fdd302a2827ff1e24cfeb296df5408608a647184923dbe2de23b518d6d8d9f7227dc24eb1020d8fd201ba2c3aa93645c846925114cd248760aab90e17f35377ddda3c815ae698c013867eddb575d82c325e960fd58cd85157130e5beb452197a229446fa92a842f58d3d39387f230bac443e3f1bfb2efa8603a6133e6890e757d87d438bda7de7baa0a2b41d0ce903e6af911bead19d97371cdc528fc5a0547f388c1ac7dbf303a1360580853e2ab43f9bebb5723b6e9ca9276c7484e7b32bad0000000000000000000000000000", 0x0, 0x0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x4, 0xbb6c}) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r0, 0x40045532, &(0x7f0000000480)=0x106e) listxattr(&(0x7f0000000380)='./file0\x00', &(0x7f0000000700)=""/124, 0x7c) preadv(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000009f7c)=""/132, 0x84}, {&(0x7f0000012000)=""/252, 0xfc}, {&(0x7f0000012000)=""/155, 0x9b}, {&(0x7f00000001c0)=""/11, 0xb}, {&(0x7f0000000000)=""/102, 0xfffffffffffffef8}], 0x5, 0x0) ioctl(r0, 0xc2604110, &(0x7f0000000000)) ioctl$sock_SIOCGIFCONF(r0, 0x8910, &(0x7f0000000280)=@req={0x28, &(0x7f00000000c0)={'teql0\x00', @ifru_flags=0x201}}) getsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f0000000140)={@broadcast, @loopback, 0x0}, &(0x7f0000000300)=0xc) bind$packet(r0, &(0x7f0000000600)={0x11, 0x1b, r2, 0x1, 0x0, 0x6, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x14) sendmsg$nl_route_sched(r0, &(0x7f00000003c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000640)={&(0x7f0000000780)=ANY=[@ANYBLOB="2c000000260000042abd7000fbdbdf2500000000", @ANYRES32=r2, @ANYBLOB="fffffb2e41b9beff07006de78d3b04994c040a0074a60ad36735de653a6d0c036e0cbc3a09e26bdbc27b20792ee9bfba0d9a71ffee88d88e1ca9f3a16cf793e71d8d8dfd7726654b62fb1e20cf94089cc0b54a802782c2b56e295f1643db9ba848b156567541d4d248c71d0752d5820f6e326f06bce2e2e559baa6d897878ff9f18f2896d0528b9b2b97af6667436190c8d51612b156cac9b8b2caed08127a15ca996f72e0ec1fb6d51a44d16f84c307cb46b43acabbf9522c4cee0520508bcbc4682a81d679ed98032bfc4bf0fe74b98d51138e2edf"], 0x2c}, 0x1, 0x0, 0x0, 0x8000}, 0x20000000) fgetxattr(r1, &(0x7f00000002c0)=@known='security.selinux\x00', &(0x7f0000000400)=""/109, 0x6d) [ 813.379286] binder: undelivered TRANSACTION_ERROR: 29201 [ 813.384927] binder: undelivered TRANSACTION_ERROR: 29201 [ 813.455927] binder: 2389:2391 BC_FREE_BUFFER u0000000000000000 no match [ 813.494964] binder: 2389:2391 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 813.502386] binder: 2389:2391 got reply transaction with no transaction stack [ 813.509778] binder: 2389:2391 transaction failed 29201/-71, size 0-8 line 2759 [ 813.533838] binder: 2389:2401 BC_FREE_BUFFER u0000000000000000 no match [ 813.560005] binder: 2389:2401 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 813.567104] binder: 2389:2401 got reply transaction with no transaction stack [ 813.574454] binder: 2389:2401 transaction failed 29201/-71, size 0-8 line 2759 [ 813.622382] binder: undelivered TRANSACTION_ERROR: 29201 [ 813.628054] binder: undelivered TRANSACTION_ERROR: 29201 22:56:04 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) read(r1, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(r0, 0x540e, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000016) 22:56:04 executing program 6: r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={&(0x7f0000000040)={0x10}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)=@ipv4_newroute={0x1c, 0x18, 0x1, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf0ffffffffffff}}, 0x1c}, 0x1}, 0x0) recvmmsg(r0, &(0x7f0000000240)=[{{&(0x7f0000000080)=@can={0x0, 0x0}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000100)=""/94, 0x5e}, {&(0x7f0000000300)=""/239, 0xef}, {&(0x7f0000000400)=""/197, 0xc5}, {&(0x7f0000000180)=""/112, 0x70}, {&(0x7f0000000000)=""/33, 0x21}, {&(0x7f0000000500)=""/71, 0x47}], 0x6, &(0x7f0000000600)=""/90, 0x5a, 0x7e7bcfee}, 0x1ff}], 0x1, 0x0, &(0x7f0000000680)) setsockopt$RDS_GET_MR_FOR_DEST(r0, 0x114, 0x7, &(0x7f0000000740)={@hci={0x1f, r1, 0x3}, {&(0x7f00000006c0)=""/44, 0x2c}, &(0x7f0000000700), 0x40}, 0xa0) 22:56:04 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0xe0}) 22:56:04 executing program 7: r0 = syz_open_dev$amidi(&(0x7f00000000c0)='/dev/amidi#\x00', 0x1ff, 0x100) ioctl$KVM_GET_REGS(r0, 0x8090ae81, &(0x7f0000000180)) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vcs\x00', 0x200001, 0x0) ioctl$KVM_SET_XCRS(r1, 0x4188aea7, &(0x7f0000000100)={0x2, 0x8, [{0xfffffffffffffffb, 0x0, 0xff}, {0xb8b, 0x0, 0xbc80}]}) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x407fc, 0x0) setsockopt$SO_RDS_TRANSPORT(r2, 0x114, 0x8, &(0x7f0000000040)=0x3, 0x4) syz_emit_ethernet(0x26, &(0x7f0000000080)={@link_local={0x1, 0x80, 0xc2}, @empty, [{[{0x9100, 0x1000, 0x1, 0x4}], {0x8100, 0x4, 0x7, 0x4}}], {@can={0xc, {{0x1, 0x5, 0x7f, 0x5}, 0x2, 0x2, 0x0, 0x0, "092ebbb8db3e3edc"}}}}, &(0x7f0000ea3000)={0x0, 0x4, [0xfffffffffffffffe]}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000240)='/dev/kvm\x00', 0x101003, 0x0) 22:56:04 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, &(0x7f0000000000)=r0, 0x4) 22:56:04 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x8dffffff00000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:04 executing program 4: r0 = socket$kcm(0x29, 0x5, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x89e2, &(0x7f0000000040)={0xffffffffffffffff}) sendmsg$kcm(r1, &(0x7f0000009f00)={&(0x7f0000009c00)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local={0x1, 0x80, 0xc2}}, 0x80, &(0x7f0000009e80)=[{&(0x7f0000009e00)="f6", 0x1}], 0x1, &(0x7f0000009ec0)}, 0x0) r2 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x7ff, 0x0) ioctl$VT_SETMODE(r2, 0x5602, &(0x7f0000000080)={0x401, 0xe1cc, 0x5, 0x0, 0x3}) sendmsg$kcm(r0, &(0x7f000000c340)={&(0x7f0000009f80)=@can={0x1d}, 0x80, &(0x7f000000b000)=[{&(0x7f000000a000)="aa", 0x1}], 0x1, &(0x7f000000b040)}, 0x0) sendmsg(r1, &(0x7f000000fd00)={&(0x7f000000ea40)=@vsock={0x28, 0x0, 0x0, @any=0xffffffff}, 0x80, &(0x7f000000ebc0)=[{&(0x7f000000eac0)='n', 0x1}], 0x1, &(0x7f000000ec00)}, 0x0) 22:56:04 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c00, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) 22:56:04 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0xffff000000000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:04 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff}) getsockname$inet(r2, &(0x7f0000000040)={0x0, 0x0, @rand_addr}, &(0x7f0000000080)=0x10) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000003fe8)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r3, 0x84, 0x8, &(0x7f0000013e95), 0x4) ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f00000000c0)={'veth1_to_bond\x00', &(0x7f0000000100)=@ethtool_perm_addr={0x1b, 0x4, "28be6a4b"}}) close(r3) close(r1) 22:56:04 executing program 6: r0 = socket(0xa, 0x1, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000440)={'veth0_to_bridge\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000180)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="3000000013002f0f000000000000000000000000", @ANYRES32=r2, @ANYBLOB="00000000000000c518a34d8c57cf19b8af9a00111016002500010008000000", @ANYRES32=0x0], 0x30}, 0x1}, 0x0) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f0000000080)={0x0, 0x100000000}, &(0x7f0000000100)=0x8) setsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000140)=@assoc_value={r3, 0x7}, 0x8) [ 814.050594] binder: 2421:2426 BC_FREE_BUFFER u0000000000000000 no match [ 814.062476] binder: 2421:2426 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 814.069570] binder: 2421:2426 got reply transaction with no transaction stack [ 814.077063] binder: 2421:2426 transaction failed 29201/-71, size 0-8 line 2759 22:56:04 executing program 7: syz_emit_ethernet(0xf5, &(0x7f0000000180)={@empty, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [{[{0x9100, 0x7fff, 0x6, 0x2}], {0x8100, 0x101, 0xffffffffffffffff, 0x2}}], {@x25={0x805, {0x1, 0x5, 0x1b, "2b5ff4e8e88618f5d133daaea9ee9fcbea9aef82a4b7f039bfd4255ec3a79435be4626babc80dd5b0ece6d4be4050358d6d602dc7110a3f1d2f09997fc1601ced01a2e29a0e0fdac16bcbfe3a60a30ba65455a66ac71bff64293445afd880cd031abd489e687052fd83017fa97ec0fc3f1e7ee35c79c0f242a65e6c91d2f0cfd39aa44b490892c0d77714b29a419b1a966a6707200a85b129360ebc88beee4313611a32e0f372ea118c16f0a14746e726058d011a39ac8ae0e1d95ca32fe8888648aa457879351cea81017d888e925ca26df57ca21c597b34fb29cc9"}}}}, &(0x7f0000ea3000)) 22:56:04 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, &(0x7f0000000000)=r0, 0x4) 22:56:04 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0xffff000000000000}) [ 814.173991] binder: 2421:2440 BC_FREE_BUFFER u0000000000000000 no match [ 814.209292] netlink: 16 bytes leftover after parsing attributes in process `syz-executor6'. 22:56:04 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x29000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) [ 814.210259] binder: 2421:2440 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 814.224982] binder: 2421:2440 got reply transaction with no transaction stack [ 814.232351] binder: 2421:2440 transaction failed 29201/-71, size 0-8 line 2759 22:56:04 executing program 7: r0 = openat$audio(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/audio\x00', 0x24040, 0x0) ioctl$sock_proto_private(r0, 0x89e8, &(0x7f0000000140)="4d0dd1ced38073d395aa7cd0a4b1c58bd6e0d8bfd973e007599a967b6c321956bb814c307226f7b788bc429bfbca4f812ce5df05bd944c4fe2cdf698dac0e83cf34571d160e0d9b60c4d0f81fc6bc275ae81421be1b114c4d83b73534e74") syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)) getsockopt$inet6_dccp_buf(r0, 0x21, 0x0, &(0x7f0000000040)=""/157, &(0x7f0000000100)=0x9d) [ 814.271797] netlink: 16 bytes leftover after parsing attributes in process `syz-executor6'. [ 814.362666] binder: undelivered TRANSACTION_ERROR: 29201 [ 814.368326] binder: undelivered TRANSACTION_ERROR: 29201 22:56:05 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) read(r1, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(r0, 0x5422, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000016) 22:56:05 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0xffffffff00000000}) 22:56:05 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000000), 0x4) 22:56:05 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x700], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:05 executing program 6: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0xb1, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000bbc000)={0xffffffffffffffff, 0xffffffffffffffff}) rt_sigprocmask(0x0, &(0x7f0000072ff8)={0x7fffffff}, &(0x7f00000c1000), 0x8) r3 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) fallocate(r3, 0x0, 0xffff, 0x4) sendfile(r2, r3, 0x0, 0x20000) fadvise64(r2, 0x0, 0x0, 0x7) dup2(r0, r1) 22:56:05 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) 22:56:05 executing program 7: syz_emit_ethernet(0x110, &(0x7f0000000080)=ANY=[@ANYBLOB="aaaaaaaaaabbffffffffffff81006c008137ffff00de2001ffffffff000000000000000700000000000000000000000435be4c1ca6a013d2898f9165f34bdefd036688e62733356dba8b470c89e3c73ef997aa2bf13dbb777568389187b67a5ec188e78127161b86c572c6740dbe8c3a41548fe381e96b206ec63c10b5e16ba2fef6ef4299643cf3f0c5d051dfaf732bf6f80565d822f7af23e9280b0a6914d5f705b0ef3275000038ab629c3397bf3fcfb681b95ed1085549b66721764ad799ca477569dca56783b1839e67f6041de8e303a15dd6b1e30367e93826d6fbc0474f94a30f01ef62f564493520f9c06fea"], &(0x7f0000ea3000)={0x0, 0x800000, [0x0, 0xce3, 0xfe5, 0xbc6]}) 22:56:05 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000040)="295ee1311f16f477671070") r1 = socket$inet6(0xa, 0x8000000000000802, 0x0) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000340)='/dev/rtc0\x00', 0x881, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000000c0)={0x0}, &(0x7f0000000100)=0xc) open(&(0x7f0000000300)='./file0\x00', 0x500, 0x80) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r2, 0xc1105517, &(0x7f00000001c0)={{0x0, 0x6, 0x1, 0x2, 'syz0\x00', 0x2}, 0x0, 0x1000052c, 0x7, r3, 0x7, 0x2, 'syz1\x00', &(0x7f0000000140)=['![vboxnet1\x00', '\x00', 'vmnet0mime_typeem0)vmnet0ppp0cpusetppp0GPL(\x00', 'bdev-eth1\x00', 'eth0{:@system!\x00', 'usercpuset\x00', '&em0em1$\x00'], 0x65, [], [0x9, 0x10000, 0x0, 0x1]}) syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x802) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000000)=0x102, 0x4) sendmsg$inet_sctp(r1, &(0x7f0000a29000)={&(0x7f00005dafe4)=@in6={0xa, 0x3, 0x0, @mcast2={0xff, 0x2, [], 0x1}}, 0x1c, &(0x7f0000fc8000)}, 0x8000) sendto$inet6(r1, &(0x7f0000b0cf6e), 0xffed, 0x0, &(0x7f000001b000)={0xa}, 0x1c) [ 815.130516] binder: 2476:2477 BC_FREE_BUFFER u0000000000000000 no match [ 815.166129] binder: 2476:2477 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 815.173230] binder: 2476:2477 got reply transaction with no transaction stack 22:56:05 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000000), 0x4) 22:56:05 executing program 7: syz_emit_ethernet(0x3e, &(0x7f00000000c0)=ANY=[@ANYBLOB="0180c2000000aaaaaaaaaa00080045000030000000000067907800000000ffffffffe6ce9078010000000000000000002c0000000000ac14ffbb1e4db4e821a310c7cddfe41222b69b3296c0b0edee26388b935dc3b33a767f6ac2d844e10c98a28a5b28c087320469d9"], &(0x7f0000ea3000)) r0 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x1, 0x56, &(0x7f0000000000)=[0x0, 0x0, 0x0, 0x0, 0x0], 0x5}, 0x20) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r0, 0x10e, 0x8, &(0x7f0000000080)=0xfff, 0x4) symlinkat(&(0x7f0000000140)='./file0\x00', r0, &(0x7f0000000180)='./file0\x00') 22:56:05 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x3c00], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:05 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x7000000}) 22:56:05 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, &(0x7f0000000300)) getresuid(&(0x7f0000000000)=0x0, &(0x7f0000000040), &(0x7f0000000080)) ioprio_set$uid(0x0, r1, 0x8) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4004af07, &(0x7f0000000240)={0x3f000000, 0x0, &(0x7f0000001740)=""/163, &(0x7f0000000540)=""/246, &(0x7f0000000640)=""/4096}) getresuid(&(0x7f00000000c0), &(0x7f0000000140), &(0x7f0000000180)) [ 815.180578] binder: 2476:2477 transaction failed 29201/-71, size 0-8 line 2759 22:56:05 executing program 7: r0 = syz_open_dev$sndpcmc(&(0x7f0000000240)='/dev/snd/pcmC#D#c\x00', 0x7fffffff, 0x4100) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX_OLD(r0, 0x84, 0x6b, &(0x7f0000000280)=[@in={0x2, 0x4e21, @local={0xac, 0x14, 0x14, 0xaa}}, @in6={0xa, 0x4e22, 0x3, @loopback={0x0, 0x1}, 0x1}, @in={0x2, 0x4e23}], 0x3c) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)=ANY=[@ANYBLOB="0180c2000000aaaaaa67907800000000ffffffff210090780037d483777eb79e7f000000450000030000000000800000"], &(0x7f0000ea3000)) r1 = socket$inet_smc(0x2b, 0x1, 0x0) ioctl$fiemap(r1, 0xc020660b, &(0x7f0000000000)={0xfffffffffffffff7, 0x0, 0x4, 0x9db, 0x9, [{0x3f, 0x7, 0x5, 0x0, 0x0, 0x8}, {0xffffffffffffff56, 0x800, 0x9, 0x0, 0x0, 0x200}, {0x3ff, 0x40, 0xffffffff, 0x0, 0x0, 0x280}, {0x8, 0xac, 0x1, 0x0, 0x0, 0x2004}, {0x5, 0x200, 0x100000001}, {0x400, 0x7, 0x1ff, 0x0, 0x0, 0x2}, {0x2, 0x3ff, 0x5, 0x0, 0x0, 0x2100}, {0xdfa, 0x800009, 0x3ff, 0x0, 0x0, 0x8}, {0x2, 0x500000000, 0xfffffffffffffb95, 0x0, 0x0, 0x1000}]}) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ppp\x00', 0x80040, 0x0) recvfrom$unix(r2, &(0x7f0000000340)=""/4096, 0x1000, 0x0, &(0x7f0000001340)=@abs={0x1, 0x0, 0x4e21}, 0x6e) [ 815.247427] binder: 2476:2498 BC_FREE_BUFFER u0000000000000000 no match 22:56:05 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x7], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:05 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000000), 0x4) [ 815.299012] binder: 2476:2498 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 815.306217] binder: 2476:2498 got reply transaction with no transaction stack [ 815.313610] binder: 2476:2498 transaction failed 29201/-71, size 0-8 line 2759 [ 815.366974] binder: undelivered TRANSACTION_ERROR: 29201 [ 815.372687] binder: undelivered TRANSACTION_ERROR: 29201 22:56:06 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) read(r1, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(r0, 0x4020940d, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000016) 22:56:06 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60000000, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) 22:56:06 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x1c}) 22:56:06 executing program 7: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x8000, 0x0) syz_emit_ethernet(0x1, &(0x7f0000000000)=ANY=[@ANYPTR64=&(0x7f00000011c0)=ANY=[@ANYRES16=r0, @ANYPTR=&(0x7f0000000180)=ANY=[@ANYPTR, @ANYBLOB="3b45a85d10d6aef066eeda77e6dcf3e608981186ee9e820687eeead3b83752f01ff69ffa4ebb6f0183343fd30612cf69f20e64de893e33f5be80e6a7e7968c0d457bfd401207378c892257f711b5ba98fe37b0504a9cc76e6626ca308429413b870ccd478b064b0186378a95e30bcb02d5bd0cf846ce4a6daef1a0619738d611303b78f4034d924d83dcc8de6206a664a16d4195fd1b9db625b77c94e92fa1aa8e72febccf9c0c970b5807413afc6b9ea20d69d0ed5f2e93f3a3f647fc522591fd580c0c255adcb81f75290dab64d3cc6a753d44d8aa1d7ce953602ae5d0ce361baf116c0d92f5db0dc57fd68162f33f791ed1ef300d5b03b589e591d83db6c4bea6fe30f4673b33065dc57d14204e5a0a1836dfe27d8597c9ae248feff98e515572d4ce021515929f799cd49c0442ad212f1eef98cd4ccd1658ebd82c94db45ed5febfb989121500efc826c1531ebcec1b78360fa1bebc10269a5f4b9804c1b51e121ce72db1a307b7bfc0cfc3c3ec0791550203eb05f2d433546932e98487e89571170646d0730ef5ed8b844bb54bf1494eb0426ca7ad170ae83041e26259553a5d943f5c75727655f7f4f9f35be0e34e1c70e1df2bd693a004745447d400b083a4acb7d1caebddbae5e953298cb844e018aadaf4e42dce6a96d98dc446e445646415b45e185fe65381a4be33f2e0bea84ce3fadd91286e918e99f26a6e3dc4bd7a1109b1fac101c428659eac5f32ece13f22238290e32a576894a151ed42399e95febefaccb40174581b56d269374b32db51c4bf1f4ffbe8e70c986f1069250703baeb625059f0c3029853a9e9a69b7d5ce982f7f61de2350c9a320a8dd271369149337a90c51afdde08cd0ad6754b462680f6cf5e1a11e664eb5434f2d5eb7180f9fdcadb1e26282084da6fe013a8ded359baf9763c6b0d605c04ed1c9993a11d5fe0c5e5703f4c8a595b9d8be24cd03f624dfbc36be4e2f8f0478e070451b0229521469f344a0c4952a50108016c91433919ac8895cae7b0ff5cd09a9fcc0c7f58efb429cc5b8ae87d09e83a80fb297db3f76e298abb5e2cd037b84e9bc7de8419ddcba701ddef05a239c924585eab4a78f6fcab39fb3128a83ab0f56f086db1f187c15e22ea8cf8434afe9eb3f98d62e37950c29b493777066863c5dae24c49ac3af40cd02c43e64f12b79307fb021606cbc1229ba29f1c102c3f1625910b605c3ff6ab3683be8cedec46f03e83f4a48f710bc40d600d46ccf855ffebcc788316a258288811bbb3aebb986fd4f8ed507a86d287bc83b4d5b35e18244ef9a78e8ce2cd0e871c233421af13a9f8a51bd72d019f71f5a6c99bc5f1505f41006eed269fffaedb1394a3b8c41b7a1ea5b6c22670373963779e758c4c3988e0a6eda8597ffa1f879bb873454b121c8bd91abcb1c5875130d733cb3a6f6c419fbb58cdad106ce09fd0a35316c3939931e9e45f65f909923aa1e25369ea1dc9d4ec0358025ab1e878e4d12a7bd1b7794a5f11189cf67bef1c8d7156761781e2d4186da3273181b0a8fedadc353a6b4474733f204479cc2c7b61baede8b970f557c565232fb8c682245fdaf4aacc7b720316c03d83eec0e9d58dec533e4fd98939cd19f3538a4dbfc571b818adaf618d3b1e97da57c5c1981460f8b84c1dcc0194dbfca84bece72c887f865d396d37cebfbc46911174e8eaf0bc28cd663c3cf62b3f36550a9792549cf374d268c0c7d5aa9726efe3f5fe19c0c1788ff7fdb6f1658036b0bff15b556f8ba8234ffc3c4d31bf7a375352e6267a94fc04783267abb03cf67aad87aaf7807d519d16c7fb4e8e6ffacb0ba8e3c8c582d993aaa4daa7eaf20c7970bc884dec46fb35086af22f36663f3c61aed357a350a5d0774c6c473546ce79f84110484aa775fe506e4202de0d86119a956b1c7c071bab13ed89070c5307490e0010de0a5a775d17a1ddd954030fee1a2c63f07d5578833f5bb1da7a60c8c1b5553cf3d462863f9e2cde8d82c73ffd6cb44cd9090cf8be8101754c6f775834154bd291c4584747daf3a0d3fca6f1f3640d0f72df178ba67968836d5fbb2ca2c108201f7eaf4906a9ad2c6b7a1fe3c5d6166b9fb49a3a41dabeb0a3a2131a4d823c1e762b7c75273b906d8bea42e0b137827907d924516b7168107b36d94e072a20517d429dc92db39bdc5050dc14138c3cf990ae5a19278e77174c5eed5d116b0b47bedc5a269257c62ee94da1b432f9a7e5fbc57abc877131f3d2c6141e88bc6bce6af36bc3fb2b9968f8205003803f8fa2412f7e62a05dbcafe1ce36cb333207760afd1f5a326ea776bae0f0a27d3217a25b7fecbdd147356bb2b5575b0238cc04dce55e7fe454f6d50c399b7965b83134597145b90c47100fb295e06a573efe74f5c7d3e93df8ec45e9bf9ea79cbde1784df37f4620014be9089961ca11bc3a9f23c2ba1c3662e4ea86741fe8a08191f205ad6b027746733656389403474013c621117ca2d7f13c3bfbb239fd721353d422d72434b13507920267e6eb3c9e1ebf01776f718ad8a926d0278d6a5f8c031b42296b5b3f59e081f79f97312ebb1e918684132c71f8564cc1d375dd41175915088054ea2e901eb794798452642444fd55776d9e0c73ad8f3592305b71dba28238ffff604c2d8335292516caa107da8722ce711b7968490b2e41b901d6dc15c03b8dc6a304d7494f61acfd7a2329ca558e927b11c64c3954a228e493ccb10c23b83d9b2ef730b13e0a42f81571a6c8797ef0f744196a8922edb02c0204ec9a0af0fcd38efd1b71e3524cc6e7a5accebf72a87acc5dc1df253d0ba95fd43e203b0c893b3d4b9224cf64f74ce1adf5ce85c668239a90a424f0c91d68917ffb9cfcdf3e1a2b33d96678ab731a7e12bde5e5988b2e7c0fb4e5eb9ea959ea5f39ad819e190315eaf35c16769b44302b57ac1299f1727204dc865c0c17735d073516be4620be54f730b8f9eee4edc36f8d25cf4085058c25cf0d9aa1e76a3599f6ad4cd679d8d91f649428c60ed03775a23d1fc4d6c91d13d809e385f5493a46edf17b257cd7a8a9f08f855a1baeda6cd223d4ac95b4690acb06229d13612063db1fb61af95ef292f8301c1ac6377d50287f67171401864a80a9b96e6a567844f1491998fd539791d61a6ae1248b5f440c5294f8005715fd94923cd442ff3429bd4f1a3f5f664c13933d91da9456ab88a032fd205b092f92326720f8f070a299ef3a27f71c213fd1b0b3d796b987cfd07e7082c4a3174814102f40384a1ab72bf43633e917c15e7d5badee7500737ba699d8d15448253988cfede28a9683f4c1cd59b1bff4f3e9c87812dc94a02abaad1afb47cfb2c39646236ca4ac28d25fd6b35158a664c9b6b12d51000298d296d3a8b5aec445fb63a1c89b644043792fb388bd8f493031f8670469f1732d2667e5657f87ff389959a0f03d4168dfe8fff1b5e72c64f18fd3091982aaac1175d554b8d8653d88975b66407775ae5b21b958f2bab86706744db3ddc5d2ee753507802f787bd81a18dd0feae148bcaa36523b69cc9e22ceb35bfd36e403e9c1bd225de412cdbcaa712c984ce7efbacf38136c94d3eb3abb89f06053707173e105e2496268b918ee504aaa6ad3a187b2cb8cac6a89618fa83204639603819d0f21c053fab3a8dc53d42f205c70daea2e5047b9c6c4d55a8f8570dbbd8f42d9c77821fa80431019e38f949ded78dbfa0d41aab64a17ca75e9edf77facac1817c6a6e51dcca8f9e3d4e0d97b9708ffa96c7321c0813a43b7c76bd6670ddf120f9473a4876f9b4780bba236d4fd606618f67a3d9d0c23b5a8bd9d908a59fa2c2646a3587d278537b16a7da59206b4248206570fcbf1f5beef1651b6cffa694d848e92a75b86028f8f20239825bdb15bd827af8be5819a9df8afc2c2cd9f704b546b8493246f4e7933d737ce16f35981274af220fd7d9a3dc70b9d0424d85902b5f23c883bdbfbeb0f3c41d4811a0cdedbda695ae3927c01b67c85e220b4c5c4c603120f990f0f8171e6be2fa905c2d7c48c335b8d9314e2f842aff7c26dee5b7f30d9d8f7fcc3f53053bf17b332ee88335a7a120124a83a2c4b13614541b50f9581cd121936dcdc7d8d220217aefce452327dc2e943f08201b5235e3519858df01cd829cba9528e9bed00f4a644e069a883994561d1115b4c84a56aaef7ca051643a127589843f3787c53d3c3f70ea65508a67a0bde702bac7b213ed2f316c6cd549d2ab87190ca04da79f37f5b6eb980fdae462019155bbfb1289aac8fbf34790e8f94e1550999d691f963c30ae0d92b4d5b76591b8ba37ab3aa40d7a99e05a29d1046d9d5d2d7b66e6703549c4e076dd7ab857af68462f17389f5a246eceb5400d1e98a5c0e441bdf5995dd01fd827f0c655d6965ad22503532ab569d19bca981ae913f9060c19d696f4834ba4da91aa754366dcbd7fea0ca542f6b23a45269493cc37469edc1288c85cdcc28e34cc2510e797ca2a85c74af8195981b2099e383f2d1cd9cfcdce5e5e453baa5f46fac506491e0907ebd1e115ddca23597ca3120b583c5a4f13b3edc19334827d3c40257ee67616062c9dd6673c380600f166cfbfdc436a4c863f08d549cd5ebe2b02340866dabe2c5589160b0e0f15e6d7e4e04a235b5bb60960751e80d880cf5c83af33c2c91051ab247642273bdbd37072fce95c89dde434d0df8594c479bde200bf99cec38df94c1ee1815270dbdd9c285f07ef71b8d761383151bafa36392c503038cc76b24fa06f3ee9217254d5d51edf39f89bca7ded10987f359aeb01e30f79ba2ac0ed9de27cd3a7d84109dbd039b573f901269b6e72af29ed5397802802cd2a42055e06ba44dbe7ea67281edb95fd450a7888c241a4322df3a9b6af2e51626ef7064d28fe51f95dda6b1990173a076396c8ea485bf00dd39011f80bdcb14ab42c6b87def2d76423d5e750d276945df6a079e3e3ce046ff689b628d546148eabed7182736da1923db89b65b69e2dd0b6a42070e715135a2656735e1b815f1d74a1416d706ad1aaccc96f542120c1bec2a84c4e4f8932eab47e67acc538c1fd638a1971df9efc83f273c4f6e529b749924556dd99999ac581b94827c776ac034469f1020e925d4bbafb83f52a81bc392a87e1c74bec098ed525522061678af4969e895485b4994a3d8db033cb5b0de17e28c81e1a19486244dc2205ea51adb36ecba86a6cca85ab4e8411c265366910ebc2e7c6434877397444bb870145cb5b521ca0d25be745f85de25c7a5179c76c4b82f10d5942d5e8ede12510f322c2af4aca72866a3367954fca434c3e32714516eb730964f17aa0c1ff9876849e9ba5458e6aa369ab19fd89500a6831737f54bbc8c7405042ccffd77863fbabb1643419d5ad285bb8f72938f079ccdabe946b76b1fc91802457923d004bec9161463fa438bf527aed609a26ed85679d2b0780d9a7f566f71fa7d1cdc0d18322e85dbfb06d03833323b0a5d490ce2ffeab57f7279fc5a70c6e087bcb927c5252ad30f0fbf498337270634bb611002591d4637450207c6e8856931fdf02076d15cb1aa6b042b5c16a39facab5b4b800a213b1b4a3e0847fcba5fbd66549bb4beeb666a1dc62743766b287605ae798915d20250553ede71dc06b80c42df7cd5d5e61f382960c6f8eefd6157dc12feb01e02dd835a84cf00df4dde29183a261c47440ff9b871c4a7ac3a8cd618b2828b751199ce0afbd162de50dde46f03207ba9783d5ed4bc215ef3fa13c2ada4292f312e6b8c7ca", @ANYPTR, @ANYRES16, @ANYRES16, @ANYPTR, @ANYRES64]]], &(0x7f0000ea3000)) syz_extract_tcp_res$synack(&(0x7f0000000040), 0x1, 0x0) 22:56:06 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1=0xe0000001}, 0x10) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) socket$packet(0x11, 0x3, 0x300) setsockopt$packet_buf(r1, 0x107, 0x2, &(0x7f0000000000)="32074ac51bd30433098a940e9a81622b", 0x10) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) r3 = socket$inet_smc(0x2b, 0x1, 0x0) getsockopt$inet_tcp_buf(r0, 0x6, 0xe, &(0x7f0000000040)=""/242, &(0x7f0000000140)=0xf2) r4 = socket$inet6(0xa, 0x1, 0x0) ioctl(r4, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") accept4(r4, 0x0, &(0x7f0000000000), 0x80800) epoll_create(0x2) r5 = accept4(r4, 0x0, &(0x7f0000000a00)=0xffffffffffffff7b, 0x80000) syz_genetlink_get_family_id$ipvs(&(0x7f0000000ac0)='IPVS\x00') sendmsg$IPVS_CMD_GET_DAEMON(r5, &(0x7f0000000b80)={&(0x7f0000000a40)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000b40)={&(0x7f0000000c00)=ANY=[@ANYBLOB="140074f8a9606e5af72a045368cfaadab65c4ec8ea8a654ff229a352966adfe2d81b1a15a32d2d1bade32f706931acd8ae52165b3a79a5db7b52dde91a3c6bf650d9a461abf23bb506f9c603b36a3c6cdcc85ab3656f01898d8dc72ed93fbe2e764ed2c62cef838d6f1179585ae22cbf58f613756c06ca50ecc814615179ef28978d80090494dd38ffe0ae25067a73109b903c383177e6cd17f386732ca31eb8a113cc13eb39a451e4c35ea277142a1e30d3f0fd8c8762c3e5b715794995fe0117143110fe5c8f0d6b5e974e666c"], 0x1}, 0x1, 0x0, 0x0, 0x4000000}, 0x20048801) r6 = accept$inet(r3, &(0x7f0000000880)={0x0, 0x0, @dev}, &(0x7f00000008c0)=0x10) setsockopt$inet_dccp_buf(r6, 0x21, 0x8e, &(0x7f0000000900)="046488e91edf93fede6c7b329806ba54930f415e212cb1bc3742c5897d14d181fb2a926558159939491bb855e7b0e45e9d79083e4b1b68f616a619096a44ba4fcb92882af5bf1b92f82cc7a9ab8f4e07296e0ec93783853707c7266dd523cc9a5921c4f21077e53d40fade1d7d4347b7b2e0ac3978cc19954e7042d8dc42bb33f7bbc7706d758cfa051fb756b4f42c5100e26d7ea7bdcd7d00942a7aa073e4d0a0fe81a45c436a33f363e1c9906317dab820eb6a6f13f0e70b43e8f191f866b9e4c794ea12ab61995e5211e7c05a784d01ccfdf7fec2", 0xd6) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000001c0)='tunl0\x00', 0x5) setsockopt(r2, 0x0, 0x8c38, &(0x7f0000000800)="fcae782300b10f2e57e0a1f36b066fcfd7a2251533b7270914e504f5d435967260b2aa18e3fefb9b6aa3d10df131b546923d7c24f48501f83cc6d501af5524d7cb53e2cb52aee70d18b8548efc245815be3092a28360685142076e715acbbafb2e5d093cadea", 0x66) socket$alg(0x26, 0x5, 0x0) sendto$inet(r0, &(0x7f00006d1fd4)="db", 0x1, 0x4000000, &(0x7f00004daff0)={0x2, 0x0, @loopback=0x7f000001}, 0x10) 22:56:06 executing program 0 (fault-call:2 fault-nth:0): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000000)=r0, 0x4) 22:56:06 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x4000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:06 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000040)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r2, 0x84, 0x8, &(0x7f0000013e95), 0x4) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r2, 0x84, 0x1f, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}}}}, 0x90) close(r2) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x400001, 0x0) setsockopt$inet_MCAST_MSFILTER(r3, 0x0, 0x30, &(0x7f0000000280)={0x9d1c, {{0x2, 0x4e20, @rand_addr}}}, 0x90) close(r1) [ 816.189666] binder: 2540:2542 BC_FREE_BUFFER u0000000000000000 no match [ 816.218193] binder: 2540:2542 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 816.225584] binder: 2540:2542 got reply transaction with no transaction stack 22:56:06 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x100000000000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:06 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000000)=r0, 0x4) 22:56:06 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x1c000000}) 22:56:06 executing program 7: shmget(0x2, 0x3000, 0x800000022, &(0x7f0000ffd000/0x3000)=nil) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000080)=0x0) sched_setaffinity(r0, 0x8, &(0x7f00000000c0)=0x5) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rfkill\x00', 0x0, 0x0) ioctl$KDENABIO(r1, 0x4b36) syz_emit_ethernet(0x3e, &(0x7f0000000000)=ANY=[@ANYBLOB="0180c2000000aaaaaaaaaa0008000000ffffffff2100907800000000450000030000000000000000acc65d52d1c7fe6a915b0d84d986921412dd19d4453ae79d73136bf299ffbbe00000010000000000000000000000000000"], &(0x7f0000ea3000)) [ 816.232994] binder: 2540:2542 transaction failed 29201/-71, size 0-8 line 2759 22:56:06 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x700000000000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:06 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x300}) 22:56:06 executing program 7: syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x3, [0x0, 0x0, 0x0, 0xfffffffffffffffe]}) 22:56:06 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) getsockopt$netlink(r0, 0x10e, 0xa, &(0x7f00008f9000)=""/12, &(0x7f0000000000)=0xc) r1 = accept(r0, &(0x7f0000000240)=@nfc_llcp, &(0x7f00000002c0)=0x80) getsockopt$inet_sctp_SCTP_GET_ASSOC_NUMBER(r1, 0x84, 0x1c, &(0x7f0000000300), &(0x7f0000000340)=0x4) r2 = openat(0xffffffffffffffff, &(0x7f00000003c0)='./file0/file0\x00', 0x80, 0x10) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00') getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f0000000400)={{{@in=@multicast1, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in=@local}}, &(0x7f0000000500)=0xe8) r5 = getgid() fchownat(r2, &(0x7f0000000380)='./file0/file0\x00', r4, r5, 0x800) sendmsg$IPVS_CMD_FLUSH(r0, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000001c0)={&(0x7f00000000c0)={0xe0, r3, 0x200, 0x70bd28, 0x25dfdbfb, {0x11}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x9}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x2}]}, @IPVS_CMD_ATTR_DEST={0x38, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x7f}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x80000000}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x9}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x101}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@mcast2={0xff, 0x2, [], 0x1}}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_L_THRESH={0x8, 0x6}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x7b8}]}, @IPVS_CMD_ATTR_DEST={0x34, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x5}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e20}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e20}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0xfffffffffffffffa}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x8}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x7fff}, @IPVS_CMD_ATTR_DAEMON={0x14, 0x3, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0xffff}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7ff}]}, 0xe0}, 0x1, 0x0, 0x0, 0xcf8683f9b1d65e6b}, 0x40) [ 816.465742] binder: undelivered TRANSACTION_ERROR: 29201 22:56:07 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) read(r1, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(r0, 0x80045432, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000016) 22:56:07 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1400, 0x32, &(0x7f0000000000)=r0, 0x4) 22:56:07 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff00000000, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) 22:56:07 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x8dffffff], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:07 executing program 7: syz_emit_ethernet(0x3e, &(0x7f0000000000)=ANY=[@ANYBLOB="0180c2000000aaaaaaaaaa00080045000030000000000000907800000000ffff224204a3d07800000000260000030000000000000000ac14ffbbe00000dd51ea5e6fe38ec201"], &(0x7f0000ea3000)) 22:56:07 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0xffffffffffffffff}) 22:56:07 executing program 4: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$packet(0x11, 0x2, 0x300) accept$packet(r0, &(0x7f00000024c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000002500)=0x14) connect(r0, &(0x7f0000002540)=@hci={0x1f, r1}, 0x80) setsockopt$packet_int(r0, 0x107, 0x1, &(0x7f0000000000)=0x3, 0x327) 22:56:07 executing program 6: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0) preadv(r0, &(0x7f00000022c0)=[{&(0x7f00000012c0)=""/4096, 0x1000}], 0x1, 0x0) fcntl$getownex(r0, 0x10, &(0x7f0000000040)={0x0, 0x0}) capget(&(0x7f0000000080)={0x19980330, r1}, &(0x7f00000000c0)={0x80000000, 0x400, 0x800, 0x43a3ff00, 0x4, 0x5}) capget(&(0x7f0000000100)={0x19980330, r1}, &(0x7f0000000140)={0x1f, 0x5, 0x7, 0x1, 0x73, 0x1c000}) [ 817.223182] binder: 2593:2595 BC_FREE_BUFFER u0000000000000000 no match [ 817.256453] binder: 2593:2595 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 817.263671] binder: 2593:2595 got reply transaction with no transaction stack 22:56:07 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x3000000000000000}) 22:56:07 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0xffff0000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:07 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1300, 0x32, &(0x7f0000000000)=r0, 0x4) 22:56:07 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f0000000100)=@sack_info={0x0, 0x0, 0x80}, 0xc) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback={0x0, 0x1}}, 0x1c) listen(r0, 0x80000000) r1 = accept4(r0, &(0x7f0000000340)=@alg, &(0x7f0000000040)=0x80, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r2, &(0x7f0000000080)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$inet_sctp6_SCTP_MAXSEG(r2, 0x84, 0xd, &(0x7f0000000240)=@assoc_value={0x0, 0x2e11}, 0x8) shutdown(r1, 0x0) write$binfmt_misc(r2, &(0x7f0000000240)=ANY=[@ANYBLOB], 0x34000) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[@ANYBLOB='q'], 0x1) ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f00000000c0)={0x2, 0x200, 0x7fff, 0x922a, 0x4000000000}) 22:56:07 executing program 7: syz_emit_ethernet(0x46, &(0x7f00000000c0)={@empty, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [{[{0x9100, 0xffffffffffff7fff, 0x4, 0x2}], {0x8100, 0x2, 0xffffffffffffffff, 0x2}}], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000000000)={0x7, 0x0, [0x800000000009a7, 0x0, 0xb88, 0x3]}) socket$nl_generic(0x10, 0x3, 0x10) socket$inet6_udplite(0xa, 0x2, 0x88) [ 817.271120] binder: 2593:2595 transaction failed 29201/-71, size 0-8 line 2759 22:56:07 executing program 4: r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rfkill\x00', 0x0, 0x0) r1 = socket(0xa, 0x1, 0x0) write$vnet(r0, &(0x7f0000000280)={0x1, {&(0x7f0000000080)=""/57, 0x39, &(0x7f00000000c0)=""/136, 0x3, 0x7}}, 0x68) ioctl(r1, 0x8912, &(0x7f0000000240)="c626262c8523bf012cf66f") fchdir(r0) syz_emit_ethernet(0x3e, &(0x7f0000000300)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaa0086dd6050a09c00082b00fe8000000000000000000000000000bbfe8000000000000000000000000000aa00ec4ef42d060ca63373dffecc6da7587c732000089078"], &(0x7f0000000040)) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x80, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) ioctl$LOOP_CTL_ADD(0xffffffffffffffff, 0x4c80, 0x0) 22:56:07 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x1c]}) 22:56:07 executing program 4: r0 = syz_open_dev$dspn(&(0x7f0000000080)='/dev/dsp#\x00', 0x1, 0x0) recvmsg(r0, &(0x7f0000000340)={&(0x7f0000000180)=@pptp={0x0, 0x0, {0x0, @dev}}, 0x80, &(0x7f00000002c0)=[{&(0x7f0000000200)=""/124, 0x7c}, {&(0x7f0000000280)=""/54, 0x36}], 0x2, &(0x7f0000000300)=""/10, 0xa, 0x8}, 0x0) ioctl$int_in(r0, 0x800000c0045005, &(0x7f0000000000)=0x1000) ppoll(&(0x7f0000000040)=[{r0}, {r0, 0x8}, {r0, 0x2086}, {r0, 0x400}, {r0, 0x2}, {r0, 0x600}, {r0, 0x4402}, {r0, 0x26}], 0x8, &(0x7f00000000c0)={0x0, 0x989680}, &(0x7f0000000100)={0x8}, 0x8) signalfd(r0, &(0x7f00000003c0)={0x4}, 0x8) clock_gettime(0x0, &(0x7f0000000380)) readv(r0, &(0x7f0000000140)=[{&(0x7f0000001300)=""/4096, 0x1000}], 0x292) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000800)={r0, 0x28, &(0x7f00000007c0)}, 0x10) readv(r0, &(0x7f0000000740)=[{&(0x7f0000002300)=""/4096, 0x1000}, {&(0x7f0000000440)=""/229, 0xe5}, {&(0x7f0000000a00)=""/176, 0xb0}, {&(0x7f0000000600)=""/128, 0x80}, {&(0x7f0000000680)=""/190, 0xbe}], 0x5) openat$null(0xffffffffffffff9c, &(0x7f0000000840)='/dev/null\x00', 0x426c2, 0x0) socket$bt_hidp(0x1f, 0x3, 0x6) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000540)='/dev/audio\x00', 0x40, 0x0) ioctl$SCSI_IOCTL_DOORUNLOCK(r1, 0x5381) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000400)='/dev/snapshot\x00', 0x10004, 0x0) [ 817.467836] binder: undelivered TRANSACTION_ERROR: 29201 22:56:08 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) read(r1, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(r0, 0x5423, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000016) 22:56:08 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x3a00], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:08 executing program 7: syz_emit_ethernet(0x3e, &(0x7f0000000140)=ANY=[@ANYBLOB="0180c2000000aaaaaaaaaa00080045000030000000000067907800000000ffffffff2100907800000000450000030000000000000000ac14ffbbe0000001667996bf584b4163d312f3b45f2095c4a102ee0e12e5d7e80442842784d08102d450ee79d2e0547d627f2d4dd2a74a404a9b3c293fd70d4a2222c9dce46e51dd95ef3333f5aa0bba27e0862ddfcabe4447924c59f70133b3ee093e4f824b5b070b7d64b8f6c20a68b7b6593c7f84ae469a608373a3b8ecef58de7bc2e177a8942d806d18afe808f096f8da2299efe2a71bdccba41952379024ca1ce8ca73cbf0e076b8f14d4fb2a9077d85695a2afeb0fbbd56b28d6121b8707de5e3e5d87c25af899fbef6332e48fcbb3d3274625e1baa330dab1842f6985da4222c99df0f6c"], &(0x7f0000ea3000)) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x1, 0x0) ioctl$sock_bt_bnep_BNEPGETCONNLIST(r0, 0x800442d2, &(0x7f0000000100)={0x6, &(0x7f0000000040)=[{}, {0x0, 0x0, 0x0, @random}, {0x0, 0x0, 0x0, @link_local}, {0x0, 0x0, 0x0, @link_local}, {}, {0x0, 0x0, 0x0, @remote}]}) 22:56:08 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffdfd, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) 22:56:08 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x8, 0x32, &(0x7f0000000000)=r0, 0x4) 22:56:08 executing program 6: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22, 0x0, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}, 0x1c) openat$mixer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/mixer\x00', 0x40000, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r1, &(0x7f0000e11ff0)=[{&(0x7f0000000140)="580000001400add427323b470c458c5602067fffffff81004e220000000058000b4824ca945f64009400050028925aa80000000000000080000efffeffe809000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) ioctl$sock_inet_SIOCGIFBRDADDR(r0, 0x8919, &(0x7f0000000000)={'ip6gretap0\x00', {0x2, 0x4e22, @multicast2=0xe0000002}}) 22:56:08 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000100)='/dev/vcsa#\x00', 0x6, 0x60000) sendmsg$nl_generic(r0, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x48000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="30140000140000012cbd7000fddbdf25050000001400500000000000000000000000ffffac1414bbcc000200567423267503a36e98d18b169cb4ac3023a0934187a7e834590018458e6cb1da9c46cb326373afdd3d007002930b0c3ced878fc3919b508aa1cc46d0a59d4b92f02a5ec77e5f9fb0c8673afdb0ca4b4153ad32fd47f351959b2d6f50fb3db6ec4140aaf4991316876d0cd006c1ecd4dc46d7e226af3277c3e5dcca2bbd99b9e1adf06db5ce471ce2e124ef1d17e3e7834e1e4808da2e099fd4a7d4896764452b30cd107a6a372255f7e8104310124dae9b1d9a6fbf5afa6c08007500746c7300080082000002000024111700e17d80d11f17126eea2927afc1fa6eb44336362cbc0d9d66d7f6baf73f42c324754dec36335d0fd683f90ec5ed54ced23bbfdbbf2556fdee565d935a1dc0617e810cff1b5c759521225f6164008dfc0a13f239a708aef0a9614de03b9f4b73adc6c13d7e00cca5b03d2ffe540e50e6565e3242489182c33e1ebf50a557afbbfa6ef9becf898ea5729c4e854039635f8e842c489fa401fa14bd5c5bbbbd5f87f7fd7239599b3b298b35c7caca4ce6efe7002905dd39186394a2dc472a1195fe304364c508877bd2db036884e9bb31e483f53028fb482ce789a442c4e99c680416371c0a71fd50b77406c77b0a1abc6cc5e4476c1b0c63f620521b3392915539b770bf533e4a983b776e836ad8901ee61d4ba84047dee36fbbaf81d33766f80c4f23a2c4cda70f053d6d6d1f42f5bc564bc0aa00b16096d0aecf0fd2bbafd2a2526ba6695c8532e6c678bda3733d12aeafda6d5694d74b9b41069e3403bb5192bfffa98ac136b6d8ef64ecdc5856c61d24aa6655dfd159746f052e1af006841788b76bb8f7c7e18d5721316e4b70a69e1c5e63cb154c5ad1a885587ef1cc405ec88f6bd6656ec39b9a5c2bc0f292033a5fc1e95ecdc4dbbf6896101c8b8d33931a303c0196c33453a4ae640e46c97c85b8723a84c2c62d9804b1590b2c2139e27268a63dc6fba02bb0d05bde38d571444aed1a42b9a475139c50d0f239a4d49e19b651fc3a632845d74541394a7678d988d6b8c72d6d53370f1f420cd13cd64a17ea5b23ab7e013866a3c0c5e44ab3a7a76cbd118328a27c6400c01a6bf1314d90b6efabedd9243e813229a46d91ee5181912d5e0ca7de969c809ffb7e55ba9280cef280c57e01734a03000de947f187bf7c0d46f1982c70cf2fa6af00cea3b2535708752c62ca68395c5afced2bc65fd7ae0d69a64d2475e775e293eccd7da6b978d3f9ec37abbb35a812548904bf7906d13d5b80c7bba4d639a79f6eb95340b85f8d8e0f0bf4da1377e7f772eabf75dbabb2003fb48285f9fc5e2009b4c33a554101dff65e15b2d83d14b99ab14e8282166aa1518457fbe66e2fe3d53648aa9ee52943ceef6b3fdee836c0da3aceda7c53ceb591dd3f706fe9db406a8edb3ee10f518aa331d6d821cb50268fc76dfe465f1742ac4fc1c5c33e1ba9624c4ecadfc4772e0fd3df16822c7ccb34275df631d8220bb750d044909c66bc36c3cba6c240e46ca9a5e256051fea778c9d3bd7dd290f395ea8eebc23ccd63873e15341aa6140daed009d69dd3c4fe9a5bd25ef72fd57bad6c2337938492f15acbfce18ca7d176aefd834ebeea51855d0fe7c2c8127cf67d038d3edc2d4dd150fda977f79af5cfe91369fab08c31500f534d677eb1eb56c5f687f64df4292d8fdf601482c4764a9c72141d9a62b6aa991b053df98b80d162c5030bd3730bb0686da101711eeedd00f151ff257122e2276d870a76b8744f708a9afd4d6ef05c14d0dcde80ab8546478c631e41ed4f8210ae61493b01b931451d0c9da897ad67d48c9a9df66ed9ddd3d4d7b72961f1d547fd39199b7f90731d284e77c66531fb56f09c577ac83d55c6ee096a88ad1d6b032af9c537c7a0812dafdddf276482bbbb462e852c2384cbbb85fe15560e391bb822789fbae6872c3028f7c026a9e56badbd60ab5a562a94593fa00b4ac62ee9ca79a114fa9f8dc2411ce6fd06b8da096ab8a91fcfb73a794e6d1ab1df0c3e2c65d016256fb86f54d96bea76edaaf7315cf99e629cff394e1cf2ad0b9c0393f7f04c356d9f63ab10af7ec97294e89be56770e560d576bb1f94ed80c66664a85440b455316e94e496e97cbbaf62bffb19cdbca192907f8155302fc84c24cbee678ac0d83a993bdb89419fa4b2be07df502d5cd2069d5b1fb8a736682a2179d33702e964b2cf6d18eef61954861e0c602f28ac87e2f7fe13dd5203ec4c5659d13f9ef3ee341cb7a39673aae5005916511403f0ded7d62ce05ab43b0d5febdc76ebb8221612fb2d97bf90a7a25a4947c8df307d1f169c025968296e2a5ff2ee6698be139cc3c8ec76d6195633f9051121e25607241d4908e6485c9f42474f055052c34e6626f250aad063dd48eceeac7fb55a8b0430cb83b60e34e332784ab299818d2f488592726ae6ba302a40903f04fec3fd2db20560ea5a0e32bd785ce67df8e55f33bd83427d3823121c6cf3a4360951ea2c5ccc5454cdba53676c3b941ffa7d1b2420447bc6575bc81616305de96e36eae55aff1f76780b65bd4f2564b2687b228acb922e2c827daa323bad2d2a4b94b3ead5c1ae3a19d058187a0740ee878cbfb6fe9b7c3d8457fd0139ab46a5f6107bd26eefa20dfb12d6b926fda8a861b2753a19e98f6e2567b0d8a5e799344b7842c01c71c50b6b94686ecbbc3b1d00dc7986aa962c75769067d5f0c524d9bd994a7b179c06324db412b0bc96127c351d4fcc5bd4e98a03e82a7e69bbc1c11b98e1c3924a871c666661e29efb27c827d7d31acf1752bfe6373cb36912301e474eeddaa2ebbd16c4265a3b7506bf28cf687512285193333b66e52fc43126efe8a19e7ef364cdcbbb954dd3fb7921c0abd9681f9c052bb92e3994ca551732d57cf40b7dc11f8dc9d35a08d3b219d455e9aa6c5874ceaa3025e6d4d84237b14a19e9609350424d3db1600e70989055816afff9e5596ab64513869c078b39f25abc442e42477e2cd17da4203925f589ae20b6e8a67baabb2b4f9ac799673ecd08c5ce848bd7650948056bcfeafa1fcac04734ed059f799aa40184f8ee8cc81c6a35bd545c8e98a9f9d78a8cb43c4aa66478a1777e97cf4f9ca5f8992319d2e7368025fc179288c5443e4ef58a5a3622bd794dbf04becfd246ad1e08cc3bd6b3f6f8a4e6e9a6c170cad954619ca64788c8dc5adbb1a38f6283201a5a43408628917ec68c825b2137db8fdab93c7ed98179a32717b571441f9e3f98de3ab297e8d72b26dda8eb2fcb39ee017c1d1507a0b452ac3c9110438a647403844963e11ed319d6d82e5de5b8f43e58a45d2528b5aa3f791d1e16a2bf8560d37c6b644cd65ed3551c46b1adcf840f76fdf8331f59fcc7c7785e96c344842d45ca367983eef7e51b9c43a59b112336a55816cedbe13573f859501df5818bb5bf9e0b98274a0664fb2fc2c73db3a48469ad72f5cdb6a3f6e56452f80ac62e51c48bc65f72e09c84e483d65e39cd4abf8cb1c020c28b58f9056005f121f6fabbff179b61f37a7e25bc1dcb8683cb4ddb157cd47866f3c4c3723b918fd346e75b413a5251db21366226d5e35da9b1b04742db16d963025dbebe92e86744ab4bc3ba4912f8309a9d1294faaa0ff8607604a18b7d25da5010befe419cc03ddfb1712ab4d53f4525e7f34086df7ccd5a4e8ace4ef9402309ee3b8ef9007fe118e46b2388788e5c189e4bddf80082d46e7b1aaea777d4860d72284b74b85bed66edbd9431530f65f4c6e0d345396e148d17de36297c505dd9c8a2516401025fcb470a0b8daa5e80160b1ee48bb9926b3342ebc43036abeda8b5066ee0893d8d82d73b106128bce82872f82537bbc114dc43d2720db1bbe92111436d9aff7119551ce5771628feedcb51277d81377afa6a0c567bea01ab3cb3c1b312b1ad451127dcc2c403f9ac94d1397217deca2a29dd1e61e7f5669cf83f99e7d9a56da29d3657a8d065f4f9c0998283aad635712c88e98ab934a3491afe03eac199b969d23f1d841d6db753e9d158b5a5e7f86e30f8a905e2b75b1cb81e0242df022a5eef508a68e5118f7f78c488b4c8014421b7cca8bf146007421fc5cbc5639369549272ae03f8e96a0fcd6d38a905f45fd8172754ef29b1465ab02a47732d64557cf889012b527f9d6d7f20f3af7a7fc1f6bb4409afbe58a2d3042a55843c02a25c41e09426682fa473724c8c1a22b59226fd01824e2918a44806e4e03a6073ce7f059909999cb87735aae1062cefa1408a923c9bc23d9de4f4d0234f4970cdaf2cfc862fbbf4878228f54328bce2d588eaf8b5ac367036f9b75348c81ee66ac6c4f0582ee2edae54d98d94b48e6bbff3977fe7f5e45aa096b775298297e3b0d757781734e89254a696b39923bff89d103d35201a2300e1e62e47ae94dae13767cba52853ea303509263dee702918b26fd4109f97cd440bfae271d6734757b06898dcf39052f8375837dcace860b00d9351b518874f9f760f446fde1c26eaa2b48da7c8987fa40ee09b80a82d97f9fce122c73713df7a4bcfb0676d5c72a87affb30f9fbf2d3826e70eeb9276237c3c8586cacd0b42cdd0042a80f464c78edb017f9ddacf267f7c281a3cddc5c38f99d1e30c2d774fb31908d51f73835780f0b39055e946974fd7ec650adb4233c53a600a604f71f3ec2b237fd1aa49979d6c03166ddfe0cca798e3e1dfd630ed56923beba1442aa0e0af6a3dfa9ee822196b311cfc8ccd7cfa739f8482c64100192b2bd1c1746db0c2940fe35a754c367195e2316511f2de36fa9e8aff7110aca9ab518198b39a3bef96d20165d7d649ce86650d1a683878333905cb8c045a1e1d8d319521c67e5997ab707335e087aa0a69777590c2ac94ad46c9f915b883b21ed300e57650de8b270f2b98a982fafcaa245bc08341a008e0f9cb4874f0222483fcacb78fa85ed39d3f78f6d4b757d9b6d59127f978c1043c37efc187b99d7abbdeb32896e2c9f8d7c5d6d8348440e327e506ca6c0d58c9cf407677f603230dd742e77ee45f8904fff2bae08f605f7e367796b1eaf465da13909ea5bc5db46c4d3f92f017f01e19d54bd0fac6c010915115014184baddb75967d5152ef0bbc7d359f5c359884efb0aef687fa7d21fc1ddb8482857f130523854ccf53673323f0c0a80dae70158631520b1f1c3b79ff717606051d9c7a687ea34706fa61a564209c22de4e5004c9318c9f07ae50e9c3ddef4e4a9ac56af00ae4e32340c599080472aa6bc95aaf5ad8693651197aa8374f976aea61dca4b0ec03025698719bc13bf09f86c502b1ee414ebec4d1ee83779d4fc8589ab1ffb570ae5675593bd1817e75a37464080b8507a3b7c4fafa3e0781d605c6af13f526df7b8516780621c4ae00917de018fecc3159f00edd55285cb78c705e70e938cb13bd6f1adf61099e72126730583dbbacbfe517ef64733ba27bb2f9a112533475ebf20dae7169d860d560dc88c83903b22f80d6efbfa80d0523cf488a2584cc886ea4bac902f9ed2e744735aea05e50c3db2a867c9e52c8d6bc49e9f700adf9b0f10febad7ddf00c090281c7f494e689434c11960468972744727afe8e3c7fad3adf1a61a27d4706b84e7341361eb558fac6b62e1a1771a4ae218cb958801226295c0bce88892ca8151e6492a8573d104b084769a8062aa5a2319b315d637a9a240702d49893421d1aa76851690654f71681a750297992f28b589d362b5712816ecfd818ed1565a74424820833660f5b2e55d2cbcfca796d13410afa7b6eb66f3bc99b2fa188ddcce0d775de077709b8258e858f6d7719e0a4cdc65ddaef4ab14bf3e7da3ffa736b99e942e9279bd1020a77560394dfee536ce59a92097fab7541fd641ac7c5b9d146da32f7aba02f9faff5de9b35a51f819dd7d3d3ba684c5c92ffadacdda408bd2c0170ec43ec581f2e0f38eec8e1b34bdcf3c951d895e60b9a84c0cc63bbb1fefc59917bba560fd9a30e28a2b0ad78267f27f6555107fc7da1131eb75e7c5fc66193580ffb878c1ca704331d26fbae5d5a16d21c32af6e9d809ce20f102fe06f1601e7b597af6d4cb808ec03112bbc1c0d959c76fda6d549ebb03e0e0f3a27d124bf64f6d6bbae3d281b65730e9aabf91c55cc3c9ba85f85f9d4639d06ce8aa9927cd814a68f2dc0579829b63e85adb9a93de66e05715c064dbf29a58ab4720f57fa618365e2c694e8823478829064bee7e998f6c9afa9415e65688555f2d7a6b4c4660cae445fb49d2ffee3f78aeb48e224bf858d7728f69587046217f6d0e683345ad9678613084af46ea3f4115e20784b9b92017733a6ce5eda10055667b0a1eacc55e578d118f3a7f3ccc6f49c143bf0e233c3f71e96b3eebac8c24f806f7af282d05b4604208008d007f0000010400700008001500ffffffff677a74734d190f065f2075ca81bd27a9e806832745a80e6c285a30fd00091ee582580dec602b178bd76e8d1c7892000000c3b32c10770f86483c8c8aa8e314e1ba331742ceb2dbe3588212941c75a6cb2597092b861118f5f745a787297e50f531f2da6fd57f5208cea78642554c0ab119df837a8e369e1cc5cd8fad7a72121284fdf6ffaf7bfbee16b64b38b7e284f907cc557dc206802b70c973f4e751b1661e931e775a4598225c8b2375efc32ce9e9e777cf819bb24c32de2793e1e14526efff3b9c4963c7cc5d590ee131667c2bb9280d5d2fe6ef89dd3e396be8c9279e06de1d11e374ec63d48a792a719de06587ca53815cd0bdc76c462ea409a568477ecae62d4ab293da76ca724c336ba6e96a38012200fa644853b4c089ea1ac40d637da721f493cc4755740695ab16434f30578cbcc4100e9aa888cd7e98d2b13e256494770405e4b93a09a2ec2d345d4f56de15ab3659ca04dfd888cf659a45422c5f31e8d36fedbbcbcec074888b58c40ca43b9bc39e1540eafa67d64ac5ee4ac1ace37f6da78f277cfd4557089250b2397ee7e261a8f010a06c60828589d7d0daec0a1166b313f7005dce8089f472fe130ab413ef33664d1a2b1fe72d723d79386a9b861d79a6e990c392b1a25457b33054bba467dd9b807adf476050cda2c4590f491d74ec8545282283db35bbfdd9b88720a69dad5a051689dedfdf809a89f747689de546f04bf678f13104dc0287b2a77358b3e4de2448096c0a1da9894de511d577adc6809942f21318deeac410a7df7e5b7ce3c32dc3f479e331e7ad08008a00"], 0x1430}, 0x1, 0x0, 0x0, 0x4800}, 0x4) r1 = socket$inet6_sctp(0xa, 0x80000000000007, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000280)={0x0, @in={{0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}}, 0x0, 0x0, 0x0, 0x0, 0x19}, 0x98) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f0000000180)='tls\x00', 0xfffffffffffffd7d) setsockopt$inet_sctp_SCTP_AUTO_ASCONF(r2, 0x84, 0x1e, &(0x7f0000000040), 0x4) getsockopt$IP6T_SO_GET_REVISION_TARGET(r1, 0x29, 0x45, &(0x7f0000000080)={'icmp\x00'}, &(0x7f00000000c0)=0x1e) ioctl$TIOCSCTTY(r0, 0x540e, 0xa59f) ioctl(r2, 0x7, &(0x7f0000000100)) socket$inet_sctp(0x2, 0x5, 0x84) 22:56:08 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x8000000]}) [ 818.278253] binder: 2653:2662 BC_FREE_BUFFER u0000000000000000 no match [ 818.313936] binder: 2653:2662 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 818.321159] binder: 2653:2662 got reply transaction with no transaction stack 22:56:08 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x1c000000]}) 22:56:08 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x6], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:08 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x24, &(0x7f0000000000)=r0, 0x4) [ 818.328619] binder: 2653:2662 transaction failed 29201/-71, size 0-8 line 2759 [ 818.346416] binder: 2653:2675 BC_FREE_BUFFER u0000000000000000 no match 22:56:08 executing program 7: syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)=ANY=[@ANYBLOB="0180c2000000aaaaccaaaa00080045000030000000000067907800005004000000000000907800000000450004030000000000000000ac14ffbbc0000001"], &(0x7f0000ea3000)) r0 = gettid() sched_rr_get_interval(r0, &(0x7f0000000100)) r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffff9c) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000540)=@nat={'nat\x00', 0x1b, 0x5, 0x538, 0x0, 0x0, 0xffffffff, 0x110, 0x110, 0x4a0, 0x4a0, 0xffffffff, 0x4a0, 0x4a0, 0x5, &(0x7f0000000000), {[{{@uncond, 0x0, 0xc8, 0x110, 0x0, {}, [@common=@ah={0x30, 'ah\x00', 0x0, {0x3, 0x9, 0x1}}]}, @unspec=@DNAT1={0x48, 'DNAT\x00', 0x1, {0x10, @ipv6=@remote={0xfe, 0x80, [], 0xbb}, @ipv6, @gre_key=0x5, @gre_key=0x9}}}, {{@ip={@rand_addr=0x1, @dev={0xac, 0x14, 0x14, 0xc}, 0xffffff00, 0xffffff00, 'lo\x00', 'veth0\x00', {}, {0xff}, 0x21, 0x2, 0x22}, 0x0, 0x98, 0xd0}, @NETMAP={0x38, 'NETMAP\x00', 0x0, {0x1, {0x1, @local={0xac, 0x14, 0x14, 0xaa}, @remote={0xac, 0x14, 0x14, 0xbb}, @port=0x4e23, @gre_key=0x8}}}}, {{@ip={@remote={0xac, 0x14, 0x14, 0xbb}, @empty, 0xffffffff, 0xffffffff, 'bridge0\x00', 'veth0\x00', {0xff}, {0xff}, 0x2f, 0x3, 0x4}, 0x0, 0x198, 0x1e0, 0x0, {}, [@common=@unspec=@conntrack1={0xc0, 'conntrack\x00', 0x1, {{@ipv6=@ipv4={[], [0xff, 0xff], @multicast2=0xe0000002}, [0xffffffff, 0x0, 0xffffffff, 0xffffffff], @ipv6=@dev={0xfe, 0x80, [], 0x21}, [0x0, 0x0, 0xff000000, 0xffffffff], @ipv4=@broadcast=0xffffffff, [0xffffff00, 0xffffff00, 0x0, 0xffffffff], @ipv6=@mcast2={0xff, 0x2, [], 0x1}, [0xffffffff, 0xffffffff, 0x0, 0xff000000], 0xffffffffffffffe0, 0x3, 0x74da5af5f75cd18, 0x4e20, 0x4e20, 0x4e21, 0x4e22, 0x202}, 0xc0, 0x100}}, @common=@set={0x40, 'set\x00', 0x0, {{0x5, [0x3, 0x7fff, 0x4, 0x1, 0x48ccfdf2, 0xff], 0x1, 0x4a7, 0x10001}}}]}, @unspec=@SNAT1={0x48, 'SNAT\x00', 0x1, {0x6, @ipv6=@local={0xfe, 0x80, [], 0xaa}, @ipv6=@loopback={0x0, 0x1}, @icmp_id=0x65, @icmp_id=0x68}}}, {{@ip={@dev={0xac, 0x14, 0x14, 0x1c}, @empty, 0xff, 0xff, 'veth1_to_bond\x00', 'yam0\x00', {}, {}, 0x0, 0x1, 0x20}, 0x0, 0x98, 0xe0}, @unspec=@SNAT1={0x48, 'SNAT\x00', 0x1, {0x1, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}, @ipv4=@rand_addr=0x3, @icmp_id=0x66, @port=0x4e22}}}], {{[], 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xfffffffffffffffe}}}}, 0x598) ioctl$SNDRV_TIMER_IOCTL_INFO(r1, 0x80e85411, &(0x7f0000000440)=""/240) [ 818.373160] binder: 2653:2675 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 818.380646] binder: 2653:2675 got reply transaction with no transaction stack 22:56:08 executing program 6: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0xa1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket(0x1e, 0x2, 0x0) sendmsg(r0, &(0x7f0000db5fc8)={&(0x7f00004aeb5c)=@generic={0x10000001001e, "030000000000000000000001e526cc573c5bf86c483724c71e14dd6a739effea1b48007be61ffe06d79f00000000000000076c3f010039d8f986ff01000000000000af06d5fe32c419d67bcbc7e3ad316a198356edb9b7341c1fd45624281e27800ece70b076c3979ac40000bd767e2e78a1dfd300881a1565b3b16d7436"}, 0x80, &(0x7f00000004c0), 0x0, &(0x7f000016cf61)}, 0x0) [ 818.380665] binder: 2653:2675 transaction failed 29201/-71, size 0-8 line 2759 22:56:08 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x2, &(0x7f0000000000)=r0, 0x4) 22:56:08 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a00, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) [ 818.484622] binder: undelivered TRANSACTION_ERROR: 29201 [ 818.490361] binder: undelivered TRANSACTION_ERROR: 29201 22:56:08 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x3000]}) [ 818.555623] binder: 2702:2705 BC_FREE_BUFFER u0000000000000000 no match [ 818.586398] binder: 2702:2705 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 818.593569] binder: 2702:2705 got reply transaction with no transaction stack [ 818.600967] binder: 2702:2705 transaction failed 29201/-71, size 0-8 line 2759 [ 818.613372] binder: 2702:2708 BC_FREE_BUFFER u0000000000000000 no match [ 818.621744] binder: 2702:2708 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 818.628863] binder: 2702:2708 got reply transaction with no transaction stack [ 818.636225] binder: 2702:2708 transaction failed 29201/-71, size 0-8 line 2759 [ 818.718220] binder: undelivered TRANSACTION_ERROR: 29201 [ 818.723919] binder: undelivered TRANSACTION_ERROR: 29201 22:56:09 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) read(r1, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(r0, 0x5409, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000016) 22:56:09 executing program 7: dup3(0xffffffffffffffff, 0xffffffffffffff9c, 0x80000) socket$pptp(0x18, 0x1, 0x2) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)) socket$pptp(0x18, 0x1, 0x2) 22:56:09 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x1000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:09 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vhost-net\x00', 0x2, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000040)={0xffffffffffffffff, 0x28, &(0x7f0000000000)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000080)={r1, 0x9, 0x18}, 0xc) ioctl$int_in(r0, 0x40000000af01, &(0x7f0000000300)) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4004af07, &(0x7f0000000240)={0x3f000000, 0x0, &(0x7f0000001740)=""/163, &(0x7f0000000540)=""/246, &(0x7f0000000640)=""/4096}) 22:56:09 executing program 6: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x2, 0x11, r2, 0x0) socketpair$inet6(0xa, 0x806, 0xffffffffffffff80, &(0x7f0000000440)) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, &(0x7f0000001040)={0x6, 0x0, [{}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}]}) pwritev(r0, &(0x7f00000003c0)=[{&(0x7f0000001140)="36077c7bc353d97ab4150e571bfa2402e2603fcb0aa22f1ed21dbd233e99a8f4b2c14a40ed0359b3912a7b1b47952982fa6c7cfa8e6b181d28f3b349e12eacd9b588be7bbebe747fb2107f06b4e53b260e08f68ab5a1b17bb7d928f342add13338dc34053f077b0a366a7ee69a24d3d0a96f23e987f51ee0867bfc83d1e0d8ebfd0ef9ef6277ebea457081145d8dc6ed0048e7eeb69d87a8accd151653b9aeb4a24781e84f02c888b1bb5bcd1b7779f2b7bc7cd7b35500b50214fe6431a8d1dc16e64e7a7a5f064fb8329039cff41b08fc4543c056627a210e16a4f9f4d0eddf0c232c97331e48323b154da10a6693de5da7595eac51d81d0f0e363b7c5185ade285fac9717274563fa7b68348fc4412d4b601b786b6e922bec709e0e84935a5271125009c74b3819271f2acd8333f23d7f9e5e2f531b086c7101bbb501a65f5dd98677288847394575361aae744bcdfddcffbd6cbd60d2204ebf86dc85a771eb27a5be9a8085503e74de0ff4978ce38cfa0c84ebd6df16fdb5a53e56112d319cdc4161c727004b40e1d813b359d57bb0410133614ca13a4112d3ead57ae30637bd99ed3ff3618a97dc12303133932380fa56a1023c541f2b5143c3746622a99e68682a911b4282cdc73c9eadbab6d90335b8f211e346443c921a5ce48fa72fd8e219d9fea5dac1540de10fc9653d372f30f14162f2276b2c12616f9aaf58ee1782142b26675e77922e3f28ccca20a880c133b745fd909219e8acf502e142cf38794e52b385a4c7263f5d56deea645c4bcbbecfa1d23d45ab2c3f45e43a9b63265f6c5ae9605b7f0f7eae91fb4a62dd137f76e946387de1d50a20355722e38f2e7594abf2aa551c23812421468ec5c5a7ff246658bd8262821a5711e98f26c81fa19e0b6511720829a56759a7a8b94ce8649bfa4888a8d2ca8c2676369e2760d44c38bd2f5884ac6b59134f39392d53e6b71635475b0b2d082a6b466b1e46c6a1443abaa179fcf785d33fad65c1932d308096f0a9e2f94afa8d8f69acbb4976a9f2c4bf298091faab34b36035c0fe87345760f543c710558e255f463b5440875b975f76318f7ab276e1df4327023e7459df5f8f507662be98d204824349d7e206e5a8eb5d36629c1532ec39f444a1d2839cb553c8eb27b5a8807efca3edc8552e8e95320186555106fff65fec5d68813dabf5571006e23c6ff2e2665713a54105632c0e007d7dd1ec407254b52b6410ca8e911d07613c70f8941f32a5d9d92836ba4f3e2da3f59b99913524a51d815447adffcd6e7029de793b512c6b5e0807267edbb4729fb1fe47f0a6c4fa725c153dc3f9a56a802aa4eb1adfefc4e0ab187b9c75b0c5dcab49a1d63a6fede7f1c3c0bdd926917090eaad2b0185ce83032ff981f25e27aa3e4a3cd29132c38236f9b7bb2635fbcacae31d7f2f88db28c73634de44a0e8b551b831a0659079ce87c171b24851b285aea603caa543a949abdcdcc1f9e0aaa3093075d570b23cfa22eb17cfe7bacea38a9f2e3f9fc0c9ab747ac4ad76a3f993bc8bc389904851d114e7961fcff83428f18173786f90ff353b800351c71bbe6e7e746aaf2baf3077bc2602391a620b910f97ca9945754607eaac9a18e144a2bc2852a055fafe2d0a3614e3f589e1006ae990b7d8d7295f4080b7b3a3f8e92dc9ef395d27cd5c76de3b1b869d5821fcf08187087825fde7ddf18a9ad27ffc4fcf9c5e261f3c166e8aa65317a002de7e584f3d5408f813ff04b001656ec93e480378ca901484b92e77dfeb84957c3ae6d08cf8d65348c7d0eae31b35f068458e8077263c20be68b2087caded5b039bfbe3d259e29cf6c0bec0953915bc6ce9dbaf8d248933781b153c66ec5d73b2a3d3a3ee03be054f2d6d7660dcddec7f014b609e25d3e19fc581c822b8d22592ba7b19f93ab122dfcb9c9258608ee595f187aeeb786342bb86933da9955f52e12792211d17467f216ef91869c31bbb2477987e2d14caa6c349b9e7ea6e494f6cba3fda71d0e32f429edbe56f54a379278b7765bbf080be28b376c7c1ce63a90b08e010065f3c3f9e24601c1f307ea2ab689f7ad26dd77adceb195bfecc192bff875d7c3094f24541e1f047b2ed1d56de207263e3d8ce992d9d31706907af652c27ae61d1f1f5e130f017368ef65a6059eeda98ced4f97d28334a2d0020ef3f95d2d5b93552410c1073496d20f84a630bd968a72d84301cfcd4b8a09455e6eee2fe6a7c9a3a5f9ac936ae186c606e4fd1ea4e01ee1ad64f4802afa460288804127adc1643ab95036a7aee58fe678716c68b7fccd22aeb16b3599a1463da22c74748873654ef43189654d04f0a865759438bcaab5192ecc7215e691c0381830375f31b231d5b545a779ce53e62af1bbfe3664dec56355a7367947fe0ccf57463715ba478e73f68f05f27e8b247d5202ac4b9776e84610e67eece9c1c3221799914a6f99f029cf72ce022e3040888e4fa70924375dee0faed336eec366ca6e29747ee8b5c04aba1a5b28cddb2381cbba84e49e19dab3f19c33da7ce42420593b29246ef5c2fd74d1f7b10114bb7ab035f2be59272076b618d228f0dffb038984d318a21a7d4818d2830ebe978b209b4b01d2af1e3372a4ee443f7ae7df3f0f5da8ab8badb0ac47e2f1718fd82bfa618e049910b434c7fdc436c2c835b06ebb28ab2c27f5226c4c7d1e7622a3f4d79968fb112f8046aee22bb23ab91472b67fa19fd173fa8af0fa82be49ed4c9e8d16e0204b153b948f13cf420096517e734c4ae7a6e70472707583a4f0426d8514beb0a64f90a8fe14a721476f2559247a738015256da9485dad02fc6e7e705df5ddc9e00ad2526b3dd33ca76aa0acd7241c841a4a07cc546b2103d7c0f544b9b00101a12cf44475c9569da693944af80abc5b6a13e59f7fce77ea7e79db3ed82c0b83f1b21b1b1ca075229fa947c0017c0c6f2e67951d316f9b0b36f22d6b0dcdd9f767da3ee0580a31abac5626c5270617ee0e7cb9cd3d53d1b8fd46b2e2d745e614fc9654189aff43196526145fdb39ee5beb32f4a30a58d8becc6b599a453414ece641b69acd656e1b4b69012ce953458798e2b8f923eba78ebe1d1b40da789b7cbf44b292dc3855ee03e843334f260e5708ce0c7a764edf4a76f0e52537f6e4b9b29fa2b5262022e1b93e9188ab274132252ec2f6f7f2463087947316028aef07b9d1d022c276292018e2ff3ea87625142812bd032720837bb676be87d7c8e01bba7f29cc2faa13577c1fbf021410f639165c7382b86b585b8f251eb9c74a0c68a6028acee58fb4f5d7683b9f61f0c59cce614c0c45ec134424ced987488fccb479529ff30c401d6f4225b693357cf64d765090ff2b13258dd37a324a47f3c09cd3ad9593802ff005927a2bd60331810f396a8b17150fd03bca673acfda8b6fe01945591419c171abe7bc4a559ecfb9e804885c34e2e638f12a09008d4c859f46594700ec6cc8daeccd3905fb7fead644274bf1623e241a466092c16f2eb1b513f1188341427313160d3f269593f21f8fe6d994c421739e4058dbe1866044903c4355af09a4d91ef96b40a8e6cd812b8fd92ccc5a12bcf9e76a052f9eccbe5746603e4d52923bf0c57b4cc73cfa2412c8c1a2839b3da52eb747bf8c4416d2c19c88a7057197608d9fcab57e43333aca228d13abd22c9392b06355d999943fb9a5a7a0b3b84a1828baaec57bb0ac6413e6fe801ef35e2d43f530386a6f44377d977a6a9505c881b0cb2068c42a54034f2bb0b94c1461f71a6f7f6eb904020fb572c25586a8b78b3270e411273b4be6fb9d48af628a84b5cda79d1428582277c721c34369b53f1491e44851cf28936373adc213143d403d80d8327f1cdd4066fed3db7c638c61823d806c75f29ca81c0ca045e5bb8d991a32df8166d96bcaa8df06d19c73612a908fe9aa5a07cadaa5cc281efc4fd2f44c67dc168680835f69feebd48bbfa99367abfdd0ae397fc4da165f146db8c4a0728666b66072fe33dfddc5676357aabc5f87e7f5d948376b5804e7cb4b9efc64de9014343ecb80cd234184f35d366e4955b3ab936393810fba54e2b864a4dbd9cd93df306c4c52788d7fce66274d4e9e7184c015ef3a7e803b7094f4eded4d7120dc3ff03f218c75616bf52e3a8731a416edf1d7ba0e1af4c7ab84d40e62cb94cacf563fbe9970cb189a75f0e8a26ecaa2240fcd54a85ed418c53d71534294c864a1655e7b9c161c5400465a58a6956d304312525e56200ec175383d6693799c32bd08e7a744cc2818fd26e69efad54e0ac51a9ccbbb783a8490e38f2ed156486282baf3abe7544f79eb266f1fe9bb9acf3835161b82006d36ae2537c6eefdcdadae0b90911d68307aed077897aefb38b48893a6dcf605f1526fc49ffc28791d5aa0e0c2d660a87cfb95483d7a5442d683d7fc54dd259902f9b21bb1c0b8482b433d1eb0c3015f406700b42005b63616c9930f2bf8a946778b564071eac38bf4cc29cc7fa134505142d8f93bf95f85adfec0a7f56f8255c64083f909d90db3c536c65047b054a359ad6d532587c7ace4bc857d1cba6f46d5defe99f60fdb019b0e98544737c3ed9651b03fa806590a167930c2ce23a6f0196b7fb0ffa66d088c879fc2810c62582fc434388dc40e4b04cea3a21a0fe390b323b546d548297e8a1bb2632ec523ddef01a55326f8e3106ada46ca0bc2d37ab8c326ae39845d29f91aa76bb432f8c2666c0989a29b52507f0b2e1b81822dc6843d1a32ed342548156b930af97f47c1aed0594060135d520aad444a3acaa13a4d4924b4448c4d498e3d5fee82d560850300e587a770694bb0d6400dccea42c63a57c71422d9ca57a89c3049709df6dc255551bea4c99480eb7cb31ea5c8d9a0a9552aa345daf5c4633e12f5e6c0f0507808c477573f48560978e15ab4db32645dae9025b7c962a079789cb5ea690de8d354ad65c1435e7a7220cead4381b6442807e5a42c9554ca2bf3b92101f0af1b528461adea87d8111e7a79777d8f275620da480847ef8fa316d325e260b47faea84e98a62e78b7f421ae2b80b7d723f8f6b53e16a7698dab750c40a545a7d8f0cfb8098106e019ca5a3c2dfac90a520784dca547f03614ee833d1416c2c64f55de826401d1e7097353db8530d6b5f881453eb4e86e3269a6b58c6737f5221ef1b4397093d32d48e818c773760905d5cebbb1261c4d956d37f95fe2d09ee9527340275e3facd0d4020b312fd62566a3e82f9519f0bacd42b2da8b5c76f50670569c3e9d671e9a1ccb473b3a67d20b5af34a2b2376380f88739a4796921db53b73cb5d62b12b6eff796a0c87c7ad94af847329951e4f85cf53469cec4e4f77d207870101219d8b1a01c8eb9aae908445755bd67d6a87f73a9d47e5cac128d13281048e2d6d900e9b735f9b51419dcffa548da7e88eb50a795302b90373b77bc4ba49a6f4e71d0073a324a5ce0ec8ec98f15b4f68092773e9a652faffaf062b6381cbb914320bff8219bd26df2e26a656037994c83949fb66948f053fb3f5fa93e783eb92dae05142d480fb5673fac99dd6b4dbe7aa1830574103c03227a802c73c3bc53ac9b7a0e5ed42287a6353ccb0d7b15b5a4b73d118ea6d9f3b29566d2851b988d57a0418204c5f1ed697409741bea0c0f2e2f46be3ab09a729bd3c33905df330b2cae6a25b3949db54637c607c75ca9372848bf6c5a8159a55f765a470d5d9c5e73ae7e405bacffaba921628177b5db1a546fb934f7e40dbe0806f81d5be7e204e", 0x1000}, {&(0x7f0000000480)="cf4e441628407f9c5a358f2f94b4e536f3af15ecfc513caaabb7cda93b0da9d21484ec73d16647f46ec0ecc12f4a217c71cb9e96ddc6d0fe7807eb76bcfc529000850820cc717d3f2d81845c14c25b229ba298ede20940e2a555ff51113af6b201ef8743ba85f78a19f2899cc20239436efdb7e1c1a19c1ad2b96c8fbe5dee8b32fbb17e31bafb32fb0a4c18e00c2affcc8e682a563e3d29a3218e59155c2c337d456cc6f2cf11df4eee", 0xaa}, {&(0x7f0000000140)="6d7044ac6ebed5d9c756cbb95f88f5f81053c5103c53fc737c1d33c212024c0e1a4d006054d955982cabf34ccfd4bc9d28d21e5560f8d0d945707b5e098da06bf3b6a1082a96e0462b70b099877fb3bafb19c3e0185f97b97a42b38bc97420e9a29686e43343e88badbb5d34d7cd01ed9145e053366c192273c4ffd05a2f2bf73f595c2fa167ca886020b5bfc77647ed", 0x90}, {&(0x7f0000000200)="e8ad9773948a318b575544ee63c1f427844acb9dcceeeb8d994e72ae85138a815269be0f02343f23a610ddfae2a73aa0f0002b54f241462e3d734ed43b2f91a91f3ab712225db0cf6a88b3c415bbf7c8", 0x50}, {&(0x7f0000000280)="74d94dab7de0c127967dd5052c12182981e64b8f0a8564e380a69a22214ea6279a11d47105a6c50b7235725922485196ee433fd02f3a509456363dd1e0ba6cf6677e57bda5a4c6368a4e3d1149e305a046411c7d138fffc0fca68518f77446ef6e4a", 0xfffffffffffffe0f}, {&(0x7f0000000300)="146fc7e8865a4628406dbab92877f6fe1cc3b147da461f74acde0e2fc4c4693ee2387fe61c2768509c6d7d29406d8cc3e01037beb14d98945f16d0d619de82b4786b29a4413009f1df7a4040345c36c443f337ded743d3f992094c7bfd16b36f6bb1fad82a026c8410c9d254990fb3", 0x6f}, {&(0x7f0000000000)="6a29f48402de19c770b84618d4fbfe867cce51c8aba41db4e372048418c8c4a78d22ac333b966b79b226910556a9", 0x2e}, {&(0x7f0000000380)="80cee2909f3bd2b84a5885e77dfa191cfb1feea91bdaeac78735b3cb1ad42e984a680a", 0x23}], 0x8, 0x3) ioctl$KVM_RUN(r2, 0xae80, 0x0) 22:56:09 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0xe000000000000000]}) 22:56:09 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x31, &(0x7f0000000000)=r0, 0x4) 22:56:09 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) 22:56:09 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x4000000]}) [ 819.340547] binder: 2731:2733 BC_FREE_BUFFER u0000000000000000 no match 22:56:09 executing program 7: r0 = socket$nl_crypto(0x10, 0x3, 0x15) ioctl$fiemap(r0, 0xc020660b, &(0x7f0000000000)={0x10001, 0x6e, 0x3, 0x80, 0x5, [{0xffffffffffff0000, 0x1, 0x0, 0x0, 0x0, 0x800}, {0x6, 0x0, 0x8001, 0x0, 0x0, 0x800}, {0x8, 0x8, 0x6, 0x0, 0x0, 0x80}, {0xff, 0x400, 0xc6e, 0x0, 0x0, 0x8}, {0x5, 0x40, 0x1e4, 0x0, 0x0, 0x80}]}) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)=ANY=[@ANYBLOB="0980c2080000aaaaaaaaaa00080045000030000000000067907800000000ffffe4ef2100907800000000450000030000000000000000ac14ffbbe0000001"], &(0x7f0000ea3000)) 22:56:09 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x2b000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) [ 819.402199] binder: 2731:2733 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 819.409360] binder: 2731:2733 got reply transaction with no transaction stack [ 819.416787] binder: 2731:2733 transaction failed 29201/-71, size 0-8 line 2759 22:56:09 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x14, &(0x7f0000000000)=r0, 0x4) 22:56:09 executing program 4: stat(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)) r0 = socket$inet_tcp(0x2, 0x1, 0x0) lseek(r0, 0x0, 0x0) 22:56:09 executing program 6: perf_event_open(&(0x7f0000000180)={0x2, 0xf4, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r0 = syz_open_dev$adsp(&(0x7f0000000080)='/dev/adsp#\x00', 0x10001, 0x40) bpf$OBJ_PIN_PROG(0x6, &(0x7f00000000c0)={&(0x7f0000000040)='./file0\x00', r0}, 0x10) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x0, &(0x7f00000002c0)) 22:56:09 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0xffff0000]}) 22:56:09 executing program 7: syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x9af, 0x0, 0x0, 0x7c]}) [ 819.591688] binder: 2731:2771 BC_FREE_BUFFER u0000000000000000 no match [ 819.631068] binder: 2731:2771 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 819.638166] binder: 2731:2771 got reply transaction with no transaction stack [ 819.645529] binder: 2731:2771 transaction failed 29201/-71, size 0-8 line 2759 [ 819.726579] binder: undelivered TRANSACTION_ERROR: 29201 [ 819.732191] binder: undelivered TRANSACTION_ERROR: 29201 22:56:10 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) read(r1, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(r0, 0x5424, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000016) 22:56:10 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x44000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:10 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0xa, &(0x7f0000000000)=r0, 0x4) 22:56:10 executing program 4: r0 = openat$mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/mixer\x00', 0x0, 0x0) fstat(r0, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000040)) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x880, 0x0) ioctl$KVM_UNREGISTER_COALESCED_MMIO(r2, 0x4010ae68, &(0x7f0000000080)={0x1000, 0x9000}) fchown(r0, 0x0, r1) setresgid(r1, r1, r1) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000001c0)={r2, &(0x7f0000000100)="68d982905413c3d54a40e50d6803de609b651114c413d1e7ab43899252758317b395bfaaf586a5c69d91085c62f10c6749affd3fdee1d1", &(0x7f0000000140)="f19882889a2f2b3da8ab5fd01a65e2ce5791fdafa5a0118e1abd666d527ca04c72e1133ce48f0ade684c23638076c9a9040a71cc43f5de28de69c665c4e99af55e5930bfb013b91fa7d6bd2e25222281c9c768e5d664862051a051627036bda51d48b25bfc31e385d8b6910dd9b165c9406f4f"}, 0x20) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x6d, &(0x7f0000000280)={0x0, 0x6f, "ca5c410d43a61f2ad6e2db4d8e45b81f0dbe30e9f5400e6029d59aaa158ee081d194904fe34728accb080372a9bdcabab5603a84ba4a21d849e82f44ec9ae66ba454e27f6b2018a575789f98993ebdbe82c87901918ea45a323778e64eeb62bea18ba01b04d3170a81fc588ee114ea"}, &(0x7f0000000300)=0x77) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(r2, 0x84, 0x6c, &(0x7f0000000340)={r3, 0x4, "f7090355"}, &(0x7f0000000380)=0xc) 22:56:10 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x6000000]}) 22:56:10 executing program 6: perf_event_open(&(0x7f0000000180)={0x2, 0xf4, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r0 = syz_open_dev$adsp(&(0x7f0000000080)='/dev/adsp#\x00', 0x10001, 0x40) bpf$OBJ_PIN_PROG(0x6, &(0x7f00000000c0)={&(0x7f0000000040)='./file0\x00', r0}, 0x10) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x0, &(0x7f00000002c0)) 22:56:10 executing program 7: r0 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x8001, 0x200000) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000040)=0x40, 0x4) 22:56:10 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) [ 820.407879] binder: 2790:2791 BC_FREE_BUFFER u0000000000000000 no match 22:56:10 executing program 7: fcntl$setstatus(0xffffffffffffffff, 0x4, 0x2000) r0 = dup(0xffffffffffffffff) getsockopt$kcm_KCM_RECV_DISABLE(r0, 0x119, 0x1, &(0x7f0000000140), 0x89) syz_emit_ethernet(0x0, &(0x7f00000000c0)=ANY=[], &(0x7f0000000180)={0x0, 0x2, [0x7e0, 0x0, 0x0, 0x201]}) syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x210000) 22:56:10 executing program 6: r0 = socket$inet6(0xa, 0x10000000001, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket(0x11, 0x82, 0x2) sendmsg$kcm(r1, &(0x7f00000001c0)={&(0x7f0000000000)=@nfc={0x27, 0x1}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="f7000000"], 0x4}, 0xc080) socketpair$inet6_udplite(0xa, 0x2, 0x88, &(0x7f0000000080)) 22:56:10 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23}, 0x1c) listen(r0, 0xffefffffffffff7f) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r1, &(0x7f0000e33fe0)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback={0x0, 0x1}}, 0x1c) write$binfmt_misc(r1, &(0x7f0000000040)={'\x00', "b907"}, 0x6) accept4$inet6(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, @local}, &(0x7f0000000080)=0x1c, 0x800) 22:56:10 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x2e, &(0x7f0000000000)=r0, 0x4) [ 820.449064] binder: 2790:2791 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 820.456347] binder: 2790:2791 got reply transaction with no transaction stack [ 820.463718] binder: 2790:2791 transaction failed 29201/-71, size 0-8 line 2759 22:56:10 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x29], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:10 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x4]}) [ 820.517958] binder: 2790:2807 BC_FREE_BUFFER u0000000000000000 no match 22:56:10 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x3c, &(0x7f0000000000)=r0, 0x4) 22:56:10 executing program 7: syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x28080, 0x0) syz_open_dev$mouse(&(0x7f00000000c0)='/dev/input/mouse#\x00', 0x7, 0x200000) ioctl$PPPIOCSFLAGS(r0, 0x40047459, &(0x7f0000000040)=0x60098) ioctl$SNDRV_RAWMIDI_IOCTL_DROP(r0, 0x40045730, &(0x7f0000000080)=0x10000) [ 820.623112] binder: 2790:2807 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 820.630301] binder: 2790:2807 got reply transaction with no transaction stack [ 820.637657] binder: 2790:2807 transaction failed 29201/-71, size 0-8 line 2759 [ 820.785795] binder: undelivered TRANSACTION_ERROR: 29201 [ 820.791395] binder: undelivered TRANSACTION_ERROR: 29201 22:56:11 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) read(r1, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(r0, 0x5427, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000016) 22:56:11 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0xffffff89], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:11 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0xe0]}) 22:56:11 executing program 6: r0 = socket$inet(0x2, 0x6, 0x0) connect(r0, &(0x7f00000017c0)=@hci={0x1f}, 0x80) setsockopt$ARPT_SO_SET_REPLACE(r0, 0x0, 0x60, &(0x7f0000000040)={'filter\x00', 0x7, 0x4, 0x4a0, 0x0, 0x0, 0x118, 0x3b8, 0x3b8, 0x3b8, 0x4, &(0x7f0000000000), {[{{@arp={@local={0xac, 0x14, 0x14, 0xaa}, @empty, 0xffffffff, 0xffffffff, @empty, {[0xff, 0x0, 0x0, 0xff, 0xff, 0xff]}, @empty, {[0xff, 0x0, 0x0, 0x0, 0xff, 0xff]}, 0xfffffffffffffff7, 0x49ff5c50, 0x100, 0x94, 0xfc83, 0xffff, 'ip6tnl0\x00', 'team_slave_0\x00', {0xff}, {0xff}}, 0xf0, 0x118}, @unspec=@CLASSIFY={0x28, 'CLASSIFY\x00', 0x0, {0x9}}}, {{@arp={@multicast2=0xe0000002, @remote={0xac, 0x14, 0x14, 0xbb}, 0xffffff00, 0xffffffff, @mac=@dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x13}, {[0xff, 0x0, 0x0, 0x0, 0xff, 0xff]}, @mac=@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, {[0xff, 0xff, 0xff, 0x0, 0xff, 0xff]}, 0x2, 0x4, 0x1, 0x1f, 0x0, 0x100000001, 'veth0_to_bridge\x00', 'vcan0\x00', {}, {0xff}, 0x0, 0x100}, 0xf0, 0x160}, @unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x3ff, 0x6, 0x4, 0x1, 0x0, "3b232ef574bc6208dd5cd4b9094b8d875300153d7970f8cb912e34d7a99950d1abce937b48f5d524600ac8becbd590219022f1aa39dc16c0519d45c5ce0b28e0"}}}, {{@uncond, 0xf0, 0x140}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @remote={0xac, 0x14, 0x14, 0xbb}, @remote={0xac, 0x14, 0x14, 0xbb}, 0x0, 0x1}}}], {{[], 0xc0, 0xe8}, {0x28, '\x00', 0x0, 0xfffffffffffffffe}}}}, 0x4f0) 22:56:11 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x1a, &(0x7f0000000000)=r0, 0x4) 22:56:11 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300000000000000, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) 22:56:11 executing program 7: syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x8) ioctl$KDSKBMETA(r0, 0x4b63, &(0x7f00000000c0)=0x7) getsockopt$inet_buf(r0, 0x0, 0x30, &(0x7f0000000000)=""/122, &(0x7f0000000100)=0x7a) semget(0x1, 0x6, 0x443) getsockopt$packet_buf(r0, 0x107, 0x5, &(0x7f0000000140)=""/235, &(0x7f0000000240)=0xeb) 22:56:11 executing program 4: syz_emit_ethernet(0x10f, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], {@mpls_uc={0x8847, {[{0x1, 0x200, 0x80000001, 0x5}, {0xffff, 0x98a, 0x9, 0x9}, {0x115f53bf, 0x4, 0x0, 0xcad}], @llc={@snap={0xaa, 0xaa, '$', "5608f2", 0x8a64, "0a191e56d8ccb8c11b8eb8b55fd687bdf5805f6aca47884ea47c656d9c774fde6d0c1d311fb0f02c0c25120b00584bcb6fa258649f27f1ca244798617ee3939677ae7cf85ef848bd6bc09cd0fd9eb4461580f649fe71d232c87ebbfa7990b2daaa1b238499709da700a6d0beba1778a2b54e46fe97d789c5fba7bb06e98595105d1c405ac23778050ee7d8e5d8015d1abf7dc31a108932e610172de178b0dd6cc4d03b3b48c2322cb58915efeb97fc6f4537ce07243365a494f5e3d581f975a8b8fa8e4c7626e7cb53e9af31452fb4b1c17a76d5cabfe2f08cf175d87866a258b0f25ec805b192bcbb457c242c"}}}}}}, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) r0 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x3c9c, 0x10400) connect$bt_rfcomm(r0, &(0x7f0000000040)={0x1f, {0x2, 0x3f, 0x80000001, 0x5, 0x2, 0x800}, 0xffffffffffffff4b}, 0xa) ioctl$BLKRRPART(r0, 0x125f, 0x0) [ 821.448355] binder: 2849:2851 BC_FREE_BUFFER u0000000000000000 no match [ 821.478228] binder: 2849:2851 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 821.485330] binder: 2849:2851 got reply transaction with no transaction stack 22:56:11 executing program 4: r0 = socket$kcm(0x29, 0x5, 0x0) ioctl(r0, 0x8912, &(0x7f0000000240)="0047fc2f07d82c99240970") fstat(r0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) chown(&(0x7f00000000c0)='./file0\x00', 0x0, r1) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = syz_open_dev$dspn(&(0x7f0000000040)='/dev/dsp#\x00', 0x3, 0x20000) openat$cgroup_subtree(r4, &(0x7f0000000080)='cgroup.subtree_control\x00', 0x2, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f00000002c0)={0x0, 0x2, 0x0, 0x2000, &(0x7f0000001000/0x2000)=nil}) ioctl$KVM_NMI(r5, 0xae9a) syz_kvm_setup_cpu$x86(r3, r5, &(0x7f0000001000/0x18000)=nil, &(0x7f0000000e00)=[@text64={0x40, &(0x7f0000000e80)="66b88c008ec8430f01d10f20a03e66d17293c4e1fc117bd2660fe590387e000066baf80cb8e42ede86ef66bafc0cb806e60000efc4c20bf7b7004800000f00180f20d835200000000f22d8", 0x4b}], 0x1, 0x0, &(0x7f0000000e40), 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) 22:56:11 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x600000000000000]}) 22:56:11 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x2b, &(0x7f0000000000)=r0, 0x4) 22:56:11 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x300000000000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) [ 821.492709] binder: 2849:2851 transaction failed 29201/-71, size 0-8 line 2759 22:56:11 executing program 6: r0 = socket$kcm(0xa, 0x5, 0x0) sendmsg(r0, &(0x7f0000000680)={&(0x7f0000000000)=@in6={0xa, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, 0x3}, 0x80, &(0x7f00000008c0)=[{&(0x7f0000000800)="cf", 0x1}], 0x1, &(0x7f00000004c0)}, 0x0) sendmsg(r0, &(0x7f0000002ec0)={&(0x7f0000000700)=@in={0x2, 0x0, @dev={0xac, 0x14, 0x14}}, 0x80, &(0x7f0000002c00), 0x0, &(0x7f0000002cc0)}, 0x0) sendmsg(r0, &(0x7f00000006c0)={&(0x7f0000000100)=@in={0x2, 0x0, @local={0xac, 0x14, 0x14, 0xaa}}, 0x80, &(0x7f0000000640), 0x0, &(0x7f0000000180)=[{0x20, 0x84, 0x2, "000340020000000000"}], 0x20}, 0x0) sendmsg(r0, &(0x7f0000000440)={&(0x7f0000000080)=@ipx={0x4, 0x8000000000000000, 0x7ff, "0b3aeac36366", 0x7}, 0x80, &(0x7f00000002c0)=[{&(0x7f00000001c0)="bd1e7eaa6988abafaf90b8404c4dc8ca950c0ad0ee30d25a6ec662f67e62e28c5c464398f24a746bc27f93cf6a02", 0x2e}, {&(0x7f0000000200)="e5aeb1fb06de71a2b58c8d99f28701b345782da361838ab3a8328c68a7a2f70c3744acc61d9b6b0871612a2dc762c2edc321373925496ac28379ddb550cef0ddbe381b82ccf3604cc786fe0b61a31e5c6ff5888c03e123295b14044ad7aada99ae2bc488124d6db8f0a4e8bc6aca4b9f4c014c9407a5", 0x76}, {&(0x7f0000000280)="b0cf385a25f0d26e5583eba89d9913133cbf2d8e5bdc4a1216938eb0ed29d5bcede6efb26975cb041f", 0x29}], 0x3, &(0x7f0000000300)=[{0x40, 0x101, 0x7fff, "b190da09522f739b415ccda357ff97bf1ac5a0b77e6cbe0c5aac36cea0fb151ba73089e27476585217c06d"}, {0xf8, 0x10b, 0x4, "825c26ffcb7e66b364881da156b02e13c8cf841feb49993340cb2f47d022a239da73cf8faf2de600f58cf09f3c5bf393d09b17522147ab02a38d9f23494dfc9486298f7d8bf66b76b3840e23753e1ad96496fa86f135e3f03eb54e13e8a2133ea09edc625d7de296922624e5289ef4451a513039cedc81225237f73df3acd57ad2f2ee3e8c06f76ed329311311df16add671a998fc97fcc35650ed6f253754e78ac82cc793444df54ca943704020c86fd172d81a76e149222d077a856aa49dfb15ed683f70465e02ca0dcea498f9f994a10569e4d397cc3fc6e4caf52cc6cd537a4afa04c9763377"}], 0x138, 0x4000000}, 0x800) 22:56:11 executing program 7: pipe(&(0x7f0000000180)) syz_emit_ethernet(0x46, &(0x7f0000000000)={@link_local={0x1, 0x80, 0xc2}, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [{[{0x9100, 0x10001, 0x7ff, 0x2}], {0x8100, 0x9, 0x1ff, 0x1}}], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x2, [0x1]}) syz_emit_ethernet(0xe3, &(0x7f0000000080)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @empty, [], {@llc={0x4, {@llc={0xf8, 0xff, "fa", "7c4828032b73f3fa505a0309539faf0b4876e504a8c665e5af876dd58382c4196a6c885aeb4b0a5b74dd8f2e95d96def0b615a8d168445e1912698a6e61d6906557e7c3327d51900b6916d3cc97d4318ee7891953410d20998e7b48c796e91fbe53e4ce9f5582694425400857fce74a7506c594983667c62db438b5db5532287f72fdf93964504179c358645dea2d0e5160916e608e71180593dfd9659bc5825cb9e021b1c1bd96a70c0915b9c19bb4eba60b64f483e80ce489ec5e8b968814fdebae9549897d3374de5c9645cb0cfd1bd96"}}}}}, 0x0) 22:56:11 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x800000000000000]}) 22:56:11 executing program 7: syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='io.stat\x00', 0x0, 0x0) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000800}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x70, r1, 0x209, 0x70bd2a, 0x25dfdbfc, {0xe}, [@IPVS_CMD_ATTR_DEST={0x54, 0x2, [@IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x4}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x6}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x80000001}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x6}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e21}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x3919}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e23}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x9}]}, 0x70}, 0x1, 0x0, 0x0, 0x20008000}, 0x0) [ 821.677582] binder: undelivered TRANSACTION_ERROR: 29201 22:56:12 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) read(r1, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(r0, 0x5415, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000016) 22:56:12 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff7f, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) 22:56:12 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x2000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:12 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x10, &(0x7f0000000000)=r0, 0x4) 22:56:12 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x600]}) 22:56:12 executing program 7: syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x4, [0x0, 0x9d0, 0x0, 0x40]}) 22:56:12 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f00003cefe4)={&(0x7f0000000300)={0x10, 0x34000}, 0xc, &(0x7f0000007ff0)={&(0x7f0000000180)=ANY=[@ANYBLOB="180000002f00fd0600000000000000000302140004000000"], 0x18}, 0x1}, 0x0) 22:56:12 executing program 4: r0 = socket(0x40000000006, 0x95e1158219e01637, 0xc2) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='veth1_to_team\x00', 0x10) syz_emit_ethernet(0x2a, &(0x7f000070aef1)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @random="324bc917fef4", [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @broadcast=0xffffffff}, @udp={0x0, 0x0, 0x8}}}}}, 0x0) [ 822.527235] binder: 2916:2923 BC_FREE_BUFFER u0000000000000000 no match [ 822.561769] binder: 2916:2923 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 822.569093] binder: 2916:2923 got reply transaction with no transaction stack 22:56:12 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0xe, &(0x7f0000000000)=r0, 0x4) 22:56:12 executing program 7: syz_emit_ethernet(0x46, &(0x7f0000000000)=ANY=[@ANYBLOB="0180c2000000abaaaaaaaa00910010008100180008004500003000000001006794780000005c00000000006b5804900000004500000300002000000000bb1400000100000000"], &(0x7f0000ea3000)={0x0, 0x100000000, [0x1, 0xffffffffffffffff]}) syz_extract_tcp_res$synack(&(0x7f0000000100), 0x1, 0x0) 22:56:12 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x2c00], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:12 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x6]}) [ 822.576465] binder: 2916:2923 transaction failed 29201/-71, size 0-8 line 2759 22:56:12 executing program 6: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) io_setup(0x7fffffff, &(0x7f0000000000)=0x0) close(r0) r2 = socket$vsock_dgram(0x28, 0x2, 0x0) io_submit(r1, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x800000000001, 0x0, r2, &(0x7f00000001c0)}]) 22:56:12 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) write(r0, &(0x7f00000000c0)="2400000024007fffffff9e0000007701000000ff0100000000008100ffffffff0100ff10", 0x24) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x110) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX(r1, 0x84, 0x6e, &(0x7f0000000040)=[@in6={0xa, 0x4e20, 0xffffffff, @local={0xfe, 0x80, [], 0xaa}, 0x100000001}, @in={0x2, 0x4e20}, @in={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x17}}, @in={0x2, 0x4e20, @loopback=0x7f000001}], 0x4c) statfs(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)=""/248) getsockopt$IPT_SO_GET_REVISION_TARGET(r1, 0x0, 0x43, &(0x7f0000000280)={'icmp6\x00'}, &(0x7f00000002c0)=0x1e) open(&(0x7f0000000240)='./file0\x00', 0x0, 0x10) [ 822.624969] binder: 2916:2932 BC_FREE_BUFFER u0000000000000000 no match 22:56:12 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x44], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) [ 822.682478] sock: process `syz-executor0' is using obsolete setsockopt SO_BSDCOMPAT [ 822.700087] binder: 2916:2932 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 822.707166] binder: 2916:2932 got reply transaction with no transaction stack [ 822.714515] binder: 2916:2932 transaction failed 29201/-71, size 0-8 line 2759 22:56:12 executing program 7: r0 = syz_open_dev$vcsa(&(0x7f0000000040)='/dev/vcsa#\x00', 0x100000000, 0xc040) symlinkat(&(0x7f0000000000)='./file0\x00', r0, &(0x7f0000000080)='./file0\x00') syz_emit_ethernet(0x3e, &(0x7f0000000280)=ANY=[@ANYBLOB="0180c2000000aaaaaaaa8cdd80db08d4e3a169aa000800ff0067907800000000ffffffff21009078000008a061a14b2828ace100000000ac14ffbbe00000011db1a5084da038aa0aa0010bd242c64f322e7089d677b70396f0cae2763eb88b55c1ebbff0b1b600ccc34cd299a99a8d7838a70bcc596def992d003c27e00e539ada04ad9a36ed2e843baa72ee00000000b52d5f9636e8fde789a6ce6494ce9939d3ba2d4be3c8f1f7c8e214adce24e2a6a87d5fdc28861da398d0beba3cc32afc39d689820428ce3d68f8cb5c7cc85367c01ddbbc5458708eae048501a5192362b28668ea41c3fbb6f701b43c4a8f6f5978222c1d55229e08cbe63243004b03287250db82e3224519bda759ec7296b365edd590919d8c4111fecdd0ca71154d31d4f53203bfba08d074248f703159a81c0fce526d8e72760f249df775e32e1b894b851565348e1af80b0bbf17d40c6ec88e54b6dfc35ef8c757faaa62f51b19030d34f8d64ebce639827ed1f2d6525f4c1695f2b2c96e45565703eb26cb17e1e40375f8000000000000000000000000000000000000000000"], &(0x7f0000ea3000)) [ 822.869716] binder: undelivered TRANSACTION_ERROR: 29201 [ 822.875433] binder: undelivered TRANSACTION_ERROR: 29201 22:56:13 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) read(r1, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(r0, 0x5441, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000016) 22:56:13 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x100000000000000]}) 22:56:13 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000600)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(aes-aesni)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000000)="b7f2288a933d659166593ae164c990a0", 0x2108) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f00000022c0)=[{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000480)="7be9a97762e58724962cc8bc3fb3804f03a09bc13681ecb0a3ee919d30e07a1e", 0x20}], 0x1, &(0x7f0000000340)}], 0x1, 0x0) readv(r1, &(0x7f0000000680)=[{&(0x7f0000000280)=""/129, 0x81}], 0x1) r2 = semget$private(0x0, 0x3, 0x11) semctl$SEM_INFO(r2, 0x4, 0x13, &(0x7f0000000040)=""/69) 22:56:13 executing program 4: r0 = syz_open_dev$sndmidi(&(0x7f0000000000)='/dev/snd/midiC#D#\x00', 0x0, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r0, 0xc0305710, &(0x7f0000000040)) syz_open_dev$mice(&(0x7f00000001c0)='/dev/input/mice\x00', 0x0, 0x80000) 22:56:13 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x3a00000000000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:13 executing program 7: syz_emit_ethernet(0x1, &(0x7f0000000080)=ANY=[@ANYBLOB="0180c2000000aaaaaaaaaa00080045000030000000000067907800000000ffffffff0500070000000000450000030000000000000000ac14ff4ba357cdf89b38f16a63be7fbbe0000001ef0fc4179ff2e1a16d76050b3d4d0397f7d807d768b748dfb57ba17d1e2232b92298a30092e8d6b3668ee931c8d920ebe98fa923733114e1e2f4780def0858d60a7c224168fd2c82e8b00552aa7eae355fa50b6533e3aa83d203bda203574c5c3b239ac4178b2f3c43e44c52d1fa91795d8cceb472e1a65fbaa6f8cb36b4b23c45768767f0d9848aa3349da1927a871fc92a8172db4721e5626520d06d39c561b8e4ecf9ad856e3a9ecdfc209d4add971abe"], &(0x7f0000ea3000)={0x0, 0x1}) r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/expire_nodest_conn\x00', 0x2, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, &(0x7f0000000040)=0x9, 0x4) 22:56:13 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x23, &(0x7f0000000000)=r0, 0x4) 22:56:13 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa00, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) [ 823.550675] binder: 2981:2984 BC_FREE_BUFFER u0000000000000000 no match 22:56:13 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x600000000000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:13 executing program 7: syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)) r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x8001, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r0, 0xc04c5349, &(0x7f0000000040)={0xb2ae, 0x8, 0x40}) ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2287, &(0x7f00000000c0)=0x100000000) 22:56:13 executing program 4: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f000016b000)={0x26, 'skcipher\x00', 0x0, 0x0, 'chacha20-generic\x00'}, 0x58) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000700)={r0}) r1 = syz_open_dev$amidi(&(0x7f0000000080)='/dev/amidi#\x00', 0xe5, 0x48000) sendmmsg$alg(r1, &(0x7f00000006c0)=[{0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f00000000c0)="20c956e7f7d9e2670506c5ab38369f5326a10322ca849de924fd1006cb8189ef0a21d919ca3eaf624b0824e9ef", 0x2d}, {&(0x7f0000000180)="618221174174908c07ecb536d49b6c52f5fe49119b173e777b507d40873ce4e168ca091f014416906a5f4273dd7e675330a9afd18bb655c04d6ad6f0d80db8f727dd70b4fcf830cd817fcfe8b79345d185f6a88d810a89cb4ace68c0cd91d129d4709af4cf9fb3eba91dc06aa6cd47a09c662c29c322acec2b2bac03114f171a292e8a00b39a2aac5c64560659a023993ffedfe03e2d0b949194d0909651f706", 0xa0}, {&(0x7f0000000240)="68799fe114c596b42283923cf8a867d5feda6612375bb268f9780c0fa5b6b47dd000e0b8a5433d8d64c646ca40affe756514b1b725ddd28a2239b0e7a3ee128f64bfd64ab6aeea1c45006676b7", 0x4d}, {&(0x7f0000000100)="c7c6037a3afbc147b43c609cbc1f43801ad5c87e6297e5aa37b8e2878b22991e55bdd0f91f", 0x25}, {&(0x7f00000002c0)="afae9285346c2cbd1dad31fad6fc88fa80cf2983ada8d410", 0x18}, {&(0x7f0000000300)="3bf9f9830bb6f50bc766f3c09db2baf24ad75aecd2a3319aca006fd2b3342eb989d4e66cbec3c080db654722af5e419533a50c7bc2c0380123be9496ccb9ba449472468fced6e65bc8121c70e80164d6f572394ca10f9ee99e162713941f09e3b6da78858c5d061f341ef84176e8fc9eca38a98e020433927f71d5ceb08f28287aae7c992d698050c8320fed5b3aa8633ef279c553c4ecc128877585cc18ed5f05fa0af812fcee477713fa82cde242b9b45f1a96b923b8f1ba7db2dd6f70282cc72f724c2ed3edbd180d48acbf9ca948b1b5455e5f4a30103045ef", 0xdb}, {&(0x7f0000000400)="8512789fec3a924dbcf0453317870f74ed1a1b2c8b1653ab4797314f80149dc55adee60419f2afdff0008795d4bbe4482837aade5dc47d20f5daf21ccd3174498cbddbcc63a2989b34ee39beb3f0ea7215b74fd0cb4977f8c5af75b7b001b375a55c8ba7cfbc4af33e11b541abfb79773584c46395b75c20383528cea59183c418aa13a880298e0cee7975da7724e00abbfc7a97b2d2a952", 0x98}, {&(0x7f00000004c0)="d608ecb23d12fbdea42c4c43325a4cd29c534d02a6f78400c31c4a4e3085d68741ba6f00568ef7a0d48c021525b17fef99c53ad78c9ff546785fb99434a56f61454dd0b31d1c0de12299f28d262a4bb8888250cea9e308be90a567118711c5880f40ab4941542671a82318c77dba11b22a893c5494eb4d02e2797fa4e0d58b49540b7ae1c7be7363802fdd423b317ed1b96aff67b78cd8e943a6da64a85dc90c4687fc4a729d6eeffdae5898bf3f67aa1653b88950b8caa792a34ac5397d456ba71c463f1384916a741fcaeb688fa87442fbeb1d2d7192528e857dcb", 0xdc}], 0x8, &(0x7f0000000640)=[@assoc={0x18, 0x117, 0x4, 0x71df}, @assoc={0x18, 0x117, 0x4, 0x8}, @op={0x18, 0x117, 0x3}, @op={0x18, 0x117, 0x3}], 0x60, 0x4}], 0x1, 0x48800) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b005e381e5b3b60ced5c54dbb7295df0df8217ad4000000000000000e6", 0x20) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000003400)=[{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000001240)="cfde84b3d59ab72211af4028404121de12b9fbab19665474661ddf62c9f96ece081307e0eff5ad50a74010ed7864501ba59497c853e950e4c003371cd4173e5ea30e2ad4133697b81d309d0e86142a045d2cd4773f5e03ba301883863428671472522b0d0339c0cab4139700d983db5872c1d5eab50fe73acac8109187569e35", 0x80}], 0x1, &(0x7f00000001c0)}], 0x1, 0x0) recvmsg(r2, &(0x7f0000001200)={&(0x7f0000000000)=@vsock={0x0, 0x0, 0x0, @hyper}, 0x80, &(0x7f00000011c0)=[{&(0x7f0000001140)=""/78, 0xfffffe06}], 0x1}, 0x0) [ 823.591623] binder: 2981:2984 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 823.598725] binder: 2981:2984 got reply transaction with no transaction stack [ 823.606422] binder: 2981:2984 transaction failed 29201/-71, size 0-8 line 2759 22:56:13 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0xe000]}) 22:56:13 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x8, &(0x7f0000000000)=r0, 0x4) 22:56:13 executing program 6: unshare(0x40000000) socketpair$inet_sctp(0x2, 0x5, 0x84, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x280, 0x0) ioctl$KVM_GET_ONE_REG(r2, 0x4010aeab, &(0x7f0000000280)={0x5, 0x6a}) setsockopt$inet_buf(r1, 0x0, 0x27, &(0x7f0000000080)="2fa1db84680fbc45bef9f03925031e347578f1343984d77acb281f4924c374f30c", 0x21) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000100)={0x0, @dev={0xac, 0x14, 0x14, 0x16}, 0x4e21, 0x0, 'wrr\x00', 0x2, 0x2, 0x2}, 0x2c) getsockopt$inet_sctp_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f0000000140)={0x0, 0x3, 0x6, 0xfff}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f00000001c0)={0x2, 0x1f, 0x204, 0xffff, 0x3, 0x3, 0xffffffff7fffffff, 0x8, r3}, &(0x7f0000000200)=0x20) r4 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x8914, &(0x7f0000000000)={'sit0\x00', 0x20003005}) 22:56:13 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x3000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:14 executing program 7: syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)) r0 = memfd_create(&(0x7f0000000000)='\x00', 0x3) ioctl$DMA_BUF_IOCTL_SYNC(r0, 0x40086200, &(0x7f0000000040)=0x6) ioctl$TUNSETPERSIST(r0, 0x400454cb, 0x0) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000000080)={0x0, 0x7f, 0x1, 0xf5, 0xfff, 0xf7}, &(0x7f00000000c0)=0x14) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f0000000100)={r1, @in6={{0xa, 0x4e20, 0xffffffff, @loopback={0x0, 0x1}, 0x4587}}, 0x7, 0x9}, &(0x7f00000001c0)=0x90) ioctl$sock_bt_bnep_BNEPGETCONNLIST(r0, 0x800442d2, &(0x7f00000002c0)={0x6, &(0x7f0000000200)=[{0x0, 0x0, 0x0, @local}, {}, {0x0, 0x0, 0x0, @link_local}, {0x0, 0x0, 0x0, @remote}, {0x0, 0x0, 0x0, @link_local}, {0x0, 0x0, 0x0, @dev}]}) [ 823.753805] binder: 2981:3015 BC_FREE_BUFFER u0000000000000000 no match [ 823.795205] binder: 2981:3015 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 823.802403] binder: 2981:3015 got reply transaction with no transaction stack [ 823.809763] binder: 2981:3015 transaction failed 29201/-71, size 0-8 line 2759 [ 823.824300] IPVS: ftp: loaded support on port[0] = 21 [ 823.937195] binder: undelivered TRANSACTION_ERROR: 29201 [ 823.942803] binder: undelivered TRANSACTION_ERROR: 29201 [ 823.947209] device lo entered promiscuous mode [ 823.961052] IPVS: ftp: loaded support on port[0] = 21 22:56:14 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) read(r1, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(r0, 0x5410, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000016) 22:56:14 executing program 4: r0 = syz_open_dev$tun(&(0x7f0000000280)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710", 0x102}) ioctl$TUNSETOWNER(r0, 0x400454cc, 0x0) r1 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x4, 0x0) setsockopt$inet6_MRT6_ADD_MFC(r1, 0x29, 0xcc, &(0x7f0000000100)={{0xa, 0x4e22, 0x8, @local={0xfe, 0x80, [], 0xaa}, 0x7}, {0xa, 0x4e24, 0x2, @empty, 0x8}, 0x88f1, [0x3, 0x7, 0x2, 0x7, 0x8, 0xfffffffffffffff9, 0x8fd4, 0x9]}, 0x5c) ioctl$BLKSECDISCARD(r1, 0x127d, &(0x7f0000000040)=0x3) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={"d202b999cf85000000000088f301e710", 0x102}) ftruncate(r0, 0x200) clock_gettime(0x0, &(0x7f0000000080)) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000001c0)={0x10000000001000, &(0x7f0000000200), 0x8, r1, 0x4}) 22:56:14 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x19, &(0x7f0000000000)=r0, 0x4) 22:56:14 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x7000000]}) 22:56:14 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x7000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:14 executing program 7: syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)) setrlimit(0x0, &(0x7f00000000c0)={0x7, 0x6}) r0 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={0xffffffffffffffff, 0x7, 0x1, 0x0, &(0x7f0000000000)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x9}, 0x20) setsockopt$bt_rfcomm_RFCOMM_LM(r0, 0x12, 0x3, &(0x7f0000000080)=0x10, 0x4) 22:56:14 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa00000000000000, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) 22:56:14 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) write$binfmt_aout(r0, &(0x7f0000000600)={{0x0, 0x2, 0x685a, 0xe0, 0x99, 0x7, 0x3d8, 0x84e}, "7a933c101605e953427ec4c9a622977fb51ff302569d66", [[], [], [], [], [], [], [], [], [], []]}, 0xa37) socketpair$inet(0x2, 0x2, 0x7b2, &(0x7f0000000000)={0xffffffffffffffff}) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000040)={0x0, 0xd9e}, &(0x7f0000000080)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r1, 0x84, 0x0, &(0x7f00000000c0)={r2, 0x9, 0xffffffffffffff76, 0x55}, 0x10) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r3 = socket$unix(0x1, 0x5, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x3, 0x1) ppoll(&(0x7f0000000540)=[{r3}, {r3}, {r4}], 0x3, &(0x7f00000005c0), &(0x7f00000001c0), 0x8) [ 824.625612] binder: 3038:3039 BC_FREE_BUFFER u0000000000000000 no match 22:56:14 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) ioctl(r0, 0x1, &(0x7f0000000000)="f4fb2fc54b4f6e99879105e99fd44de96053e3144983117b6f921515d3d8c47a53039f696563867b76109f0a84780b55514257dcec2652c5e00e83bde3fdfb5adbf38bd678e1ba1411a6372a73129f39b6816f8e") r1 = syz_open_dev$usbmon(&(0x7f00000000c0)='/dev/usbmon#\x00', 0x9, 0x20000) ioctl$KVM_REINJECT_CONTROL(r1, 0xae71, &(0x7f0000000100)={0xa1}) bind$inet6(r0, &(0x7f00002aafe4)={0xa, 0x4e23, 0x0, @ipv4={[], [0xff, 0xff]}}, 0x1c) listen(r0, 0x40) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r2, &(0x7f000087dffe)='F', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) sendmsg$netlink(r2, &(0x7f0000000080)={0x0, 0x359, &(0x7f0000214000)=[{&(0x7f0000000080)=ANY=[@ANYBLOB], 0x1}], 0x1, &(0x7f0000000180)}, 0x0) write(r2, &(0x7f0000000140)="fe", 0x1) writev(r2, &(0x7f0000000240)=[{&(0x7f00000001c0)='$', 0x1}], 0x1) read(r0, &(0x7f0000000180)=""/41, 0x29) r3 = accept4(r0, &(0x7f0000c71ff0)=ANY=[], &(0x7f0000f5effc), 0x0) shutdown(r3, 0x2) 22:56:14 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x4400], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:14 executing program 7: syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)=ANY=[@ANYBLOB="0180c200000098aaaaaaaa000800c4dfa44500003000000000006778780000000000450000030000000000000000ac14ffbbe0000001"], &(0x7f0000ea3000)) 22:56:14 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x29, &(0x7f0000000000)=r0, 0x4) [ 824.687675] binder: 3038:3039 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 824.694852] binder: 3038:3039 got reply transaction with no transaction stack [ 824.702308] binder: 3038:3039 transaction failed 29201/-71, size 0-8 line 2759 22:56:15 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0xe0000000]}) 22:56:15 executing program 4: r0 = socket$kcm(0x29, 0x2, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="0047fc2f07d82c99240970") r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/net/pfkey\x00', 0x480000, 0x0) ioctl$ASHMEM_SET_PROT_MASK(r1, 0x40087705, &(0x7f0000000200)={0x6, 0x8000}) r2 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x1ff, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc4c85512, &(0x7f00000000c0)={{0x9, 0x0, 0x0, 0x0, "1a0ab9b1f94c716787e88fae5552770ad6a9b54e0679918e0a88af8aacaea63fd56d1dd99812e16bc06df8b8"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "0b690d49b85ec254b15b023d1e67900f8f55709195aa7d999552981434f68e364a3238b17109db386e35830a143c5755ae184895c461436bad45232f258c32a1", &(0x7f0000000040)}) r3 = dup(r0) ioctl$PPPIOCSFLAGS(r3, 0x40047459, &(0x7f0000000100)=0x40000) r4 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x40, 0x0) ioctl$KVM_ENABLE_CAP(r4, 0x4068aea3, &(0x7f0000000080)={0x81, 0x0, [0x7c85, 0x3f, 0x0, 0x1]}) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) fadvise64(r4, 0x0, 0x80000000, 0x5) getsockopt$IP6T_SO_GET_REVISION_TARGET(r5, 0x29, 0x48, &(0x7f0000000180)={'IDLETIMER\x00'}, &(0x7f00000001c0)=0x1e) 22:56:15 executing program 7: syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x0, 0x0, 0x0, 0x5ac]}) 22:56:15 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x2f00000000000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) [ 824.841924] binder: 3038:3070 BC_FREE_BUFFER u0000000000000000 no match [ 824.899360] binder: 3038:3070 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 824.906500] binder: 3038:3070 got reply transaction with no transaction stack [ 824.914069] binder: 3038:3070 transaction failed 29201/-71, size 0-8 line 2759 [ 825.053394] binder: undelivered TRANSACTION_ERROR: 29201 [ 825.059058] binder: undelivered TRANSACTION_ERROR: 29201 22:56:15 executing program 7: syz_emit_ethernet(0x65, &(0x7f0000000000)={@remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@llc={0x4, {@llc={0xfc, 0xfe, '-t', "f86dcfafdabbe4020963b5ff9d8c351578ee54f7c269e97af7c3df87c0234c2bc76ceeae22e3dd27030ebb80e7fa0d11ec406c40b199401c8fccd36964e8da161ef0ea3e8232e90f0406b33f3b5d19d8c22fd1"}}}}}, &(0x7f0000ea3000)={0x0, 0x3, [0x415, 0x0, 0x1]}) r0 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vsock\x00', 0x80, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f00000000c0)={0xe1, 0xff, 0x6, "dd88d074ece235cb3170b210f2602cbdd1fdeea8316b3717be116867d53aa908c02ab7299deafdab2c3a5c8daa54584e300a167034f5876a5bfe0dbf416b5f49292d28444e249a4ab28caa2ffc885e4ca63f138aaeceab3dfab64cb1af63b40411af55a06fbb5f1708e52160ab319956603f4a2ae62522e2c8ce407a8bccef3bb706b0b96f3842ad6fa8e6d0d98dff3f810a7a37b313f770620003efe930b7aef9b9b2994b3f49fe0a504997a01be0ad83985b5d4ce81a46668dfcfc98ce6e577e11ba79db5f6cddf9e804b9b390684ca026634d84642f26cc96cefd81248a216e"}) ioctl$sock_inet_tcp_SIOCATMARK(r0, 0x8905, &(0x7f00000001c0)) 22:56:15 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x28, &(0x7f0000000000)=r0, 0x4) 22:56:15 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x3000000]}) 22:56:15 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) read(r1, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(r0, 0x5460, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000016) 22:56:15 executing program 4: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup\x00', 0x200002, 0x0) r1 = openat$cgroup_ro(r0, &(0x7f0000000140)="c28f9b31409815888a6116f3500cc271b81d263e0820901a2319bc8c22c60a6c709e481772f1dd05c6c0dfe645aa1984a03859045ac7d19d11fd3080f0d9b97a717008bc9a0117b1d6d86fd9adbcc623bfb19e3ec29519a16b1327651edc7443714f1581e144c32ac716bb71921f200c208b74428c83a05966710be7bed947b5411aa162035c185411ef7a2286fc201dc7194d9bc8948e377ab74d5840a80f3c0186c0ca5e", 0x0, 0x0) read$eventfd(r1, &(0x7f0000000080), 0xfffffffffffffd77) 22:56:15 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) 22:56:15 executing program 6: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000140)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snapshot\x00', 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/ip_tables_targets\x00') sendfile(r0, r1, &(0x7f00000000c0)=0xfffffffffffffffc, 0x7ffffffe) 22:56:15 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x3c], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) [ 825.729371] Unknown ioctl 1 [ 825.733139] binder: 3104:3110 BC_FREE_BUFFER u0000000000000000 no match [ 825.736353] Unknown ioctl 35077 [ 825.756886] binder: 3104:3110 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 825.764120] binder: 3104:3110 got reply transaction with no transaction stack [ 825.769176] Unknown ioctl 1 22:56:16 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x3a], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:16 executing program 4: pipe(&(0x7f00004a8000)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r1, 0x407, 0x3) write$binfmt_elf64(r1, &(0x7f0000000100)=ANY=[@ANYBLOB="c3"], 0x1) vmsplice(r1, &(0x7f00000001c0)=[{&(0x7f0000000080)}], 0x1, 0xfffffffffffffffe) vmsplice(r0, &(0x7f0000001740)=[{&(0x7f00000016c0)="79ab", 0x2}], 0x1, 0x6) 22:56:16 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x15, &(0x7f0000000000)=r0, 0x4) [ 825.771476] binder: 3104:3110 transaction failed 29201/-71, size 0-8 line 2759 22:56:16 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x7]}) 22:56:16 executing program 7: syz_emit_ethernet(0x3e, &(0x7f0000000300)=ANY=[@ANYBLOB="0180c2000000aaaaaaaa02d5080045000030000000000067907800000000ffffff16ff0f048314d7b3f02100907800000000450000030000000019000000ac14ffbbe0000001"], &(0x7f0000ea3000)) socketpair(0x0, 0x800, 0x22ae, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000240)={0xffffffff}, 0x13f, 0x7}}, 0x20) epoll_ctl$EPOLL_CTL_DEL(r0, 0x2, r1) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000002c0)={0x5, 0x10, 0xfa00, {&(0x7f0000000040), r2, 0x1}}, 0x18) 22:56:16 executing program 6: syz_emit_ethernet(0x46, &(0x7f0000000040)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @link_local={0x1, 0x80, 0xc2}, [{[], {0x8100, 0x1000, 0xfd1b, 0x2}}], {@ipv4={0x800, {{0xb, 0x4, 0x0, 0x0, 0x34, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}, @local={0xac, 0x14, 0x14, 0xaa}, {[@timestamp={0x44, 0x18, 0x7, 0x3, 0x0, [{}, {}, {[@empty=0x2100]}, {}]}]}}, @igmp={0x0, 0x0, 0x0, @multicast1=0xe0000001}}}}}, &(0x7f0000000000)={0x4000000, 0x3, [0x0, 0x0, 0x10000000000, 0xc52]}) 22:56:16 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x6000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:16 executing program 4: r0 = memfd_create(&(0x7f0000000000)="6d81351e39cfc228a4a17200", 0x0) fallocate(r0, 0xfffffffffffffffd, 0x0, 0x6) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x4) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r0, 0xc0145401, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x800, 0x1, 0x8}) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r0, 0xc0145401, &(0x7f0000000080)={0xffffffffffffffff, 0x1, 0x10, 0x3, 0x8}) 22:56:16 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x34, &(0x7f0000000000)=r0, 0x4) [ 825.952993] binder: 3104:3137 BC_FREE_BUFFER u0000000000000000 no match 22:56:16 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x3000000000000000]}) [ 826.014880] binder: 3104:3137 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 826.022058] binder: 3104:3137 got reply transaction with no transaction stack [ 826.029530] binder: 3104:3137 transaction failed 29201/-71, size 0-8 line 2759 22:56:16 executing program 6: r0 = dup(0xffffffffffffffff) clock_gettime(0x7, &(0x7f0000000200)={0x0, 0x0}) futimesat(r0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)={{}, {r1, r2/1000+30000}}) getsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(r0, 0x84, 0x7, &(0x7f0000000180), &(0x7f00000001c0)=0x4) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000), &(0x7f00000000c0)=0xc) pkey_mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x9, 0xffffffffffffffff) futex(&(0x7f0000000040), 0x400000089, 0x0, &(0x7f0000004000)={0x77359400}, &(0x7f0000000140)=0x1, 0x40000000) ioctl$KVM_KVMCLOCK_CTRL(r0, 0xaead) [ 826.222565] binder: undelivered TRANSACTION_ERROR: 29201 [ 826.228200] binder: undelivered TRANSACTION_ERROR: 29201 22:56:17 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) read(r1, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(r0, 0x80045440, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000016) 22:56:17 executing program 7: syz_emit_ethernet(0xffffffffffffff5a, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) pwrite64(r0, &(0x7f0000000040)="34ce1e8c7e337b482768f219ae759913f10320eaf232e9aeacd7613134bd3fbc700b2a992948dac4c0f52852078896fd275eb231361978128f2749280f46e160b4c7ea963b31d115eb243c023e2e172f57d9aca9c3c09db59acc01a0c3f0829add1d7bc45838e6fc1b4d01f6", 0x6c, 0x0) r1 = dup(0xffffffffffffffff) ioctl$IOC_PR_REGISTER(r1, 0x401870c8, &(0x7f0000000000)={0x1ff, 0x3, 0x1}) 22:56:17 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x300], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:17 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) r1 = syz_open_dev$sndpcmc(&(0x7f0000000200)='/dev/snd/pcmC#D#c\x00', 0x9, 0x84102) ioctl$KVM_SET_TSC_KHZ(r1, 0xaea2, 0xde8) r2 = accept$inet(0xffffffffffffff9c, 0x0, &(0x7f00000000c0)) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f0000000340)={0x0, 0xcdbf}, &(0x7f0000000380)=0x8) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}, 0x1}, 0x0) sendmmsg(r3, &(0x7f0000000180), 0x400000000000117, 0x0) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f0000000400)={0x0, 0x0, 0xfffffffffffffffd, 0x8000, 0x0}, &(0x7f0000000440)=0x10) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r2, 0x84, 0x66, &(0x7f0000000500)={r4, 0x9b}, &(0x7f00000004c0)=0xa0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r2, 0x84, 0x13, &(0x7f0000000180)={r5, 0x1}, &(0x7f00000001c0)=0x8) ioctl(r0, 0x8, &(0x7f0000000040)="295ee1311f16f477671070") r6 = socket$inet(0x2, 0x7fb, 0x68) ioctl$PPPIOCGFLAGS(r1, 0x8004745a, &(0x7f0000000100)) getsockopt$inet_int(r6, 0x0, 0x18, &(0x7f0000000080), &(0x7f0000000000)=0x4) 22:56:17 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x5, &(0x7f0000000000)=r0, 0x4) 22:56:17 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0xffff000000000000]}) 22:56:17 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) [ 826.816823] binder: 3171:3172 BC_FREE_BUFFER u0000000000000000 no match [ 826.854839] binder: 3171:3172 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 22:56:17 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x33, &(0x7f0000000000)=r0, 0x4) 22:56:17 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x600], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:17 executing program 7: syz_emit_ethernet(0x3e, &(0x7f0000000000)=ANY=[@ANYBLOB="0180c2000000aaaaaaaaaa00080045002b7111436bba8102580030000000000067907800000000ffffffff21009078000000004514ffbbe0000001000000000000000000000000f9cecea58167b90a12bb0e83598f6c365d4a5c169667a131c496020b1a07fc5b0d60d2f2cbf0078daf8052be879ba55d3c8315c8534b4a0599820582d95f76ad00a6737d4d76e2f20dccf20e6dc0cb19937ffb0918c0fa7567102d457b644ab28ca51bd9a440803fa6c9c45732cc"], &(0x7f0000ea3000)) [ 826.862091] binder: 3171:3172 got reply transaction with no transaction stack [ 826.869483] binder: 3171:3172 transaction failed 29201/-71, size 0-8 line 2759 22:56:17 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x400000000000000]}) [ 826.927686] binder: 3171:3192 BC_FREE_BUFFER u0000000000000000 no match [ 826.960166] binder: 3171:3192 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 826.967305] binder: 3171:3192 got reply transaction with no transaction stack 22:56:17 executing program 4: r0 = socket$alg(0x26, 0x5, 0x0) close(r0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr(des3_ede)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000bbfe8)="ad56b6c5820faeb995298992ea54c7beef9f5d56534c90c2", 0x18) r2 = accept$alg(r0, 0x0, 0x0) ioctl$int_in(r0, 0x5421, &(0x7f0000000080)=0x2) write$binfmt_aout(r2, &(0x7f0000000180)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000dd000000000000"], 0xfffffd07) recvmsg(r2, &(0x7f0000b2f000)={&(0x7f00008e8000)=@nfc, 0x10, &(0x7f0000030fa0)=[{&(0x7f000009f000)=""/87, 0x2009f057}], 0x1, &(0x7f0000590000)}, 0x0) 22:56:17 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x8], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) [ 826.974692] binder: 3171:3192 transaction failed 29201/-71, size 0-8 line 2759 22:56:17 executing program 7: syz_emit_ethernet(0x1, &(0x7f0000d53fc1)=ANY=[@ANYPTR=&(0x7f00000003c0)=ANY=[@ANYBLOB="331e7c2f54b11a1ef4e361dc847af9ab4dd82ee5bc4482a9aba8c2876a7c4f400e570c113d0a513e9f37be9b45f52476306b5eb7fe6b2bf162cda45b7295f71355f64e9fc846ebc40851294739be8f6dec856f87ed0fb912f1bf36aa97c263a1d16109145e8b10242943bcd86254c1585dfdb174c6634bfa75564d0a391734748534d947c68f062a93d3670e3b25243377692c9497d5e667c2b45e951d4064e3", @ANYPTR64=&(0x7f0000000280)=ANY=[@ANYPTR, @ANYRES64, @ANYBLOB="5aa24d22ff0ba603f6b6c2d72e1d0e90d536d84c5f5c9f726072ea75356dc10d0ab8e84b7212df4eb0a050bdda99537a5eb73faf170a89a95bde194fc692cfea41e536ec5afa86b4fd69044644f602b40681804ce3ad9a9d43eb4b1603eba56b700d79d6ab4e25798b6211ed11c0d3696934fb4c6ad473d442f9"], @ANYRES16, @ANYPTR=&(0x7f0000000340)=ANY=[@ANYRES32, @ANYRES64=0x0, @ANYPTR64, @ANYRES16, @ANYRES32], @ANYPTR64=&(0x7f0000000380)=ANY=[@ANYRES32], @ANYPTR64]], &(0x7f0000ea3000)) r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x400000, 0x0) r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000080)='fou\x00') sendto$inet(r0, &(0x7f00000001c0)="d3d89b6a3685d65f032f85eb6ee2f8b76605311f3f3c2c8b1eca265efc4035180d3c621b6ecce5b43e6f41e1da19288cee5ae76ccb313ee92f5a65dd191cf3e5920aec1f52c3174c9ba7c30fcedb241c518f9b21bda7d62bb5e901c9", 0x5c, 0x4000, &(0x7f0000000240)={0x2, 0x4e24, @rand_addr=0x100000000}, 0x10) sendmsg$FOU_CMD_GET(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000040}, 0xc, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="00002bbd7000fddbdf2503000000080003000900ec079d00000000000073000000080001004e220000080001004e01000000000500080001004e200000080001004e210000080004000200000004e5de0adb2bec2491b93a319d8e55d3fc66a175bf5e1ad6fc881ffceec8ca6280ab464d8ccb09edc5022fe047ab2320721dcefb38505b857e1b3963bb3ebe76e2e650582948b18b8944a860e20015e4274acd937f49fc28c1fc2ae9819e1fa04453b7f20599e608d9b0e38c7ddb53b4c911958b3c20503415d19f46cf913c22883cbbf35f70b27e8d3c2b1df903410f610f388e02be5a080c0b95e99a309ec139cb20b411db41ffffff6226fdd5278b9ed3b8e135"], 0x54}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) 22:56:17 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0xd, &(0x7f0000000000)=r0, 0x4) 22:56:17 executing program 6: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00007e5000)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000bc000)=@abs, 0x8) fcntl$setstatus(r1, 0x4, 0x800042c05) sendmmsg$unix(r1, &(0x7f00000bd000), 0x80, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r0) r2 = syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x7, 0x400000) getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x20, &(0x7f0000000140)={@local, @rand_addr, 0x0}, &(0x7f0000000200)=0xc) setsockopt$inet6_mreq(r2, 0x29, 0x1d, &(0x7f0000000240)={@ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, r3}, 0x14) [ 827.093240] binder: undelivered TRANSACTION_ERROR: 29201 [ 827.098876] binder: undelivered TRANSACTION_ERROR: 29201 22:56:18 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) read(r1, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(r0, 0x5425, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000016) 22:56:18 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) 22:56:18 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x700000000000000]}) 22:56:18 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x3c00000000000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:18 executing program 7: syz_emit_ethernet(0xffffffffffffff75, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x0, 0x43f, 0x0, 0x946]}) 22:56:18 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x7, &(0x7f0000000000)=r0, 0x4) 22:56:18 executing program 6: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000003c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(khazad-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) shutdown(r0, 0x1) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000004700)=[{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f00000002c0)="c9e49ed9f80a5639", 0x8}], 0x1}], 0x1, 0x0) recvmsg(r1, &(0x7f0000000100)={&(0x7f0000000180)=@pppol2tpv3={0x0, 0x0, {0x0, 0xffffffffffffffff, {0x0, 0x0, @loopback}}}, 0x80, &(0x7f0000000040)=[{&(0x7f00000016c0)=""/209, 0xd1}], 0x1, &(0x7f00000017c0)=""/201, 0xc9}, 0x0) 22:56:18 executing program 7: syz_emit_ethernet(0x1034, &(0x7f0000001040)={@link_local={0x1, 0x80, 0xc2}, @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [{[{0x9100, 0x5, 0x101, 0x3}], {0x8100, 0x3, 0x7, 0x4}}], {@ipx={0x8137, {0xffff, 0x101e, 0x10000, 0x0, {@broadcast=0xffffffff, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 0x5}, {@random=0x9, @random="f8059186cc63", 0x8}, "3dafcb60253a05d9345ba40ffa73b88b5ba6c7368e720d13f2e83e9ee5d857252ee7736a0c362620257f8a1915ec07bed2432bce2ff5d70f8ed4e074ef2a15096af75ea1f54b74115058ac51e91a59289bf56583eb3fc80d400fd2fd3c4e361866c5a2e2bbf4a468f24b5c76594849097264291108f0ff6f52f58df3e371890022172dca8b526594d07d19fc552e0aa08f9e27548411fa3dc3a1b1edccc122bec66f369a75140926a34234478216e56ad016f1ab5d5328cb934e36d844c11015a4ee546f3e215b7b25031704f9625fc201d23790bd7d201b636aee9fe61897c3bd52efa677a2822b0b2f2ae3fb7b2528694f8b125c5a84a1bf68f34b1fcdf5a9a0c84608489077907ad9ef9967c795af49bf6f0810eaf6f287d5e9f7d111f856b785775920b56d88a090b817450a322881c739c85613d3d3b3cf066ba269b126100eb987b30dffb33a7af8712d295bb398bfca5b0796c1346f6b2fa8da091747f06558e62e328c55d949fd98ff6c2e7ec38ae515008af0dcb94dd0da9192ac054731da0bf7584828b7048116378bd26c0137fc541559e6e4decda5dbf980188c3faf3e6ba83b04ffd6a9a98a9eaf4ea09a192400ab0a9f4547f4774a19225cb5fb0c3979e81847883b46cdc4156fde0a18e5fdb67f76b05e3a7f0c230f8e4bfaf2a093715cdd3231f71a5e6362483f9498e4dd8d7a2f84b7559acaf656526ced69745c21608d99587adf6c05442ae73ba231ed189e30e69165999c659e2f43b3ea7078a6e5364bacdaa53bb6aae633ad0271b103d7601b324377125d911f4e08283111a63b37ffd25ccaf487f77796a52a1f8eb28c4494cc16cfe36b43f5bb9962631fef960d70f68f147a291b939473edb79ce6583c457e3d17e8e27156925d6637f4f14b26aa155c4367e6c799507e4973ff0a00cf68d6fc977870414d953c6360d8f1a0896a373d8a1e8ff652a8b382a4322aab7048440fa9a7e6d9d5c7b4653dfcdff450739290a36ad193622bcf19241d426ae7879a7dc83ab0369f70002145b08909e40b80db547c62511a2eda9819f41782561af5d3a8072a2585060504cf7e53a1835627fa89e24c0c3cbd3c045b20b97589582da7b0b8b1c6543f8c29f7a12b3af9ac0b957d9d95c8fdf14485220035230651ae17c84421ce41aaf0fff11728a65a8b27626e5a0ed9b747b757b4436e00c0d9be3a4f161454ed21376d7027d74204d40ea606694b33d8a50458d26c30da8cfff8cb790b4c3b13e94bf96510bc9cc6c4e60ff62f2deca37e13249f004a051efa5ee462af094f78bf618c02fab2180083a251f409a6999c002dfc2ebbdf8862bddaa26c33f9980e9a9919da8a605c38c5218d0c42a65207548b3f4a52fc6ae42d2cdf617dfb633f687200f330159bb20f3f9fffdf713b080b71381e99c5e3f0c9e94d813075e269a76e89d6859c538655f19f7c32a6d97425a11f29cf2a5e40c99d1b72d4fb6e69f1b8483ed508d1bc1294747475cd20a55e577127ad20a2ea58e78ba1a0ad2313f7e4e419935c13553848c8752ca7690ed642d5dd7e91582a12e0c12c64b16145a5b12bb4d6a4fc9a19539ea6555a3e3c28c4695a89c50828953aa8426b077a768b8f75d17851662538da9d062fb6336ec1ebbcaa69e81cb7f9085d2253c04d3aaba74436463c8205f15628d8e9a681e61de9801bb587f7accd9a72355f4c9b553563901b1d52edf9584dee1d964f8c2c818850b5c0e39ca2b7023976eeb3fde465bac3333c9d2315f9897047474595b4bdb1e5fffe31e503890bd7186f20bed1446fd1100f3a4e4d2706746c1126c88b1d2912bc01310d9bcb649a46630b7ba1298ade1b09c47ad1d259408643675e9a390add66803fef5957905cae25ab6c90a5809d21b0b705ad6b343b0704f2c852ee90fed93116b32e4b0bf0d09f512d7013da1254301f14ae520d6aa47971ed1e82aa0c4c6d4b2d55c8c00456571baf7dc851bb0a86c3bfb4342bb746d733056cbb11b176079c57b8d44fa3e227fef8dd5fc0ddd3d31043a7de5b76b8302d7894f2035b88a546fc5bc32ba63fec3e93a21d8b5aa8f2f78bcbbb73a0db80932440598e35fd4cf7deecf123c6fa69d16376787bee61715daa6188c7f868a4db577cf88a5ac37e41bc1d73ddec1f5197bd54164ab4e0b2163268a5da00e0be08bdbffe409d8cef989c0b28c972a765aa34632436039d1c5d69d3bd5970ddedb613d02d68d5311873a8a7feb2bbbe81a7a6c60c39fe0e7b1bf1ff98f68f3c1f61b47801dd9e37e793a7cf96b8b66b7de75c6fc078678376849d081fea88237679c552113204e27e8e60dd4b6d7f3ea0e8dbdfd6cae8e1543f0840e93c357a2478c00dd53a78692b28ad189bbfcc58f4fb47fd509f2a45d31af190019dc5cf8a910cce20359e5b652b3a5588a088da6a91721d461db7312ca1e115af62d1fb9a2a7abc6787e5e36dfa20210663b60be2fb09b0cfcf60ad4eb31d17c78f2af6b19c4024623425584a8e15a369e6e94c29f11603233dc1a0ff0046ad749cb6d6c6d37edb3e96666967a9c3ff021710602c595df3228f5cbbdfdc91f45916e609f7f2d7b6ec75ebc480b9ff20d5f6cf5f90ea9b788af09b11ce3c88a2316ffa0303165c6378f239fd40611e7a0b6f0eff5cde32f9e7d3eeae7135e1ced50a25c79246727998d33468b5831f686cba31ec2ff21beeddf04e0da6f96032378bf3c3a6fe8314e9b431682144985fd046ea5a269109668d725b292030d5194cd7c7d14abc4d368d4f795b5b86483d9bf26d6420b70120a93289cf7b79d98c62f344024c58aff4c7536a257d5af6a9d6b3b9291749a8430d22916ba72daf544cbeaa8e3fe868c4c18145674aa66bf1676a7152f5a979a0e53f08f8688d36f3ffdf9f1a79a18608077fc566e7fb5c0ad91bdba2145a769c66993e5860f2757e73a3f390f3509ab782588ca8b3bdc982171f1150da5a684f31dad65d212b1a88e7ce5f733ae8669303e5b319538b5afb801d8f4b9bc06b72ae2cd3eb1372cac4550b4fcc07199e30398560de460d41099848b28b72c7aa96af9c7051c51e56ddc2dd971fa242c24857b32166804fa05fe4f34a756a4cc58f4ee8c2ac831243315560820abbda090a442caa42bdc8ff6bd1024245b8a62c0eaef5d3efdff98e67282415e4dee60a1353ad14085ddb5724fae231e5eb273786bfb034be65859adfe60b2ddda2d7567e7d868cbc9455454b1319169e8987e5b964ebc619813b366c8e2c39fce3027899d5849b6d24a3e3be9488ba09acecbfcc26bfb0f208c9110b6caa1775cd8f16dd234c7dac5381137be229aed68cfd016a87e205da5cd0d591114216c3ec1b7fca84573321eb36ce846fd11b886550eb8ad0c486b21a9a39ce9736f4551f199caa0814953a95d672cddc656b7c26650dc0c096413fbad7019a207f51a97d497d960b9b60f10ac53e2cd4913c28093dbb4d38f2c5f0a209f1d1cedef74d8cc7b03d8287e5020ea28d4ea0635fdee9eed3f1dd32da1b789e97d576f7cad48b2a20c4e1e35d8873ff62fb22591044d6f9d5e804a1bbba01be0e8fb0eea5d7e36e3b203af0185603fde46b25d066536eab3de4f1d9afaded696e9222dbea615bd7bd7308de47229fca79d25ffc915ab3e52222cb5e5316e7fd2f45b1d98a06615ce1871f90e42e4cfe73e7bf26d42ebf76d22400b4b824d903d5603a8cb7eebef4c2c2ebcd4a4f81c7c13cfb83940c6d66bb65098c509baf212acd640eeb9529eb58f209962a6dae76a512ea73d908af95b50343466df62d0a55e570cff65fcdc01d8f184c3ff4fc845919ba32cf2c04e598ae71e2f8811c254e26fb3305771070d0be33ec0c187cfd0472ef5d2a920ef8395e6a5573f975d866e25af02f67f8871e0d773e102028baa82f1e29823c9c36c1cf60513423a6cadd24d9b979b28799412c9b25083c0aa11df282fa631024a9fe8909fd9d9c68462e39cca7db222e78b681109b1b6c75edd53f956520a20887e56c68dbce271c2e31a1f674e16f41bef875cfe066b0f23f222a27e3be762e98e2a037544f4ab3e7de59f3ed03770515f44faa8c704c791f4ee979502b4175a4ad27aeb2e6cb8bb7345069357f770ee5ff90e9a4fa743f92e0be561f189882e9b87fb1ba883237c08212bd01e9a798c672d94fc1f3c0774186370e1ea5835dce2ba5711e279bc4d1166b5bd1f5bc4783af1c06a404e3b8eba9bdf717bb6ac7fcfba183b99f26b3b5cb9ca8e3b249acaaa24172ff9008cfe7a54248c66c55cd0547dea3b87dcbf72954c8af70d3ff8619cccc6ac1433fe9e5f7b1b616e283f043e7791f6016ab45fb73ebd17948f0d7d4e78011ee00ab3ef595cf9c2b86c410016994b4eab6940b0cc24b37603aaccc284bc650c66342277e2a53fb06b9b86817a6fd178b9b676f00ced318ccbba2e569b91d914faa52479753042a5a41722243fae52859395eb6e7b170c463b286183318b605f5d485950589934dfa90335c3008cbef3cbbe2716fd79198e1257af46370d80f96e8d431aaa84138922fa81d6aea738d08e5ccc44ca1c0c3c60d63771f901672bb6ea863860e12efefdd632202e9b9a95640b305e2b90ecce3ace55620ef0437ad274d9c58c7b61082ec62df62ade688dff6bd1324cc15113e253916eb94602be2ac7a5051420ffb7f9cd7e51ec83eaf63436064370bf3e4bc8df3f3c1021a652b7992a84a6e6249fc0c56e8103351d685e77584a5d8efbfcc937e4b2f0ee0d2c40bde4eb33ce175b99dd6e38df8ac1885e90a0c04a3040d74b94151a94441231fc7a5098df351ce7bdddf4be3f3c21b2feb139976d01fac057d6fead8c40b8044c6af4b8b2747d6e505bb0dfd9f8091d41cf1b4c7a680082e6ad2f155a6d8ab56edad219499ff7556575412d704a72c5ee09bbc0f039c2e3c0935be11ba95fffe545fec12361b11ef07820825463ec95887fa6098d777486e66eb482293d25ea3ca7f46e5a10f2de47b2ece0e9fa1bec0e05e0e1e6b85b7fa298429513bfda77ba06dff995cdb34b7c182084190067f527e704b66bd9de0f03be45b953bcee3b347fb4b0ef5030aa02754efee6285d304522c4874e71646fc46b8008b52a651668db75c29e720b62c226084930eb2984f8f0308a37ceb5148b923efaf5a636d5bc4d2ef04b55a1aeff7aa85392363a239ca0ca17c79c4ca166cb4b4336405b11bdb2a092e466d4a32ca8d70546d78f537d8d1bb0ed75ea71092d2e359c3f047f5164470df1ba187c2e7d2ea9853bd6346be5cadf067b1cc30f83cbdccf596f7d7b028320f142df66faf2c78b8f7e3ef395c0b479e83fb7ec3751fb620dc4c349ede1dffea2b2472d9a2c31c50ed830e19863cef1e7739f0535f70923ee6af37a6941108b660a317e7a246ef14c4c9058d4864baa15920a2411b39a2995802c2edfbe1f75a78ac8dbd535ee7444ee52524674cde041dc2e7b7857d75def39a33fa52ef85102af799325e251aae71db854724a1dc293ff95edc66394b19f4399445c9e0544ab2776aed1f9e42b7ee0ac7b0bb290afbf79916a7e2eb6b8853898f1bcc73560fdfc2c1d66c54c5e7843b8a99915fcfe11e053addb116bd7f353f3d01152784f8ef4c1844e67560dc06db7530ff234813e329164003397c2ed976dd2aecc8eaa041352da9104420b18f10c5e2ea499f032ec03273de99053dc47827b5e9a8966ee559e0847e821c56a16d21518f92e5a56a3453dcab9419c22999dafbc6a7d0881dec9048a7724796e5130d18"}}}}, &(0x7f0000ea3000)) [ 827.890274] binder: 3234:3236 BC_FREE_BUFFER u0000000000000000 no match [ 827.927595] binder: 3234:3236 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 22:56:18 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x2900000000000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:18 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x1000000]}) [ 827.934732] binder: 3234:3236 got reply transaction with no transaction stack [ 827.942126] binder: 3234:3236 transaction failed 29201/-71, size 0-8 line 2759 22:56:18 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0xc, &(0x7f0000000000)=r0, 0x4) 22:56:18 executing program 4: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) r0 = syz_fuse_mount(&(0x7f0000000340)='./file0\x00', 0x4000, 0x0, 0x0, 0x0, 0x0) chown(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) read(r0, &(0x7f0000000380)=""/4096, 0x35) r1 = syz_open_dev$vcsa(&(0x7f0000000180)='/dev/vcsa#\x00', 0x5, 0x8000) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f00000000c0)={0x0, @time={r2, r3+10000000}, 0x6, {0x80000001, 0x9}, 0x0, 0x3, 0x992}) 22:56:18 executing program 7: syz_emit_ethernet(0x3e, &(0x7f0000000000)=ANY=[@ANYBLOB="0180c2000000aaaaaaaaaa1e295290adb52c7897fbffffff000000ffffffff21009078000000004500000300000000000000e0ac14ffbbe0000001ab195726b40573b0205f6e7adc1f738b13b5154612e89267a6d27b337d86d1bd0eac063800fe02393dfcd2dace0d278ee24814e73d2626be078f6ddf178dd5a1"], &(0x7f0000ea3000)) 22:56:18 executing program 6: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x802, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000000)={{{@in=@rand_addr, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in6=@loopback}}, &(0x7f0000000100)=0xe8) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f0000000180)={@remote={0xfe, 0x80, [], 0xbb}, @loopback={0x0, 0x1}, @local={0xfe, 0x80, [], 0xaa}, 0x0, 0x1, 0x13a6, 0x100, 0x0, 0xfffffffffffffffd, r2}) r3 = dup(r0) ioctl$KDSKBMETA(r3, 0x4b63, &(0x7f00000002c0)=0x253960ab) r4 = memfd_create(&(0x7f0000000200)='\x00', 0x1) ioctl$sock_SIOCGSKNS(r3, 0x894c, &(0x7f0000000340)=0x8) ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f0000000300)={0x2, 0x8, 0xb638, 0x4, 0x7fff}) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r4, 0x84, 0x1d, &(0x7f0000000240)={0x5, [0x0, 0x0, 0x0, 0x0, 0x0]}, &(0x7f0000000280)=0x18) 22:56:18 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x3c000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:18 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x3]}) [ 828.112390] binder: 3234:3272 BC_FREE_BUFFER u0000000000000000 no match [ 828.120631] binder: 3234:3272 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 828.127718] binder: 3234:3272 got reply transaction with no transaction stack [ 828.135185] binder: 3234:3272 transaction failed 29201/-71, size 0-8 line 2759 [ 828.208160] binder: undelivered TRANSACTION_ERROR: 29201 [ 828.213792] binder: undelivered TRANSACTION_ERROR: 29201 22:56:19 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) read(r1, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(r0, 0xc0045877, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000016) 22:56:19 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x2f, &(0x7f0000000000)=r0, 0x4) 22:56:19 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) 22:56:19 executing program 7: socketpair$inet_tcp(0x2, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendto$inet(r0, &(0x7f0000000200)="63650b4b995ec47885b6412ca00df478e57179f3fd014fee72b6b9af0087a5b66dcd8c69735762dce046e8633795ff720047f1f63aae952c6c808cdf99587497373aea1d89", 0x45, 0x40000, &(0x7f0000000280)={0x2, 0x4e24, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = msgget(0x3, 0x90) msgctl$MSG_INFO(r2, 0xc, &(0x7f00000000c0)=""/253) accept4(r1, &(0x7f0000000000)=@can, &(0x7f0000000080)=0x80, 0x80800) ioctl$sock_inet_SIOCGARP(r0, 0x8954, &(0x7f00000002c0)={{0x2, 0x4e22, @loopback=0x7f000001}, {0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}, 0x64, {0x2, 0x4e20, @loopback=0x7f000001}, 'bridge0\x00'}) 22:56:19 executing program 6: r0 = socket$packet(0x11, 0x2, 0x300) mmap(&(0x7f00000c7000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x4000000000000000) setsockopt$sock_int(r0, 0x1, 0x2e, &(0x7f0000000000)=0x100000000, 0x4) 22:56:19 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x2f000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:19 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x1c00000000000000]}) 22:56:19 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0xffffffff00000000]}) 22:56:19 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x21, &(0x7f0000000000)=r0, 0x4) [ 828.947680] binder: 3298:3300 BC_FREE_BUFFER u0000000000000000 no match 22:56:19 executing program 7: syz_emit_ethernet(0x3e, &(0x7f0000000080)=ANY=[@ANYBLOB="aaaaaaaaaa20aaaaaaaaaa000800450000ff210090780000001b450000030000000000000000ac14ffbbe0000001e26186f4b198968a4f9e04c71258ad59687c784e2eb470a98d13c50724f2630eea1f9784a4fbf85610c52922977c1b8d9c252527e2b8ee23acfdc041dabd00dcd597eaac57a513becf23b2f3bbc5270c9da5bae6d050e8b73fe2bbbb19625bdd1255295d32f9732bc406e25db6cc614215d86d67932dcea517ce4df2bfd608df798ff66cbddd2852d2dec8b44ee7ccfb"], &(0x7f0000000000)) r0 = fcntl$getown(0xffffffffffffff9c, 0x9) ptrace$setopts(0x4206, r0, 0x3, 0x4) syz_extract_tcp_res(&(0x7f0000000040), 0x11b, 0x1) 22:56:19 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") getsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000080)={@mcast1={0xff, 0x1, [], 0x1}, 0x1, 0x3, 0x3, 0xc, 0x7b, 0x0, 0x2}, &(0x7f00000000c0)=0x20) r1 = socket$inet(0x2, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x1) getsockopt$inet_int(r1, 0x0, 0x22, &(0x7f00006ed000), &(0x7f0000000180)=0x4) ioctl$sock_inet_SIOCDARP(r1, 0x8953, &(0x7f0000000000)={{0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x10}}, {0x307, @random="e46c6c1e7dce"}, 0x4, {0x2, 0x4e23}, 'veth1\x00'}) [ 829.006568] binder: 3298:3300 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 829.013710] binder: 3298:3300 got reply transaction with no transaction stack [ 829.021098] binder: 3298:3300 transaction failed 29201/-71, size 0-8 line 2759 [ 829.138780] binder: 3298:3333 BC_FREE_BUFFER u0000000000000000 no match [ 829.156151] binder: 3298:3333 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 829.163444] binder: 3298:3333 got reply transaction with no transaction stack [ 829.170817] binder: 3298:3333 transaction failed 29201/-71, size 0-8 line 2759 [ 829.218256] binder: undelivered TRANSACTION_ERROR: 29201 [ 829.223955] binder: undelivered TRANSACTION_ERROR: 29201 22:56:19 executing program 4: r0 = socket(0x10, 0x4000000000000002, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'sit0\x00', &(0x7f0000000000)=@ethtool_cmd={0x49}}) r1 = syz_genetlink_get_family_id$fou(&(0x7f00000000c0)='fou\x00') sendmsg$FOU_CMD_GET(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80404450}, 0xc, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="00042dbd7000fddbdf2503000000040005000800040003000000080003007f00000008000139857d03000800040001000000040005000800030000000000080004000300000004000500080003003b000000"], 0x3}, 0x1, 0x0, 0x0, 0x40}, 0x4008081) 22:56:19 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x3300], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:19 executing program 7: syz_emit_ethernet(0x3e, &(0x7f0000000180)=ANY=[@ANYBLOB="0180c2000000aaaaaaaaaa00080045000030000000000067907800000000ffffffff2100000000000000000e0000e0000001000000000000000000000000ff675179efb9eadff4392d49e26d7b4280da69f9588534d62fec9b9ad28d0a1fa16848a1124787317fc3557a42debeb9f3288210a5a4ffc86a4a39d1ebf3651d3b618110"], &(0x7f0000ea3000)) io_setup(0x2, &(0x7f0000000140)=0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) userfaultfd(0x800) io_getevents(r0, 0x9000000000, 0x2, &(0x7f0000000040)=[{}, {}], &(0x7f00000000c0)={r1, r2+10000000}) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x210040, 0x0) ioctl$KVM_GET_PIT2(r3, 0x8070ae9f, &(0x7f0000000240)) 22:56:19 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x30000000]}) 22:56:19 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0xf, &(0x7f0000000000)=r0, 0x4) 22:56:20 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) read(r1, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(r0, 0x540f, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000016) 22:56:20 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295e273b5abcf477671070") r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x0, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000180)='/proc/self/net/pfkey\x00', 0x0, 0x0) io_setup(0x20, &(0x7f0000000040)=0x0) io_submit(r2, 0x1, &(0x7f0000000140)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x8, r1, &(0x7f0000000080)="cab82154fabcba3403cb7007dca4afd4db973fc7989363f21332900a07104ef05724541613b1b2c60831cc54269ea3c7b4d2e4c06d05119314c59a6a3961", 0x3e, 0x2, 0x0, 0x1, r1}]) fsync(r0) close(r1) 22:56:20 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6000000, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) 22:56:20 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x2b], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:20 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x1b, &(0x7f0000000000)=r0, 0x4) 22:56:20 executing program 7: syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)=ANY=[@ANYBLOB="0180c2000000aaaaaaaaaa000800458c2530000000000067907800000000ffffffff2100907800000000450000030000000000000000ac14ffbbe0000001"], &(0x7f0000ea3000)) r0 = memfd_create(&(0x7f0000000000)='@keyring\x00', 0x3) getsockopt$ARPT_SO_GET_ENTRIES(r0, 0x0, 0x61, &(0x7f0000000040)={'filter\x00', 0x1, "f2"}, &(0x7f0000000080)=0x25) 22:56:20 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x1c00]}) 22:56:20 executing program 4: r0 = open(&(0x7f0000000040)='./file0\x00', 0x90000, 0x20) ioctl$IOC_PR_CLEAR(r0, 0x401070cd, &(0x7f0000000080)) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) [ 829.992814] binder: 3361:3362 BC_FREE_BUFFER u0000000000000000 no match [ 830.024813] binder: 3361:3362 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 830.032010] binder: 3361:3362 got reply transaction with no transaction stack 22:56:20 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0xfffffff5], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:20 executing program 7: r0 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000000)='/dev/urandom\x00', 0x2040, 0x0) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)) [ 830.039573] binder: 3361:3362 transaction failed 29201/-71, size 0-8 line 2759 22:56:20 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x22, &(0x7f0000000000)=r0, 0x4) 22:56:20 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x30]}) 22:56:20 executing program 6: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1=0xe0000001}, 0x10) connect$inet(r0, &(0x7f0000004e00)={0x2, 0x1000000004e20, @loopback=0x7f000001}, 0x10) ioctl$sock_inet_SIOCGIFNETMASK(r0, 0x891b, &(0x7f0000000000)={'irlan0\x00', {0x2, 0x4e20}}) sendmmsg(r0, &(0x7f0000005f40)=[{{&(0x7f00000027c0)=@pppoe={0x18, 0x0, {0x0, @link_local={0x1, 0x80, 0xc2}, 'lo\x00'}}, 0x80, &(0x7f0000002a40), 0x0, &(0x7f0000002ac0)}}, {{&(0x7f0000002b40)=@rc={0x1f}, 0x80, &(0x7f0000002cc0)=[{&(0x7f0000002bc0)='\t', 0x1}], 0x1, &(0x7f0000002d00)}}], 0x2, 0x4008040) r1 = getuid() setsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000040)={{{@in=@rand_addr, @in=@local={0xac, 0x14, 0x14, 0xaa}, 0x4e22, 0x10000, 0x4e23, 0x4, 0xa, 0x80, 0x20, 0x0, 0x0, r1}, {0x40, 0x3, 0x100000000, 0x81, 0x5099, 0x0, 0x6, 0x79b9}, {0x4, 0x4c5, 0x0, 0xfa}, 0xfffffffffffffff9, 0x0, 0x2, 0x1, 0x2, 0x3}, {{@in6=@loopback={0x0, 0x1}, 0x4d3, 0x32}, 0xa, @in6, 0x3504, 0x0, 0x3, 0x3, 0x4, 0x5, 0x4}}, 0xe8) 22:56:20 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x1d, &(0x7f0000000000)=r0, 0x4) 22:56:20 executing program 7: r0 = syz_open_dev$amidi(&(0x7f0000000040)='/dev/amidi#\x00', 0x1, 0x100) ioctl$TIOCGSOFTCAR(r0, 0x5419, &(0x7f0000000080)) r1 = dup2(0xffffffffffffffff, 0xffffffffffffffff) write$cgroup_int(r1, &(0x7f0000000000)={[0x0]}, 0x1) socket$inet_tcp(0x2, 0x1, 0x0) 22:56:20 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x400000000000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) [ 830.277484] binder: undelivered TRANSACTION_ERROR: 29201 [ 830.350848] IPVS: ftp: loaded support on port[0] = 21 [ 830.792171] bridge0: port 1(bridge_slave_0) entered blocking state [ 830.798616] bridge0: port 1(bridge_slave_0) entered disabled state [ 830.805889] device bridge_slave_0 entered promiscuous mode [ 830.834739] bridge0: port 2(bridge_slave_1) entered blocking state [ 830.841157] bridge0: port 2(bridge_slave_1) entered disabled state [ 830.848377] device bridge_slave_1 entered promiscuous mode [ 830.876433] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 830.904659] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready 22:56:21 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) read(r1, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(r0, 0x40049409, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000016) 22:56:21 executing program 6: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r2, r1, 0x8, 0x0) r4 = socket$inet6(0xa, 0x1, 0x0) ioctl(r4, 0x4000008912, &(0x7f0000000100)="0a5ee13b1f16f477671070") vmsplice(r0, &(0x7f0000002480)=[{&(0x7f0000002400)="b9", 0x1}], 0x1, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r0, 0x40405515, &(0x7f0000000040)={0x2, 0x0, 0x8, 0x7fffffff, 'syz1\x00', 0xae}) close(r0) close(r1) vmsplice(r3, &(0x7f00000002c0)=[{&(0x7f0000000000)='u', 0x1}], 0x1, 0x0) 22:56:21 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x8]}) 22:56:21 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c000000, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) 22:56:21 executing program 7: r0 = syz_open_dev$usbmon(&(0x7f0000000080)='/dev/usbmon#\x00', 0x5, 0x4000) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(0xffffffffffffff9c, 0x84, 0x70, &(0x7f00000001c0)={0x0, @in={{0x2, 0x4e21, @multicast2=0xe0000002}}, [0x3, 0x5, 0x0, 0x3, 0xfff, 0x2615533, 0x5, 0x2, 0x400, 0x200, 0x8, 0x6, 0x8, 0x8000, 0x77d]}, &(0x7f00000002c0)=0x100) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f0000000300)={0x3, 0xffff, 0x8, 0x6, 0x1, 0xfffffffffffffffe, 0x3, 0xfffffffffffffff8, r1}, &(0x7f0000000340)=0x20) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f00000000c0)="c4824da82b66ba2100b801000000efb9270900000f323640a7650f30c4e2899c8e02000000f02046452ef3440f6fb800f0ff7fc42101dbc40f2047", 0x3b}], 0x1, 0x4000, &(0x7f0000000040)=[@flags={0x3, 0x200010}, @cr0={0x0, 0x10}], 0x2) ioctl$KVM_SET_MSRS(r5, 0x4008ae89, &(0x7f0000000380)=ANY=[@ANYBLOB="01000000001e00fb034d574b0000000001184c6f85cf140429e2b32138877be6592a3ca37205f73e637393abf579190f207bf6cbcca2c771f0159e43eb0fe93792"]) ioctl$KVM_ENABLE_CAP_CPU(r5, 0x4008ae8a, &(0x7f0000000140)) 22:56:21 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x3b00000000000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:21 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x9, &(0x7f0000000000)=r0, 0x4) [ 830.983596] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 831.045515] binder: 3471:3472 BC_FREE_BUFFER u0000000000000000 no match [ 831.053948] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 831.073744] binder: 3471:3472 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 831.080851] binder: 3471:3472 got reply transaction with no transaction stack [ 831.088251] binder: 3471:3472 transaction failed 29201/-71, size 0-8 line 2759 [ 831.161626] binder: 3471:3487 BC_FREE_BUFFER u0000000000000000 no match [ 831.169849] binder: 3471:3487 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 831.177056] binder: 3471:3487 got reply transaction with no transaction stack [ 831.184412] binder: 3471:3487 transaction failed 29201/-71, size 0-8 line 2759 [ 831.238194] binder: undelivered TRANSACTION_ERROR: 29201 [ 831.243887] binder: undelivered TRANSACTION_ERROR: 29201 [ 831.334576] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 831.341886] team0: Port device team_slave_0 added [ 831.371381] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 831.378714] team0: Port device team_slave_1 added [ 831.407124] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 831.437605] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 831.466953] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 831.496976] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 831.779943] bridge0: port 2(bridge_slave_1) entered blocking state [ 831.786362] bridge0: port 2(bridge_slave_1) entered forwarding state [ 831.793066] bridge0: port 1(bridge_slave_0) entered blocking state [ 831.799456] bridge0: port 1(bridge_slave_0) entered forwarding state [ 831.807123] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 832.735296] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 832.770568] 8021q: adding VLAN 0 to HW filter on device bond0 [ 832.860066] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 832.944926] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 832.951210] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 832.958895] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 833.045479] 8021q: adding VLAN 0 to HW filter on device team0 22:56:23 executing program 4: clone(0x200, &(0x7f0000000080)="dd92c2a3bb7c6e6b069bd54c0862e42dc666532e23ad4fc3e7c1c9d33c788963f827af6bff0221c41f82e1249e4628fad2c6edbad94c2e", &(0x7f0000000000), &(0x7f00000000c0), &(0x7f0000000140)="cedda342dc0f54009c03b7b271f6dee90c98cd51e231a01f90bd1a41638b46f07f5724bd89cb9c8adcd76ad731faac8e1bef0fa9eda82ae7b70b018293d48b0323ef19e31a459373d8905b06b58384941f0ce565998bac375686606883710420fc7a1f9b0edb00e36da5568dbc1cf7e80308e91b4e00968058bc0d18658ecfeafa38bacd2e226cd940b3d5ad7d6a0e4dcce39f7439096b743a4ffb7105056de0fbf2f550b40ccea17d3ec87c040c8208fb2b60cc509aa854f92372f6a80baf9535a09a0b1b09704802b3d6df064d45a768cb708f2b47eeb10b0412a1cf8ab8c898") mknod(&(0x7f0000f80000)='./file0\x00', 0x1040, 0x0) execve(&(0x7f0000f8aff8)='./file0\x00', &(0x7f0000a7bfc8), &(0x7f0000000400)) getpeername(0xffffffffffffff9c, &(0x7f0000000240)=@pppol2tpv3={0x0, 0x0, {0x0, 0xffffffffffffffff, {0x0, 0x0, @loopback}}}, &(0x7f0000000040)=0x80) getsockopt$packet_buf(r0, 0x107, 0x0, &(0x7f00000002c0)=""/129, &(0x7f0000000100)=0x81) r1 = gettid() socketpair$unix(0x1, 0x5, 0x0, &(0x7f000000d000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r2, 0x5452, &(0x7f0000008ff8)=0x3f) recvfrom$unix(r3, &(0x7f0000bf5000), 0x0, 0x0, &(0x7f0000d93ff6)=@file={0x0, './file0\x00'}, 0x6e) r4 = getpid() fcntl$setown(r2, 0x8, r4) fcntl$setsig(r2, 0xa, 0x12) kcmp(r1, r4, 0x1, 0xffffffffffffffff, 0xffffffffffffffff) dup2(r2, r3) tkill(r1, 0x16) exit(0x0) open(&(0x7f0000363ff8)='./file0\x00', 0x401, 0x0) ioctl$sock_SIOCSPGRP(r3, 0x8902, &(0x7f0000000380)=r1) 22:56:23 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x2b00], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:23 executing program 7: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cfb(blowfish-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b0", 0x4) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000024c0)="b31e61dffc8e97c88968c4cd644089f7602562c0f435a5f82aa73504c33c9da6662c8b993e4664ce8bf41af0024fb96e88cdc143f9ed77be30c3ccbe8b097a1a5eca4d442c85a3d3ca77828aca0381cb29242a5a935c7cb10e29f74eb6d35920dddd711f67d291848e5f9f9f1545a63ebdd581904fff235e3cf4d4b30ed136e8f8ed670cd05dd3edb9df8232559676f6bdcc066ddd4bf348d8cea93d8eb78d02ab8683a83361040b7036e937eb5ea1735da68242634abf254bc0e2f344ac620beeea48949536b2062b05ee7ead6402e7501c21bd65a287601d5ada5475b34ad25ad935c7839225ca9f8c4c3e5490d262764a695b547c4b611c67f84a7bbaef29d3e5db23178e33877f1f06d90ba061078f1558ffac498056f0dc36fd9b95a0d34c9f5c13c390a6092aa86ad4ff049102f22fcb2a01e736f187506058d000c30f7998743114d39ec016634303d5dbc13b4824b432fedf02ffc4ef9900da85d27fc665efbaf923608ab2d5f5d7f98a66b7fb8cfcbb948fac775705b890c4b04cad8e17e2398ba45ddf2fea6565764f45f7f60e4d28ff73076ca949a4cf1950b8102f64c04e1347df5ee01f1cba8f6838722551615de4b24949141ac120ed33d56de8bb14900578de32b9f62be38cc92e690116156147e57d941c40cd606c418208476d64845f1cf8e55c228f69d43b0bfd2c6317ce321a6a093b96a06c4ae85c5cc0db2d6e21b382d88fa4406f61eb0807d7befac33ca68f0aae59d2485d0baf4ef09367b5a1b21aea7135daf52ed5b5129b12cf7dd2fe6b4c2911ae8138d5f9eb2cf0e4fcde7d1f2eeddc13cc1737ec3d6ca6e4ad9abf0475eb128bef3c64c7755aa903b1c196a88c6889bcfe41647d32a42926e4ef9e1c8a31e7d9b9139731cde386253b01f85e386c71f5bae07e1ed47b505bdb2602638da2fba9f06ff06aa3c1445379ada246d2e42cd36fd29b1ce1355abf54aa90f8ee87d76ed38ee98815509770c9307636d8a8b3bad665937292426a4b648f29d61b278eaa3ab5c3b227566823e6bf1ad237749f7322f6e23840d54ddb42d05365d0b405601d20613db784af0b4a303625da3f24cd8ccbec5cb903431d90b8e1d9cd987197841bc4f6f6f2205290faeeacbb0f9cd87fac60f3ff6a1150cd58281337454b8a50a979a810ecd0da530ff7c80bd9754f02120a376f35964b397829df3c96e5268f870760bf2347c9fc3cce468394f1eb96909e6c568ab2a9b0fa41ed98689e865893e137c9d1003ce97596a746329bbbd9bda59923fcaeb1272238eae589cccac6bba38d986def826faec4c37af1e5ff7ecc312cb3c776775158b0a20ac17e2caef5a51ae2472414b8780a1aaac37caf685ef4a083a24d520559ddee8edd61447e87b14100aa25a3d609ed0806058cf32089fabaa835a3912259c7877c81186e8c73aff267a4959cef89afb145f0d1c0f08558d46309e60df0fc7a7f39f50044bbc0a15a457417d32308971392c4c455244e4a2df80d088299757783c9fcdcfc44c12f693a6ccf95afe9500e6f5ad4b45e8cb576d573039f0c6d7a0103a17ae29aea6e67f84b62046cecfb016fe1d654887a8f0e387d1d0b05a2ccd8f4dd663949a23fec5ceaf1684a63152b5ece4394b52e49f4d3dca17e0ee7e0e2d158e01df4aeb790c613e1ab8fa54267d7c29c99e2fda7e1fa3e529d1c2eb33aae8c7cd53be293a6875dcb2738e8013c0a937d7c6e1372d8bf0b6d09035795954b919d36c3008fc1840ac88854fdb7155a00d31b24fca686bd510501cad86c7bab02ae7d6311f49d7ced881c3ec59f996ca854874128909028c163ea477f819d381d5fa44ed90d6e24fb7aaf3d66335328edafd7aa4e32349cafbf7c634ddfb23b206efe0ae70071836130ee41b448aff7696ffff327f96f3e88471166024e21c375baf1d4c0ca6cfa847e4dd042935540286f06ae8747286b3c68f3bd4dc6c99ae0785b704c70860158d0ad05f44f87e790b6e6e5aa953e576d3abfc172764d70a959943e2ed659e0a3b6f48e06b0ebbc46a8e330ffe526c55c5f1a24b8857ffdbce92b20e95e660441074fdaeb7537ce9f781365d94fea3139067b2279d59aa5a91ad6104f4b3caac048567e99ffdbc7e74d76f36899b2be33bbefab8ce79d9e26ca99d6c78a3ef3add375b08f9be66c90012d49943da765f264da75ee67aa5aead5037ce74372d84dd51c6351992c60b5ccc703437a9111714e7f091a54c23089312e5f5c9033dec25396855156e6b8c7148f8805a2a9a727f25348083cc43010d8fc73a21a6014d424369b15b493129435aa772d942d75e0926f4a4ac2cd4a416d2ac74fe18c9c83108cfb5461588e5f369da9ba79699309da69237d771983c48dfaa81513d0aa2703e9a81281e6a8445eb820f3a5abcce343c3620807b48d362943ce9e67de712861cc071fbaf460d31171a6b0f896e4224c0cf2a6c36a1435d8c1b5a4c5abd423a250df37a43369e93dd00559431e184b3e563e5e7cd034a8054224aaf860c69fde4b95edf4bf603bbfac967ea8847c464af0a463c94a73e9663d0fdd3bc40430199dc3762b723ed8674316efc0037e4556d874f8e6e5befdeb8fc79205ff9bd9faa27cc130afc203a5562b05e24d84e4c31d6ef2cc01e8674578a07ca31e9730443018e8a1a96c85971a240333422177bf6bb51db3ecb071398484859cb929ef90cfd67e9deabafa191779f9837e3c5cff73dadb079c79fd5d4085aa2bfdcac3f71c1e6b2c6f83f3c48021a1845158f23869ecf634445b62363378ea609f304b311305f55d48dcfd3dd7ca15c6d21ada1b1f1acde955d4d92f81be1736f9efb4d05100412dabfbcb1bbe6c4be31d190fe263c3558415ddc27d7bfedcb324c2cf40cd5def4a3816dc8b35410ad1bebd26ba03041a6df17b4966e096f4e5adc6849524db199a97e9ebfccb165fc86cfe0aac3b169911d11b59ae7893612b6ac3c79cd47273d4aecd0b74dff76145c33257c9a52f645ecfd68c9c7c1db544d6fb575974ad0ad93992ea948f0cde240810fc0bba1f8092fb934188140168760b8ff79422bd4f4913a27d393cc7ff16ad2b776e99ea2a40ce73ec287873092c62418ff285c531c1bf648e8ce6462753d325bc1740245a2f5c7f5bef37223c0198267c28d47fa08a46d8900dad610d18d580c3ba7c5ec7c2a8894a270427aca263562a6717737b2677b40a76d83b3780c902c91ef3cf785bb16f88c5c3d37f1b8d441df98a75443b2d593c7b9e6fa3887f080592a2d564a3d76f401f5ad4a9e843e61ff2c222bf0ecdc58dbb0d918e8ac9cf129187ca9f83afcdc1adb270dc0a9d8fa05b8b73bbcc7abb5829b4d2d77f44b6021ddb32ef430857d24e988aefc20c6311a25e932323be0a963933fac63ac11c4547fdd876544c22f827a46c48a328392999ce304bf2d1d4fb859f04c26bf450e5d0081aa43407118e0c01ceccfeb286251aeb5a1bda02d21942547e5657b14604ad61779132aa26aa062d62e945ea0369ed2f28c6039ce21775133a567e2310e5e8def1328d3bb812149233fdc641c5119390fbfcb27da3a361a0fdab2bdebf559e42f27b18a074124bfb8267354a8dfae63c5efbe7dea43408e76558d174807d87e581a989968f906ff489cf43b8cb3919989833ad7fd4ac18ea6f9b7b031e023e0c900b14e3a6f40e7924c888797e9f6492c8f84a7e7ae88019fd53f924ac71041ee0f8d0aa3c39d4279085fb4214f7cf7bca7d285ae5e30890a25cae80321e14a67800159f087176cf28df730045b16a2317720e3d381fc43d0335b4a133e565b067421c0d2a82731800302c2ebbedb9427cef520213856d0463148f300950cb4a50b9eab08f6e956009c22d5208a0795a6b50cbc594bb39130b86f255e60f230cb0bbc297dd6a2c777bb0610d1aa507a52d3a462fb8f14edc9149abf2b934ab7dbb3bca2669cc1cd5aa2a0e6c6eb2da6373b43b7d2e00f89222d63a5a07a43a0b978d58663a946b2b2366f0f7f0a95106860bf062279d3ed001a2a4c47c86b677605bdc37c9fcb03f9712fed12e8619b288b783c9ee1dcc4ab1a4928a439c92330a24aaba0740ac549919e13e42a5fc7a631c252ae7b8d743cb18050347a79aa5e06d54979a053ddc398b9f949f25e0366587cdda2cc37e085eb3a84213d63835c29b22dbffe5d1341a0dd244428e71d96b34bcd866533645ef8074e331d9c8ec", 0xbb3}], 0x1, &(0x7f0000000300)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) syz_open_dev$adsp(&(0x7f0000000340)='/dev/adsp#\x00', 0x6, 0x40) recvmsg(r1, &(0x7f0000000240)={&(0x7f0000000080)=@llc={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x80, &(0x7f00000001c0)=[{&(0x7f0000000140)=""/107, 0x6b}], 0x1, &(0x7f0000000200)=""/6, 0xff7e}, 0x0) recvmsg(r1, &(0x7f0000001440)={&(0x7f0000000280)=@sco, 0x11c, &(0x7f00000013c0)=[{&(0x7f00000014c0)=""/4096, 0x1000}], 0x1, &(0x7f0000001400)=""/6, 0x6}, 0x0) 22:56:23 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x700]}) 22:56:23 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x700, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) 22:56:23 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x12, &(0x7f0000000000)=r0, 0x4) 22:56:23 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000004c0)={0x44, 0x3, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240), &(0x7f00000002c0)}}], 0x0, 0x0, &(0x7f00000003c0)}) r1 = dup(r0) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000000)={0x0, @multicast2, @local}, &(0x7f0000000040)=0xc) 22:56:23 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) read(r1, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(r0, 0x5414, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000016) 22:56:23 executing program 7: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x1, 0x0) fsync(r0) r1 = add_key$keyring(&(0x7f00000000c0)='keyring\x00', &(0x7f0000000200)={0x73, 0x79, 0x7a}, 0x0, 0x0, 0xfffffffffffffffe) add_key(&(0x7f0000000100)="6173796d6d65747269630000f623c165dbdd5da4e516feae1218931b7f62f1989e779cb3e199015e6f224dc786b78b696462c7dec58cd05fa42773a0af0a703d63e19620fd165b5d862cf735059c401152746037a51f9d035dcf4197d265f6f5d246b14212db69e767574420fb11a7308eb293967dbd5a729bb8c6833a854e2036d4e9270fef4cef270638e56c144263ecf6903800009d38f68668c21513e19c1311eea8ee94c59609987d033ca3c8ad624dbc5c8958aaa4e9158c5850c6228a22d0adaabe8bb566c069d5baa64e30af6d878c", &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000000280)="30818dd9c14c75bc8e4d592cffd4607c4b3b154d7fc4035cd9e32bc89c52351945927bc911ad1787c590714269ee80ae70cbf1f3c7dd26c2b99cb25df53fd91fcfd121392a1d5bdc4fbf1e9ffea1b710f7419e69fade3839634c8e06a9a6afa60fd985e068e135343fe4f4729d4717b87cce448951857dec90d730f5fe41ab38e32af6b9f76c548881ab710ff9be8910", 0x90, r1) 22:56:23 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x3b00], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) [ 833.630921] binder: 3712:3714 unknown command 64 [ 833.638772] binder: 3712:3714 ioctl c0306201 200004c0 returned -22 [ 833.653453] binder: 3713:3721 BC_FREE_BUFFER u0000000000000000 no match [ 833.660310] binder: 3712:3714 unknown command 64 [ 833.660329] binder: 3712:3714 ioctl c0306201 200004c0 returned -22 22:56:23 executing program 6: r0 = socket$inet6(0xa, 0x2, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") mkdir(&(0x7f0000000180)='./file0\x00', 0x0) r1 = syz_fuse_mount(&(0x7f0000000340)='./file0\x00', 0x4000, 0x0, 0x0, 0x0, 0x0) chmod(&(0x7f00000000c0)='./file0\x00', 0x0) umount2(&(0x7f0000000080)='./file0\x00', 0x2) r2 = dup2(r0, r1) inotify_add_watch(r2, &(0x7f0000000040)='./file0\x00', 0x0) 22:56:24 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0xffffffffffffffff]}) [ 833.738241] binder: 3713:3721 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 833.745370] binder: 3713:3721 got reply transaction with no transaction stack [ 833.752754] binder: 3713:3721 transaction failed 29201/-71, size 0-8 line 2759 22:56:24 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x2], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:24 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x2c, &(0x7f0000000000)=r0, 0x4) 22:56:24 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x300000000000000]}) 22:56:24 executing program 7: r0 = socket$inet6(0xa, 0x3, 0x10000000) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000b86000)={0x0, &(0x7f0000f40ff8)}, 0x10) mmap(&(0x7f0000000000/0xaa1000)=nil, 0xaa1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x4000000000000003) [ 833.925327] binder: undelivered TRANSACTION_ERROR: 29201 22:56:25 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000300), 0x4) r1 = socket$netlink(0x10, 0x3, 0x4) setsockopt$inet_mreq(r1, 0x0, 0x23, &(0x7f0000000000)={@local={0xac, 0x14, 0x14, 0xaa}, @loopback=0x7f000001}, 0x8) write(r1, &(0x7f0000fa8000)="2700000014000707030e0000120f0a0011000100f5fe0012ff000000078a151f75080039000500", 0x27) 22:56:25 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x25, &(0x7f0000000000)=r0, 0x4) 22:56:25 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x89ffffff], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:25 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48000000, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) 22:56:25 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETAW(r1, 0x5407, &(0x7f0000000000)) openat$null(0xffffffffffffff9c, &(0x7f0000000080)='/dev/null\x00', 0x80, 0x0) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snapshot\x00', 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TIMER(r2, 0xc0605345, &(0x7f0000000140)={0x7ff, 0x0, {0xffffffffffffffff, 0x0, 0x4, 0x3, 0x800000000000000}}) ioctl$VT_GETSTATE(r1, 0x5603, &(0x7f00000001c0)={0xaf, 0xd39, 0x8}) 22:56:25 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x300]}) 22:56:25 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) read(r1, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(r0, 0x545d, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000016) 22:56:25 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") unshare(0x2000400) r1 = inotify_init() ioctl$INOTIFY_IOC_SETNEXTWD(r1, 0x40044900, 0x80000000) r2 = creat(&(0x7f0000000140)='./file0\x00', 0x0) setsockopt$inet6_icmp_ICMP_FILTER(r2, 0x1, 0x1, &(0x7f00000001c0)={0xfda2}, 0x4) inotify_add_watch(r1, &(0x7f0000000240)='.\x00', 0x80000002) write$binfmt_elf64(r2, &(0x7f0000000280)=ANY=[@ANYBLOB="7f"], 0x1) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0}, &(0x7f0000000080)=0xc) r4 = add_key$keyring(&(0x7f00000000c0)='keyring\x00', &(0x7f0000000180)={0x73, 0x79, 0x7a, 0x1}, 0x0, 0x0, 0xfffffffffffffff8) ioctl$SIOCGIFHWADDR(r2, 0x8927, &(0x7f0000000200)) keyctl$get_persistent(0x16, r3, r4) ioctl$sock_inet_tcp_SIOCINQ(r1, 0x541b, &(0x7f0000000000)) [ 834.851805] binder: 3781:3784 BC_FREE_BUFFER u0000000000000000 no match [ 834.882999] binder: 3781:3784 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 834.890232] binder: 3781:3784 got reply transaction with no transaction stack 22:56:25 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0xe000000000000000, 0x2d4401) ioctl$KVM_ASSIGN_PCI_DEVICE(r1, 0x8040ae69, &(0x7f0000000040)={0x1, 0x6, 0x8, 0x2, 0xfffffffffffff6f9}) r2 = syz_open_dev$binder(&(0x7f0000000600)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000340)={0x10, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="04e30440000000000663070000000100"], 0x0, 0x0, &(0x7f0000000280)}) 22:56:25 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x2900], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:25 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x2a, &(0x7f0000000000)=r0, 0x4) [ 834.898727] binder: 3781:3784 transaction failed 29201/-71, size 0-8 line 2759 22:56:25 executing program 6: r0 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000000)='/dev/urandom\x00', 0xc000, 0x0) ioctl$sock_inet_SIOCGIFADDR(r0, 0x8915, &(0x7f0000000080)={'yam0\x00', {0x2, 0x4e21, @local={0xac, 0x14, 0x14, 0xaa}}}) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$sock_inet_SIOCSIFNETMASK(r1, 0x891c, &(0x7f0000000040)={'vcan0\x00', {0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}}) r2 = memfd_create(&(0x7f00000002c0)="bcf6", 0x0) write(r2, &(0x7f0000000300)='i', 0x1) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xfffffffffffffffe, 0x11, r2, 0x0) mincore(&(0x7f0000000000/0x1000)=nil, 0x1000, &(0x7f00000001c0)=""/92) 22:56:25 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000300), 0x4) r1 = socket$netlink(0x10, 0x3, 0x4) setsockopt$inet_mreq(r1, 0x0, 0x23, &(0x7f0000000000)={@local={0xac, 0x14, 0x14, 0xaa}, @loopback=0x7f000001}, 0x8) write(r1, &(0x7f0000fa8000)="2700000014000707030e0000120f0a0011000100f5fe0012ff000000078a151f75080039000500", 0x27) 22:56:25 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x0, 0x1c]}) [ 834.961684] binder: 3794:3795 unknown command 1074062084 [ 835.000250] binder: 3794:3795 ioctl c0306201 20000340 returned -22 [ 835.049842] binder: BINDER_SET_CONTEXT_MGR already set 22:56:25 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x0, 0xffffffff00000000]}) 22:56:25 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x33], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) [ 835.082415] binder: 3794:3795 ioctl 40046207 0 returned -16 [ 835.092786] binder: 3781:3815 BC_FREE_BUFFER u0000000000000000 no match [ 835.112306] binder: 3781:3815 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 835.119532] binder: 3781:3815 got reply transaction with no transaction stack 22:56:25 executing program 7: r0 = open(&(0x7f0000000000)='./file0\x00', 0x8000, 0x86) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) modify_ldt$write(0x1, &(0x7f0000000040), 0x10) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='children\x00') getsockopt$IP_VS_SO_GET_SERVICES(r1, 0x0, 0x482, &(0x7f0000000080)=""/180, &(0x7f0000000180)=0xb4) pread64(r1, &(0x7f0000000280)=""/12, 0xc4, 0x2) ioctl$KVM_SET_GSI_ROUTING(r0, 0x4008ae6a, &(0x7f00000002c0)={0x2, 0x0, [{0x7, 0x2, 0x0, 0x0, @adapter={0xffffffffffffffe0, 0x2, 0x20, 0x3, 0x8}}, {0x3f, 0x3, 0x0, 0x0, @msi={0x5f2, 0x7b1, 0x1c0000000000}}]}) 22:56:25 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x35, &(0x7f0000000000)=r0, 0x4) 22:56:25 executing program 6: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = fanotify_init(0x8, 0x8000) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vcs\x00', 0x200, 0x0) getsockopt$inet_sctp_SCTP_RTOINFO(r1, 0x84, 0x0, &(0x7f0000000000)={0x0, 0x6, 0x5701, 0x6}, &(0x7f0000000300)=0x10) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, &(0x7f00000001c0)={r2, 0x917b}, &(0x7f0000000280)=0x8) fanotify_mark(r0, 0x8, 0x8, r1, &(0x7f0000000040)='./file0\x00') syz_emit_ethernet(0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffff8000ff0800480000280000000000009078ac23521038361846da93efe084333f64dc1700ef00890300000000009078ffffff1972ab14bdd69e045abbeecc16022d5d421f802d0ef31db2a4598bca3a90a11ffa7b177fcb55cdad5f31aa9c5b70b433667b38a6742cc915a1a944e7fe7a6da9c9f214c87a39ab4df3a45bb1c7ef26c4586240d48b02eb37f0c0b1c39ffbf696c55f423a2c18520a3c06af5254264959da50b2d32a52879410f7978733cd6aaafb70ee16e3f7b690450500be373d34b7fe193bc848d83df00109af5069c7c445551b53cd61fc9ac2cf3fc73f0a33c9878c78543b58cb60c48101a5d7036f1982f212ab4cc1c201a5402ce03b4249498e64184898d2346ba43eb53eca6d43bf454e404c3a7c7652000000a361e46c7e3a0c7bbefbd671469c0a84b80e74f0ac86a6b45bf9b2db5594e7f7c26c575d841969f2f45d4cefde9afbd573e29f14b054d2ec4b772ed0a8c509ad0fef7ab1ff9ce7ae9816ae06b4c3d7bb7872326cceb7042328fe23e523cd2308fb9acbe3c8102d587004d894188499c060d6d08f357c926ee46bc20137f9b514dd89880c59e4ccd5c15de8e82825996bb3865449cf98073e906e44f1ead443e95e8c8971ced5d6f9945347142d0b9d613b59ecc5377879bb968b74d52864d871e80c2709ae3630566a6903d3040c1275a50088ca5e"], &(0x7f00000002c0)) ioctl$SNDRV_TIMER_IOCTL_STOP(r1, 0x54a1) [ 835.126905] binder: 3781:3815 transaction failed 29201/-71, size 0-8 line 2759 22:56:25 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4800, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) 22:56:25 executing program 4: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040)='/dev/zero\x00', 0xa2000, 0x0) bind$vsock_dgram(r0, &(0x7f0000000080)={0x28, 0x0, 0x2711, @hyper}, 0x10) ioctl$KDSKBLED(r0, 0x4b65, 0x3) r1 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f00000000c0)=@nat={'nat\x00', 0x19, 0x2, 0x2d0, [0x200002c0, 0x0, 0x0, 0x200002f0, 0x20000320], 0x0, &(0x7f0000000000), &(0x7f00000002c0)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x2, [{{{0x5, 0x0, 0x0, 'bridge0\x00', 'rose0\x00', 'veth0_to_bridge\x00', 'vlan0\x00', @link_local={0x1, 0x80, 0xc2}, [], @link_local={0x1, 0x80, 0xc2}, [], 0x70, 0x70, 0xa0}}, @common=@redirect={'redirect\x00', 0x8, {{0xfffffffffffffffe}}}}, {{{0x11, 0x0, 0x0, 'yam0\x00', 'veth0_to_team\x00', 'teql0\x00', 'gretap0\x00', @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], 0xb0, 0x138, 0x170, [@statistic={'statistic\x00', 0x18, {{0x7}}}]}, [@common=@IDLETIMER={'IDLETIMER\x00', 0x28, {{0x0, 'syz1\x00'}}}, @snat={'snat\x00', 0x10, {{@remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}}}}]}, @snat={'snat\x00', 0x10, {{@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff]}}}}]}]}, 0x348) [ 835.153397] binder: undelivered TRANSACTION_ERROR: 29201 [ 835.158990] binder: undelivered TRANSACTION_ERROR: 29201 22:56:25 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0xffffffffffffffff], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) [ 835.258215] binder: 3835:3837 BC_FREE_BUFFER u0000000000000000 no match [ 835.306949] binder: 3835:3837 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 835.314084] binder: 3835:3837 got reply transaction with no transaction stack [ 835.321466] binder: 3835:3837 transaction failed 29201/-71, size 0-8 line 2759 [ 835.418732] binder: 3835:3851 BC_FREE_BUFFER u0000000000000000 no match [ 835.426611] binder: 3835:3851 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 835.433706] binder: 3835:3851 got reply transaction with no transaction stack [ 835.441135] binder: 3835:3851 transaction failed 29201/-71, size 0-8 line 2759 [ 835.458737] binder: undelivered TRANSACTION_ERROR: 29201 [ 835.464310] binder: undelivered TRANSACTION_ERROR: 29201 22:56:26 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) read(r1, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(r0, 0x5428, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000016) 22:56:26 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") 22:56:26 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x6, &(0x7f0000000000)=r0, 0x4) 22:56:26 executing program 6: r0 = socket(0xa, 0x803, 0x6) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000040)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000080)={@empty, r1}, 0x14) socket$inet6_udplite(0xa, 0x2, 0x88) 22:56:26 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x0, 0x700]}) 22:56:26 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) close(r0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000003fe8)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r2, 0x84, 0x8, &(0x7f0000013e95), 0x4) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000400)={"7465616d3000000000000000fa00", &(0x7f0000000300)=@ethtool_sfeatures={0x17}}) close(r2) close(r1) 22:56:26 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x200000000000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:26 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4800000000000000, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) [ 835.869824] binder: 3862:3871 BC_FREE_BUFFER u0000000000000000 no match [ 835.905811] binder: 3862:3871 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 835.912935] binder: 3862:3871 got reply transaction with no transaction stack 22:56:26 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0xffffff8d], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:26 executing program 4: r0 = socket$inet6(0xa, 0x80000, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000040)="295ee1311f16f477671070") r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup\x00', 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000000)='io.max\x00', 0x2, 0x0) write$cgroup_int(r2, &(0x7f0000000140)=ANY=[@ANYBLOB='2:4\r'], 0x4) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(0xffffffffffffff9c, 0x84, 0x6d, &(0x7f0000000380)=ANY=[@ANYRES32=0x0, @ANYBLOB="230000003b32486206b85964eb6c5d0bac47de416bec9e7089158101b841fe75fa3a25d3aaf976fe6dc15b4ec198f2ce6806e0f222d8a4a8d1897bbbf40aae1a175b9e2ec84db866e6364e2af10721dde29ead28ccf0a2c2c7faa7b833a64aaf45c54478828cd7fd4cfeae1195ed4e70b4918414579d19e33ef7f83b58f46f0776ce53affbb521723ae418f1e0f113e489ec27053f38757a842ef4c61f9c3104bc92b569c519d706c11a6eb373baf92877efcb4c1efc13561926401cb29e61391794b4b1fc9da6496c9fceb9de5d86fce00c86d0b11cef27bcb7475265695e732e046baa7d2156488f9339e6caaf76d99ff9d97badd4d91799dc1ec71a873a8f"], &(0x7f0000000100)=0x2b) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f0000000180)={r3, @in6={{0xa, 0x4e24, 0x6, @local={0xfe, 0x80, [], 0xaa}, 0x1ff}}, 0x100000001, 0x7fff, 0xf8, 0x0, 0x8}, &(0x7f0000000240)=0x98) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x191000, 0x0) ioctl$UFFDIO_UNREGISTER(r4, 0x8010aa01, &(0x7f00000000c0)={&(0x7f0000ff9000/0x4000)=nil, 0x4000}) socketpair$inet6_udplite(0xa, 0x2, 0x88, &(0x7f00000002c0)) sendfile(r0, r0, &(0x7f0000000280), 0x100000001) r5 = syz_open_pts(0xffffffffffffffff, 0x400) ioctl$TIOCEXCL(r5, 0x540c) ioctl$KDSIGACCEPT(r5, 0x4b4e, 0x18) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f0000000300)={0x26, 'aead\x00', 0x0, 0x0, 'aegis256-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r6, 0x117, 0x1, &(0x7f00003c1000), 0x0) 22:56:26 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0xb, &(0x7f0000000000)=r0, 0x4) 22:56:26 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x0, 0xe0]}) 22:56:26 executing program 6: r0 = socket$netlink(0x10, 0x3, 0x10000000000004) writev(r0, &(0x7f0000000140)=[{&(0x7f0000000280)="48000000140019900953359bc877004b0101048c590a880900000000000000fe5f0028213ee20600d4ff5bffff00c7e5ed5e00000000c80000000000000000f5ffffffffffffff00", 0x48}], 0x1) socket$inet6(0xa, 0x7, 0x10001) r1 = syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x42200) setsockopt$inet_sctp_SCTP_HMAC_IDENT(r0, 0x84, 0x16, &(0x7f0000000000)={0x4, [0x3, 0x2, 0x522800, 0x4]}, 0xc) fcntl$getown(r1, 0x9) [ 835.920281] binder: 3862:3871 transaction failed 29201/-71, size 0-8 line 2759 [ 835.972301] binder: 3862:3881 BC_FREE_BUFFER u0000000000000000 no match 22:56:26 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x800000000000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) [ 836.029338] binder: 3862:3881 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 836.036485] binder: 3862:3881 got reply transaction with no transaction stack [ 836.043899] binder: 3862:3881 transaction failed 29201/-71, size 0-8 line 2759 22:56:26 executing program 6: r0 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={0xffffffffffffffff, 0x3, 0x1, 0x3, &(0x7f0000000000)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0xa}, 0x20) setsockopt$inet6_IPV6_ADDRFORM(r0, 0x29, 0x1, &(0x7f00000000c0)=0x2, 0x4) socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8008910, &(0x7f0000000100)="0970abf107c8") r1 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) mknodat(r1, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0) renameat2(r1, &(0x7f0000000340)='./file0\x00', r1, &(0x7f0000000380)='./file1\x00', 0x1) 22:56:26 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x3b000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) [ 836.161251] binder: undelivered TRANSACTION_ERROR: 29201 [ 836.166932] binder: undelivered TRANSACTION_ERROR: 29201 22:56:27 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) read(r1, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(r0, 0xc0045878, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000016) 22:56:27 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x2d, &(0x7f0000000000)=r0, 0x4) 22:56:27 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = add_key$keyring(&(0x7f0000000100)='keyring\x00', &(0x7f0000000140)={0x73, 0x79, 0x7a}, 0x0, 0x0, 0xfffffffffffffffb) r2 = add_key$keyring(&(0x7f0000000300)='keyring\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, 0x0, 0x0, r1) open(&(0x7f0000000940)='./file0\x00', 0x0, 0x0) add_key(&(0x7f0000000000)='dns_resolver\x00', &(0x7f0000000080)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000180)="c6a34e987940ea478d9bd365b9e4621e334652733324b7773a3df8a7504d9e18e2e4a839fcd9030000000000000028945d12a9caae603ff81c4dc32ed3d70fb5d4c5b866305249060000005277822d0e0616a2e5b74c48e38b9936f298c6feec95ad327c724ec507bd34b94e99623f014bf81ea54900ac54a99aa04e1a7f000000e8d3bfa2f3abce9736aac3e0b19d5a697bc438cd49bc1cf3af72c2180bbee78e9a7237c02e10ac77e3a4fd8a6e2bdca6a9a1d7da1a3e559fdafb6703c73b3c4c10865302fb324f16327996273625d9f0a54ef16bdb08f22ed11fd80b74eb861aebe51b0912c0f79486c25c49524ffe4f00", 0xf2, r2) request_key(&(0x7f0000000040)='dns_resolver\x00', &(0x7f00000002c0)={0x73, 0x79, 0x7a, 0x3, 0x1000500}, &(0x7f00000000c0)='\x00', 0x0) 22:56:27 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000000000, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) 22:56:27 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x0, 0x3]}) 22:56:27 executing program 4: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu\x00', 0x200002, 0x0) r1 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x100000000, 0x81) r2 = openat$cgroup_ro(r0, &(0x7f0000000180)='memory.stat\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_NUMBER(r1, 0x84, 0x1c, &(0x7f00000000c0), &(0x7f0000000100)=0x4) read(r2, &(0x7f0000000080)=""/20, 0x14) poll(&(0x7f0000000000)=[{r0, 0x8328}], 0x1, 0x10000) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000400)={0x0, 0xfffffffffffffffd, 0x83, 0x3e102798, @scatter={0x0, 0x0, &(0x7f00000001c0)}, &(0x7f0000000200)="ca471d77691c36fbf902414170a5c01ad527a7b7d779c3bf5931727583517c732b4f5c21f44591eea6025b2e30482f388b591e03610582889f3dd2c32c1538693e9b1c44a7c5a263d7d3b12a794a755588d213bb36c89a3a97bbbc1a53f2ca32bffbaeed70ca7a568f2efd7f4cd1ad943228129ddc438ed4f86c454ddb2cf25cfef052", &(0x7f00000002c0)=""/244, 0x3, 0x0, 0x3, &(0x7f00000003c0)}) 22:56:27 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x3b], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:27 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000080)="2957e1311f16f477671070") 22:56:27 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x4], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:27 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r0, 0xc02c5341, &(0x7f0000000040)) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") unshare(0x12020100) ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f0000000000)={0x4, 0x4, 0x1, 0x7, 0x10001}) [ 836.926851] binder: 3933:3935 BC_FREE_BUFFER u0000000000000000 no match [ 836.954673] binder: 3933:3935 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 836.961891] binder: 3933:3935 got reply transaction with no transaction stack [ 836.969269] binder: 3933:3935 transaction failed 29201/-71, size 0-8 line 2759 22:56:27 executing program 6: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000080)=@pppol2tpin6={0x18, 0x1, {0x0, r0, 0x3, 0x0, 0x0, 0x0, {0xa, 0x2, 0x0, @remote={0xfe, 0x80}}}}, 0x32) close(r1) close(r1) 22:56:27 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xae0000)=nil, 0xae0000, 0x0, 0x4d031, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/qat_adf_ctl\x00', 0x80, 0x0) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x25dfdbff, 0x1000010}, 0xc) 22:56:27 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000000)=r0, 0x3) 22:56:27 executing program 7: r0 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x2000) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000080)={0x4, &(0x7f0000000040)=[{0x3, 0x6, 0x8, 0xf6}, {0x0, 0x80, 0x0, 0x5}, {0x7, 0x9, 0x7}, {0x1, 0x9, 0x3f, 0x2}]}, 0x10) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000000c0)='veth0_to_team\x00', 0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) listen(r2, 0x4) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x2, &(0x7f000039a000)=[{0x20, 0x0, 0x0, 0xfffff02c}, {0x6}]}, 0x10) ioctl$LOOP_SET_CAPACITY(r0, 0x4c07) 22:56:27 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x0, 0x400000000000000]}) 22:56:27 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0xf5ffffff00000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) [ 837.093910] binder: 3933:3960 BC_FREE_BUFFER u0000000000000000 no match [ 837.151329] binder: 3933:3960 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 837.158446] binder: 3933:3960 got reply transaction with no transaction stack [ 837.165852] binder: 3933:3960 transaction failed 29201/-71, size 0-8 line 2759 [ 837.343577] binder: undelivered TRANSACTION_ERROR: 29201 [ 837.349328] binder: undelivered TRANSACTION_ERROR: 29201 22:56:28 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) read(r1, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(r0, 0x5437, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000016) 22:56:28 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000ff8000), 0x0) r2 = accept$alg(r1, 0x0, 0x0) socketpair(0xa, 0x80000, 0x4, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SG_GET_SCSI_ID(r3, 0x2276, &(0x7f00000000c0)) sendmmsg$alg(r2, &(0x7f0000003e80)=[{0x0, 0x0, &(0x7f0000001400), 0x0, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r2, &(0x7f00000015c0)={&(0x7f0000000040)=@pppol2tpin6, 0x80, &(0x7f00000014c0)=[{&(0x7f0000003ec0)=""/4096, 0x1000}], 0x1, &(0x7f0000001580)=""/32, 0x20}, 0x0) 22:56:28 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000000)=r0, 0x20000004) 22:56:28 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0xffffffff00000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:28 executing program 7: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cuse\x00', 0x8000000002, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/tcp6\x00') sendfile(r0, r1, &(0x7f0000493000), 0xfffffffd) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f0000000040)={0x0, 0x9b5, 0x96}, &(0x7f0000000080)=0x8) ioctl$SNDRV_CTL_IOCTL_TLV_READ(r0, 0xc008551a, &(0x7f0000000140)=ANY=[@ANYBLOB="0000000010b2d8106a00000001800000000001003f000000"]) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r1, 0x84, 0xa, &(0x7f0000000100)={0x6e, 0x7ff, 0x8000, 0x5, 0x8, 0x7b67, 0x8, 0xffff, r2}, 0x20) 22:56:28 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x0, 0xffff000000000000]}) 22:56:28 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback={0x0, 0x1}}, 0x1c) listen(r0, 0xffffffffffffff7f) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r1, &(0x7f0000e33fe0)='X', 0x1, 0x0, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback={0x0, 0x1}}, 0x1c) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000001540)='/dev/rtc0\x00', 0x511000, 0x0) setsockopt$ALG_SET_AEAD_AUTHSIZE(r2, 0x117, 0x5, 0x0, 0xfffffffffffffffd) getsockopt$inet_sctp6_SCTP_RTOINFO(r1, 0x84, 0x7c, &(0x7f00000000c0)={0x0, 0xa00}, &(0x7f0000000100)=0x10) 22:56:28 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000000000000, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) 22:56:28 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x0, 0xe0000000]}) 22:56:28 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) socketpair$inet_smc(0x2b, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000000)=r0, 0x4) shutdown(r2, 0xb8a1d6199ad49551) socket$vsock_dgram(0x28, 0x2, 0x0) 22:56:28 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x2b00000000000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) [ 838.013656] binder: 3989:3990 BC_FREE_BUFFER u0000000000000000 no match [ 838.037625] binder: 3989:3990 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 838.044769] binder: 3989:3990 got reply transaction with no transaction stack [ 838.052325] binder: 3989:3990 transaction failed 29201/-71, size 0-8 line 2759 22:56:28 executing program 7: r0 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vsock\x00', 0x400, 0x0) ioctl$KVM_GET_PIT2(r0, 0x8070ae9f, &(0x7f00000000c0)) r1 = syz_open_procfs(0x0, &(0x7f0000000180)='net/ip6_tables_matches\x00') getsockopt$inet6_mreq(r1, 0x29, 0x1d, &(0x7f0000000140)={@local, 0x0}, &(0x7f00000001c0)=0x14) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f0000000200)={r2, 0x1, 0x6, @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}}, 0x10) r3 = socket$kcm(0x29, 0x20000000000005, 0x0) sendfile(r3, r1, &(0x7f0000000040)=0x1, 0x10003) write$binfmt_aout(r3, &(0x7f0000000000)=ANY=[@ANYBLOB='\x00'], 0x1) 22:56:28 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x2) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) read(r0, &(0x7f0000000080)=""/199, 0xc7) write$binfmt_elf64(r0, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f454c4e6546000000007d95c88c1612786908655d4e1d310e524467c8a1648dd39a8400080033000000b35deebba752cb5e00b96c93ac19724b1680c1c3e388c160ace5cb9f350cd8bdc1fce8faa44b0ac91aedeb2f59059abda5302087183fca4ec788444ae6fd17e3e03b36364ce3f800e4f95369893c9e3f022872b25cbaa3"], 0x2a) [ 838.097840] binder: 3989:4014 BC_FREE_BUFFER u0000000000000000 no match [ 838.121892] binder: 3989:4014 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 838.129075] binder: 3989:4014 got reply transaction with no transaction stack [ 838.136454] binder: 3989:4014 transaction failed 29201/-71, size 0-8 line 2759 22:56:28 executing program 6: unshare(0x40000000) r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000100)="290000000000000000ffffda060200000100000001040000040d000a00ea1100000005000000f707baaee4c4559ebd775f94957a70680f8482069279df2d80d9f8ba45a16b2f1d26401b2006ff0ac0f6397a405c773f53bfea4b258917b1b8973308d8601f60a13f00000000000000c28b2a298926", 0x75}], 0x129f) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'bond0\x00', 0x101}) [ 838.209840] Unknown ioctl -2140098913 22:56:28 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=ANY=[@ANYBLOB="181a00000008000000f9ff00be0000009500000000000000"], &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/mixer\x00', 0x100, 0x0) getdents64(r2, &(0x7f0000000080)=""/119, 0x77) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000000)=r0, 0x4) [ 838.238574] Unknown ioctl -2140098913 22:56:28 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x2c000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) [ 838.307772] IPVS: ftp: loaded support on port[0] = 21 [ 838.325501] binder: undelivered TRANSACTION_ERROR: 29201 [ 838.331171] binder: undelivered TRANSACTION_ERROR: 29201 [ 838.437409] IPVS: ftp: loaded support on port[0] = 21 [ 838.465773] device bond0 entered promiscuous mode [ 838.470727] device bond_slave_0 entered promiscuous mode [ 838.476353] device bond_slave_1 entered promiscuous mode 22:56:29 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) read(r1, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(r0, 0xc0189436, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000016) 22:56:29 executing program 7: r0 = socket(0x18, 0x0, 0x1) connect(r0, &(0x7f0000000040)=@pptp={0x18, 0x2, {0x0, @broadcast=0xffffffff}}, 0x20) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x40, 0x0) ioctl$KVM_SET_XCRS(r1, 0x4188aea7, &(0x7f00000000c0)={0x1, 0x2f58dcfa, [{0x80000001, 0x0, 0x1}]}) 22:56:29 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x0, 0x8000000]}) 22:56:29 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000000000000, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) 22:56:29 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=ANY=[@ANYBLOB="1800000000000000000000cdfc000000"], &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x12000, 0x0) ioctl$UFFDIO_WAKE(r1, 0x8010aa02, &(0x7f0000000080)={&(0x7f0000ffb000/0x2000)=nil, 0x2000}) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x1, &(0x7f00000000c0)={0xffffffff}, 0x106, 0x6}}, 0x20) write$RDMA_USER_CM_CMD_QUERY(r1, &(0x7f0000000180)={0x13, 0x10, 0xfa00, {&(0x7f0000000340), r2, 0x2}}, 0x18) r3 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r3, 0x1, 0x32, &(0x7f0000000000)=r0, 0x4) 22:56:29 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x2f00], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:29 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") unshare(0x400) r1 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_RECVRCVINFO(r1, 0x84, 0x20, &(0x7f00000001c0)=0x31, 0x4) r2 = syz_open_dev$midi(&(0x7f0000000040)='/dev/midi#\x00', 0x8, 0x40200) r3 = syz_open_dev$admmidi(&(0x7f0000000100)='/dev/admmidi#\x00', 0x8, 0x100) ioctl$VHOST_SET_VRING_KICK(r2, 0x4008af20, &(0x7f0000000140)={0x3, r3}) getsockopt$inet_sctp_SCTP_RECVRCVINFO(r1, 0x84, 0x20, &(0x7f0000000000), &(0x7f0000000180)=0xff66) [ 839.054466] binder: 4061:4065 BC_FREE_BUFFER u0000000000000000 no match [ 839.085464] binder: 4061:4065 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 839.092646] binder: 4061:4065 got reply transaction with no transaction stack [ 839.100103] binder: 4061:4065 transaction failed 29201/-71, size 0-8 line 2759 22:56:29 executing program 6: perf_event_open(&(0x7f0000000280)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair(0x8000000000001e, 0x1, 0x0, &(0x7f000000dff8)={0xffffffffffffffff, 0xffffffffffffffff}) write$sndseq(r1, &(0x7f000082cf40), 0x203a0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) timerfd_settime(r0, 0x1, &(0x7f0000000080)={{0x0, 0x989680}, {r2, r3+10000000}}, &(0x7f00000000c0)) close(r1) close(r0) 22:56:29 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x2f], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:29 executing program 7: r0 = socket$kcm(0x29, 0x5, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="00f78c2cf82bd876b01fee8b30b3872f07d82c992409705dd5a452ffa78ad98be8cab6ef4743b55997fb397f8a51fc94ad9452e94e2eb0ddaf967e03fafa4237514fe942bbbf892cd7ec79f8955808d3980659d4dd420faa66ff5cfaca4e0faa2c77fffc0d0d85671de4eadc40411f5e719bd9fd06d1fbcf36409b018a21016f1a7a36f224910c23a4c7b040c2b8e853fa199231613c4b3f714a4f8401dfde4dd856b6eaa5f3c649cadab5371ac13447c4b5e6763a3f0a1e634e1d9cffda70db7ad75b5ea9b38eef4118c9a964a614e65e08bfcc8bad9ae42834acadf6c191d88c960073bd28b79d91") r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f00000001c0)={0x73, 0x79, 0x7a}, &(0x7f0000000100)='\x00', 0x1, 0xffffffffffffffff) keyctl$setperm(0x5, r1, 0x2000000) clone(0x0, &(0x7f0000000200), &(0x7f0000000180), &(0x7f0000000280), &(0x7f00000002c0)) keyctl$get_security(0xb, r1, &(0x7f0000000080)=""/84, 0x54) r2 = syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x10001, 0x1) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r2, 0x40045542, &(0x7f0000000200)=0x80000001) 22:56:29 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=ANY=[@ANYBLOB="180000000000000000000000000000000000000000000000"], &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000000)=r0, 0x4) 22:56:29 executing program 4: r0 = socket(0x1, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000000), 0x1}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$sock_inet6_udp_SIOCOUTQ(r0, 0x8902, &(0x7f0000000000)) r1 = syz_open_dev$mouse(&(0x7f0000000040)='/dev/input/mouse#\x00', 0x6, 0x101800) ioctl$HDIO_GETGEO(r1, 0x301, &(0x7f0000000080)) 22:56:29 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x0, 0x3000000]}) 22:56:29 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0xf5ffffff], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:29 executing program 4: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$inet6(0xa, 0x1, 0xfffffffffffffffe) r2 = add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f00000001c0)={0x73, 0x79, 0x7a, 0x1}, 0x0, 0x0, 0xfffffffffffffffb) keyctl$get_security(0x11, r2, &(0x7f0000000240)=""/96, 0x60) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") getsockopt$inet_udp_int(r0, 0x11, 0x6c, &(0x7f0000000200), &(0x7f0000000180)=0x4) fsync(r1) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f00000000c0)='vegas\x00', 0x6) syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x0, 0x2) getsockopt$inet6_mtu(r1, 0x29, 0x17, &(0x7f0000000040), &(0x7f0000000080)=0x4) [ 839.276507] binder: 4061:4094 BC_FREE_BUFFER u0000000000000000 no match [ 839.302665] binder: 4061:4094 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 839.309816] binder: 4061:4094 got reply transaction with no transaction stack [ 839.317154] binder: 4061:4094 transaction failed 29201/-71, size 0-8 line 2759 22:56:29 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x0, &(0x7f0000000040)=ANY=[], &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000000)=r0, 0x4) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x60080, 0x0) ioctl$KVM_S390_UCAS_UNMAP(r2, 0x4018ae51, &(0x7f0000000080)={0x4, 0x4, 0x5}) [ 839.518543] binder: undelivered TRANSACTION_ERROR: 29201 [ 839.524409] binder: undelivered TRANSACTION_ERROR: 29201 22:56:30 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) read(r1, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(r0, 0x540b, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000016) 22:56:30 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x0, 0x4000000]}) 22:56:30 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0xffffff89], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:30 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000)={0x0, 0x0, 0x0}, &(0x7f0000000040)=0xc) socket$inet6(0xa, 0x6, 0x3) setgid(r1) 22:56:30 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7000000, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) 22:56:30 executing program 7: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x800, 0x0) getsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, &(0x7f0000000080)=0x80000000, &(0x7f00000000c0)=0x2) r1 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = socket(0x40000000015, 0x805, 0x0) r3 = dup3(r1, r2, 0x80000) ioctl$TIOCGLCKTRMIOS(r3, 0x5456, &(0x7f0000000000)={0x8, 0x10001, 0xf7, 0xfffffffffffffffd, 0x2, 0x7ff, 0x4, 0x40, 0xa64d, 0x7, 0x3, 0x100}) 22:56:30 executing program 6: r0 = accept$inet6(0xffffffffffffff9c, &(0x7f0000000180)={0x0, 0x0, 0x0, @local}, &(0x7f00000001c0)=0x1c) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000200), &(0x7f0000000240)=0xc) r1 = socket$kcm(0x2, 0x800000000002, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)=@nfc={0x27, 0x0, 0x2, 0x3}, 0xd0b7a20e2b82d5d5, &(0x7f00000019c0)}, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(r1, 0x890b, &(0x7f0000000000)) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x800, 0x0) ioctl$sock_bt_bnep_BNEPGETCONNLIST(r2, 0x800442d2, &(0x7f0000000140)={0x1, &(0x7f0000000100)=[{0x0, 0x0, 0x0, @broadcast}]}) 22:56:30 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ppp\x00', 0x80000, 0x0) ioctl$TCSETAW(r1, 0x5407, &(0x7f00000001c0)={0x1000, 0x1, 0x4, 0x1, 0x24f, 0x4, 0x7, 0x4, 0x6, 0x4}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080)={0x0, 0x0}, &(0x7f00000000c0)=0xc) fstat(r0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) chown(&(0x7f0000000040)='./file0\x00', r3, r4) socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000000340)) r5 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r5, 0x1, 0x32, &(0x7f0000000000)=r0, 0x4) ioctl$sock_SIOCSPGRP(r1, 0x8902, &(0x7f0000000380)=r2) [ 840.190243] binder: 4127:4139 BC_FREE_BUFFER u0000000000000000 no match 22:56:30 executing program 6: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000002c0)='net/udp6\x00') getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000300)={0x0, 0x4, 0x3, [0x7f, 0x81, 0x4]}, &(0x7f0000000340)=0xe) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000380)={r1, @in6={{0xa, 0x4e21, 0x6, @local={0xfe, 0x80, [], 0xaa}, 0x400}}, 0x0, 0xffffffffffffff01, 0x0, 0x9, 0x4}, &(0x7f0000000440)=0x98) r2 = open(&(0x7f00000001c0)='./bus\x00', 0x40, 0x0) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x1, 0x11050, r2, 0x100000000000) setsockopt$inet6_MCAST_JOIN_GROUP(r2, 0x29, 0x2a, &(0x7f0000000100)={0x80000000000008b, {{0xa, 0x4e22, 0x4, @loopback={0x0, 0x1}, 0x8}}}, 0x88) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r2, &(0x7f0000000080)={0x4000000d}) r3 = syz_open_dev$sndmidi(&(0x7f0000000040)='/dev/snd/midiC#D#\x00', 0xe440, 0x1) ioctl$KVM_GET_REGS(r2, 0x8090ae81, &(0x7f0000000580)) r4 = socket$inet6(0xa, 0xa, 0x80) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_bt_bnep_BNEPGETCONNLIST(r3, 0x800442d2, &(0x7f0000000240)={0x2, &(0x7f0000000200)=[{0x0, 0x0, 0x0, @link_local}, {0x0, 0x0, 0x0, @broadcast}]}) ioctl(r4, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") write$cgroup_type(r3, &(0x7f00000000c0)='threaded\x00', 0xff4c) timerfd_gettime(r0, &(0x7f0000000480)) 22:56:30 executing program 7: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/stat\x00') setsockopt$IP_VS_SO_SET_EDITDEST(r0, 0x0, 0x489, &(0x7f0000000140)={{0x3f, @empty, 0x4e23, 0x4, 'nq\x00', 0x2, 0x5, 0x13}, {@local={0xac, 0x14, 0x14, 0xaa}, 0x4e20, 0x4, 0x0, 0xf55}}, 0x44) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000040)={0xaa}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) ioctl$UFFDIO_UNREGISTER(r1, 0x8010aa01, &(0x7f0000000000)={&(0x7f000069b000/0x1000)=nil, 0x1000}) setsockopt$inet_sctp_SCTP_HMAC_IDENT(r0, 0x84, 0x16, &(0x7f0000000100)=ANY=[@ANYBLOB="010100000400"], 0x6) r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000240)='/dev/mixer\x00', 0x402, 0x0) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f00000001c0)={0x0, 0x6}, &(0x7f0000000200)=0x8) setsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r2, 0x84, 0x72, &(0x7f0000000280)={r3, 0x0, 0x10}, 0xc) ioctl$KVM_SET_VAPIC_ADDR(r2, 0x4008ae93, &(0x7f00000000c0)=0x10000) 22:56:30 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x0, 0x8]}) 22:56:30 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0xffffffffffffffff], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) [ 840.235440] binder: 4127:4139 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 840.242708] binder: 4127:4139 got reply transaction with no transaction stack [ 840.250103] binder: 4127:4139 transaction failed 29201/-71, size 0-8 line 2759 22:56:30 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000040)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928856af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000000)=r0, 0x4) r2 = dup2(r0, r0) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r2, 0x10e, 0x1, &(0x7f0000000180)=0x1f, 0x4) 22:56:30 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x800000000000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) [ 840.405189] binder: 4127:4164 BC_FREE_BUFFER u0000000000000000 no match [ 840.437635] binder: 4127:4164 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 840.444760] binder: 4127:4164 got reply transaction with no transaction stack 22:56:30 executing program 7: r0 = syz_open_procfs(0x0, &(0x7f0000000080)="2f6578650000000000049b840572137291be10eebf000ee9a90f798058439ed5e901d2da75060002acc7edbcd7a071fb35331ce39c5a000000080000007c54ecf16b46e8f5eb845f06c2b4833f0f84b356f039192806008f7ce66c7288410412f83962fc4ae2805c44331afe5705952580b49acad4596489f4455f2cba58ee6d298147dfab3256c742c1b69f67793dfd6a9b4db888e646223be7fb8b2717202ea956118f193fb8ab5dd2c0fdaf9716ed51bd15d81d43b89e1cecabcba5d2e62f5b3ec8667778db1218b7bc16e0571138971db98e50262419de58d747295da8aebc0f7f7f5680e4d3eeade20a2d3e420b35456180b109549e4ef0e1b55691030039ce36a24837297a9b9f7a674b065f6f33f02b4ff484f04d8bba269191d364ec5ac1383d9ab7460d2a89938fb7600936d99b6a7926fafb27e09600c5030b051d15119f710af1a0") ioctl$fiemap(r0, 0xc020660b, &(0x7f0000000000)=ANY=[@ANYBLOB="00000000000000bfa6006d5b9204000000000001000000000000000000216b149c6dc531f6bc28d1a6545c6eb60ab5c9c67199d4890035a5ababfdc1e04a45fb1bdebbe4aafdf65476b089773e6ee308e8f72eef05d9a734dca261efe9070c6b860af6fb65f122fdeb"]) ioctl$TCSETAW(r0, 0x5407, &(0x7f0000000200)={0xfffffffffffffffa, 0x5, 0x80000000, 0x609, 0xb34, 0x6, 0x6, 0x4, 0x9, 0x81}) 22:56:30 executing program 4: r0 = socket$alg(0x26, 0x5, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r0, 0x40a85323, &(0x7f0000000180)={{0x0, 0x2cbf}, 'port1\x00', 0x20, 0x400, 0x6190, 0x7, 0x81, 0x7, 0x7ef, 0x0, 0x3, 0x3}) r1 = geteuid() r2 = getuid() setreuid(r1, r2) bind$alg(r0, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cipher_null\x00'}, 0x58) r3 = accept4(r0, 0x0, &(0x7f0000000040)=0x31e, 0x0) r4 = socket$inet6(0xa, 0x5, 0x0) ioctl(r4, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") openat$mixer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/mixer\x00', 0x0, 0x0) r5 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ipv6_route\x00') sendfile(r3, r5, &(0x7f00000002c0), 0x10000000000443) [ 840.452329] binder: 4127:4164 transaction failed 29201/-71, size 0-8 line 2759 [ 840.627631] binder: undelivered TRANSACTION_ERROR: 29201 [ 840.633209] binder: undelivered TRANSACTION_ERROR: 29201 22:56:31 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) read(r1, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(r0, 0x2, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000016) 22:56:31 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000040)=r0, 0xffffffffffffff43) 22:56:31 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x0, 0x3000000000000000]}) 22:56:31 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0xffff000000000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:31 executing program 7: mq_open(&(0x7f0000000000)='{\x00', 0x801, 0x90, &(0x7f0000000080)={0x6, 0x4, 0x2, 0x1, 0x2, 0x2, 0x10000000000, 0x8000}) r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000040)="0700e1311f16f477671070") clone(0x0, &(0x7f0000000140), &(0x7f0000000180), &(0x7f0000000280), &(0x7f00000002c0)="d167dba7ec323a34c9c143e8250ae4f58a1ffc38a9c26c8c8576844dd3047daf68647cce5459cc30e76ab7b895146a1994fed16c688eb16eeeeab66fb04d53b5d72000000000000000b7f5dd6d5e33d826414bfe7a0a93f017e869b388f1e47bd15e5ada83844bc3fd14e1bb911f7a527d3fb9bfb4f08676141ad8a73486425f2191d0c7d108004fd07ca203b7a01466bae24167000000000000000000") prctl$getreaper(0x25, &(0x7f0000000100)) setsockopt$inet6_MRT6_ADD_MIF(r0, 0x29, 0xca, &(0x7f00000000c0)={0x6826, 0x1, 0x80000000, 0x5, 0x3}, 0xc) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000200)='/dev/autofs\x00', 0x2, 0x0) ioctl$sock_inet_SIOCGARP(r1, 0x8954, &(0x7f0000000380)={{0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x14}}, {0x1}, 0x44, {0x2, 0x4e22, @broadcast=0xffffffff}, 'erspan0\x00'}) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000140)='/dev/full\x00', 0x4000, 0x0) setsockopt$inet_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f00000001c0)='tls\x00', 0x4) 22:56:31 executing program 4: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x4, 0x8a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x792, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x8000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket(0x40000000000010, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/ip_mr_vif\x00') ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000000)={0x1}) sendfile(r0, r1, &(0x7f0000000200), 0x100000001) 22:56:31 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) 22:56:31 executing program 6: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f760070") r1 = socket$inet(0x10, 0x3, 0x0) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000540), 0x4) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000180)=[{0x8b68, 0x2, 0x0, 0x4000000000004}]}, 0xffffffcb) sendmsg(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000880)="240000002e0007031dfffd946fa2830020200a0009000300001d85680c1ba3a20400ff7e280000001100ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) [ 841.198480] netlink: 8 bytes leftover after parsing attributes in process `syz-executor6'. [ 841.213716] binder: 4195:4199 BC_FREE_BUFFER u0000000000000000 no match 22:56:31 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x33000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:31 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = socket(0xa, 0x1, 0x0) ioctl(r2, 0x8912, &(0x7f0000000080)="c626262c8523bf012cf66f") mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) setsockopt$bt_BT_RCVMTU(r2, 0x112, 0xd, &(0x7f0000000000)=0x1, 0x2) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000004c0)={0x4c, 0x0, &(0x7f0000000380)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)}, 0xfff}}], 0x0, 0x0, &(0x7f0000000440)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008fd0)={0x50, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000100)}}}, @register_looper={0x630b}], 0x0, 0x0, &(0x7f0000fedffe)}) [ 841.254515] binder: 4195:4199 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 841.261641] binder: 4195:4199 got reply transaction with no transaction stack [ 841.269123] binder: 4195:4199 transaction failed 29201/-71, size 0-8 line 2759 22:56:31 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x0, 0x600]}) 22:56:31 executing program 6: r0 = socket$kcm(0x29, 0x200000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000100)="0042fc2f07d82c99240970") r1 = syz_open_dev$sndseq(&(0x7f0000053ff3)='/dev/snd/seq\x00', 0x0, 0x101802) write(r1, &(0x7f0000000140), 0x0) open_by_handle_at(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="71000000ff000000049cfef42c138bbd93e14ecf17f1c5d0481321ca8cabf2898fd4ee9107bba72c85e523b30ca6d8b482cb1b4e6684915a4e563c3120c70029c8f1624c9be3711fe16e52eccd7649f8060d7c614fb8fab7211853bb851fa0819f5c0401712b904f2df82a056e8c2799c986170ff9185c907b0518afc0772a682e578ba175cbf75a06a26e56a1280bf25ab238e92a83551464889a9e4217efafb3c13199c8785a3e405aac729bc99f265a07fa433e9e984d64f50a4cca4df32de5cd2dea5f413ce85b7d802445e327f65dd62c5d68793c541c97738d79c8c9fb0c6ecdeb3331b46ed80faf6bcf"], 0x2) ppoll(&(0x7f0000000000)=[{r1}], 0x1, &(0x7f0000000040)={0x0, 0x989680}, &(0x7f0000000080), 0x8) 22:56:31 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ppp\x00', 0x80002, 0x0) ioctl$BLKRAGET(r2, 0x1263, &(0x7f0000000100)) fstatfs(r1, &(0x7f0000000040)=""/112) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000000)=r0, 0x4) [ 841.337255] binder: 4195:4215 BC_FREE_BUFFER u0000000000000000 no match [ 841.373149] binder: 4195:4215 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 841.380259] binder: 4195:4215 got reply transaction with no transaction stack [ 841.387610] binder: 4195:4215 transaction failed 29201/-71, size 0-8 line 2759 [ 841.420502] binder: BINDER_SET_CONTEXT_MGR already set 22:56:31 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) fsetxattr(r0, &(0x7f0000000040)=@known='security.ima\x00', &(0x7f0000000080)='setgroups\x00', 0xa, 0x3) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket(0x10, 0x2, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000140)='setgroups\x00') sendfile(r1, r2, &(0x7f00000000c0), 0x80000002) ioctl$BLKPBSZGET(r2, 0x127b, &(0x7f0000000000)) [ 841.441615] binder: 4225:4229 ioctl 40046207 0 returned -16 [ 841.458514] binder: 4225:4229 got transaction to context manager from process owning it [ 841.466832] binder: 4225:4229 transaction failed 29201/-22, size 0-0 line 2843 22:56:31 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) 22:56:31 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x8dffffff], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) [ 841.502650] binder: undelivered TRANSACTION_ERROR: 29201 [ 841.508251] binder: undelivered TRANSACTION_ERROR: 29201 [ 841.516810] binder_alloc: 4225: binder_alloc_buf, no vma [ 841.522433] binder: 4225:4229 transaction failed 29189/-3, size 0-0 line 2967 [ 841.579874] binder: 4241:4242 BC_FREE_BUFFER u0000000000000000 no match [ 841.603574] binder: 4241:4242 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 841.610701] binder: 4241:4242 got reply transaction with no transaction stack [ 841.618073] binder: 4241:4242 transaction failed 29201/-71, size 0-8 line 2759 [ 841.635116] binder: BINDER_SET_CONTEXT_MGR already set [ 841.643142] binder: BINDER_SET_CONTEXT_MGR already set [ 841.663344] binder: 4225:4247 ioctl 40046207 0 returned -16 [ 841.672224] binder: 4225:4229 ioctl 40046207 0 returned -16 [ 841.685424] binder_alloc: 4225: binder_alloc_buf, no vma [ 841.691093] binder: 4225:4249 transaction failed 29189/-3, size 0-0 line 2967 [ 841.711066] binder: 4241:4253 BC_FREE_BUFFER u0000000000000000 no match [ 841.721690] binder_alloc: 4225: binder_alloc_buf, no vma [ 841.726063] binder: 4241:4253 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 841.727412] binder: 4225:4247 transaction failed 29189/-3, size 0-0 line 2967 [ 841.734288] binder: 4241:4253 got reply transaction with no transaction stack [ 841.748983] binder: 4241:4253 transaction failed 29201/-71, size 0-8 line 2759 [ 841.777151] binder: undelivered TRANSACTION_ERROR: 29189 [ 841.783537] binder: undelivered TRANSACTION_ERROR: 29189 [ 841.789539] binder: undelivered TRANSACTION_ERROR: 29201 [ 841.800659] binder: undelivered TRANSACTION_ERROR: 29189 [ 841.826680] binder: undelivered TRANSACTION_ERROR: 29201 [ 841.832291] binder: undelivered TRANSACTION_ERROR: 29201 22:56:32 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) read(r1, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(r0, 0x5418, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000016) 22:56:32 executing program 6: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000240)='/dev/sequencer2\x00', 0x2, 0x0) ppoll(&(0x7f0000000040)=[{r0}], 0x1, &(0x7f00000000c0)={0x77359400}, &(0x7f0000000100), 0x8) ioctl$TCSETSF(r0, 0x5100, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 22:56:32 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x0, 0x3000]}) 22:56:32 executing program 7: syz_emit_ethernet(0x3e, &(0x7f0000000380)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "c42e59", 0x8, 0x67, 0x0, @ipv4={[], [0xff, 0xff], @broadcast=0xffffffff}, @local={0xfe, 0x80, [], 0xaa}, {[], @udp={0x0, 0x0, 0x8}}}}}}, &(0x7f0000000000)) r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000640)='/dev/zero\x00', 0x400100, 0x0) getsockopt$EBT_SO_GET_INIT_ENTRIES(r1, 0x0, 0x83, &(0x7f00000007c0)={'nat\x00', 0x0, 0x4, 0xb6, [], 0x5, &(0x7f0000000680)=[{}, {}, {}, {}, {}], &(0x7f0000000700)=""/182}, &(0x7f0000000840)=0x78) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000007c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='.', &(0x7f0000000380)="045b898f73", 0x1004, 0x0) umount2(&(0x7f0000000100)='./file0\x00', 0x4) mount(&(0x7f00000008c0)='.', &(0x7f00000002c0)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000003c0)) umount2(&(0x7f0000000040)='./file0\x00', 0x0) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000600)='/dev/snapshot\x00', 0x100001, 0x0) r3 = gettid() ioctl$SNDRV_CTL_IOCTL_ELEM_REPLACE(r2, 0xc1105518, &(0x7f00000004c0)={{0x7, 0x7, 0xc469, 0x101, 'syz0\x00', 0x5c}, 0x6, 0x410, 0x0, r3, 0x5, 0x7fffffff, 'syz0\x00', &(0x7f0000000200)=['\x00', 'mslos\x00', '\x00', 'bdev\x00', 'em0cpuset\x00'], 0x17, [], [0x6, 0x3f, 0x401, 0x8a]}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffff9c, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000400)={0xffffffff}, 0x0, 0x5}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r2, &(0x7f0000000480)={0x1, 0x10, 0xfa00, {&(0x7f00000003c0), r4}}, 0x18) syz_emit_ethernet(0x9c, &(0x7f0000000040)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @empty, [{[], {0x8100, 0x6, 0x100000000, 0x2}}], {@mpls_mc={0x8848, {[{0x8903, 0xa35c, 0x6, 0xffffffff}, {0x8000, 0x100000001, 0x4, 0x7ff80000}], @generic="c52859909b7b56d4e2b523250221adb88d9b77689378bbfb090578749aa9ae7d7462c405e759a31a0ed2d2c124fd40f5bd5fb6bae3a23e2e17fd166192adedf4838626f5a66adc6dff3329be68bde150e3ed283531b77420abbb28f0df8c6b17ad903f3eafb81bcde1e590f1cdf365d5a29a4c1dd760389873785590bc03b186f1d2"}}}}, &(0x7f0000000100)={0x1, 0x3, [0x6bb, 0x7d2, 0xb01, 0x434]}) r5 = syz_open_dev$dmmidi(&(0x7f0000000180)='/dev/dmmidi#\x00', 0x9, 0x2) bpf$OBJ_PIN_MAP(0x6, &(0x7f00000001c0)={&(0x7f0000000140)='./file0\x00', r5}, 0x10) 22:56:32 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000000000000000000000000000950000000000000092b6a25422b2c9399f37c172cb815b9f0284f8ceba3df6ecbc5069286ac23f5b68a648d53ce6b5053e35a0bd9cf8b011d5238fa037f32a37fe84972c64b1e1c7cd1e6ccb5aac13433eaa97c240fae1070d8276c53885b9173eceee4c1526446f4cade2d074a9102bcd1a4a4d93e07ade3023872bba4e6c0fe318809d1c64293558a05c9afff498310864bd5c809dad28158696ae2d5c1b8ba7336b08b2af09ca56c35cdf7e2b1766b5bb6b0edeca328c798073ec79a9b92801ea9250193fb7699062b08a4486d0261e0074f6521a05b31410bc2df390f269d280366a9558a711c62ec3414756d3a55552e96877e4540d0734934e99c321c4ce9b99d664c7aad79dff9a43803800aae14fa393"], &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000000)=r0, 0x4) 22:56:32 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x3c00000000000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:32 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f0000000140)=0x13, 0x71) r1 = syz_open_dev$admmidi(&(0x7f0000000040)='/dev/admmidi#\x00', 0x19b400, 0x400000) getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f0000000080)={0x0, @dev, @rand_addr}, &(0x7f00000000c0)=0xc) bind$can_raw(r1, &(0x7f0000000100)={0x1d, r2}, 0x10) r3 = socket$netlink(0x10, 0x3, 0x10000000004) write(r3, &(0x7f0000fa8000)="2700000014000707030e0000120f0a0011000100f5fe0012ff000000078a151f75080039000500", 0x27) 22:56:32 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) [ 842.258877] binder: 4260:4261 BC_FREE_BUFFER u0000000000000000 no match [ 842.266139] binder: 4260:4261 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 842.273228] binder: 4260:4261 got reply transaction with no transaction stack [ 842.280662] binder: 4260:4261 transaction failed 29201/-71, size 0-8 line 2759 22:56:32 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x3300000000000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:32 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000000)=r0, 0x4) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x0, 0x0) ioperm(0x2, 0x7, 0x9) 22:56:32 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x0, 0x300000000000000]}) 22:56:32 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x20110, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0xfffffffffffffffe, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r3, r4, &(0x7f000000f000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0xaaaaaaaaaaaab7d, 0x0, &(0x7f0000000000), 0x0) [ 842.361329] binder: 4260:4279 BC_FREE_BUFFER u0000000000000000 no match [ 842.377386] binder: 4260:4279 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 842.384565] binder: 4260:4279 got reply transaction with no transaction stack [ 842.392087] binder: 4260:4279 transaction failed 29201/-71, size 0-8 line 2759 22:56:32 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x6000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:32 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000000, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) 22:56:32 executing program 7: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000240)="295ee1311f16f477671070") r3 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000015c0)={r3}) r4 = eventfd(0x0) r5 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r4}) socket$inet_sctp(0x2, 0x5, 0x84) ioctl$KVM_IRQFD(r5, 0x4020ae76, &(0x7f0000000000)={r3}) 22:56:32 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x0, 0xe000000000000000]}) [ 842.504610] binder: undelivered TRANSACTION_ERROR: 29201 [ 842.510272] binder: undelivered TRANSACTION_ERROR: 29201 [ 842.582129] binder: 4297:4300 BC_FREE_BUFFER u0000000000000000 no match [ 842.629119] binder: 4297:4300 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 842.632909] irq bypass consumer (token 00000000d34d2a78) registration fails: -16 [ 842.636300] binder: 4297:4300 got reply transaction with no transaction stack [ 842.636321] binder: 4297:4300 transaction failed 29201/-71, size 0-8 line 2759 [ 842.688704] binder: 4297:4311 BC_FREE_BUFFER u0000000000000000 no match [ 842.690258] irq bypass consumer (token 0000000020419f2a) registration fails: -16 [ 842.695848] binder: 4297:4311 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 842.710196] binder: 4297:4311 got reply transaction with no transaction stack [ 842.717528] binder: 4297:4311 transaction failed 29201/-71, size 0-8 line 2759 [ 842.760440] binder: undelivered TRANSACTION_ERROR: 29201 [ 842.766078] binder: undelivered TRANSACTION_ERROR: 29201 22:56:33 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) read(r1, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(r0, 0x5421, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000016) 22:56:33 executing program 4: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) r1 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0x2, 0x501000) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000040)={0x0, 0x47, "827ae0b299f370115bfe11639d1dfdf198e5c831fe4f607218107d2b373f00f8047c708af1a9bef7854530b365d6e9b44fee40303a0967b0a9c66c1fa97636cf9cebe41fa92b76"}, &(0x7f00000000c0)=0x4f) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f0000000100)={r2, 0x400}, 0x8) socket$alg(0x26, 0x5, 0x0) 22:56:33 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") syz_emit_ethernet(0x13e, &(0x7f0000000040)={@link_local={0x1, 0x80, 0xc2}, @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, '>![', 0x108, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @empty, {[], @gre={{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x880b}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x86dd}, {0x8, 0x88be, 0x0, {{0x0, 0x1}, 0x1}}, {0x8, 0x22eb, 0x0, {{0x0, 0x2}, 0x2}}, {0x8, 0x6558, 0x0, "c53f9bc10b5218fbe6b21126ec5dfd4b51895eeabb8f1881b91980e74888ed41c49dc1d8bafc100ed78e3cc3b555dd235dba88b38388d4deb8c6d3795dcf58efc348b06d6b0f767c7520b7f6b0ca7326a75ba6ca9e1dadc8a4fecca66ad80f29bc3bb41a06f18c6f4f0b195587ebc281814d6457127854ef65964f36cbef44461b195c5e4c40fe1a57ae459fadf5b343cca1eeb3cdd0243195920ebeb7ebe99d397ef4d81cd3bca637aa32fbb0205fa83ce13b0277825ee8de7e55926a410d09a500e29e"}}}}}}}, &(0x7f0000005840)) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r2 = creat(&(0x7f0000000180)='./file0\x00', 0x63) setsockopt$inet_udp_encap(r2, 0x11, 0x64, &(0x7f00000001c0), 0x4) r3 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r3, 0x1, 0x32, &(0x7f0000000000)=r1, 0x4) 22:56:33 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x700], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:33 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x0, 0x100000000000000]}) 22:56:33 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c00000000000000, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) 22:56:33 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback={0x0, 0x1}}, 0x1c) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000240)='/proc/sys/net/ipv4/vs/cache_bypass\x00', 0x2, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r1, 0xc0a85352, &(0x7f0000000280)={{0x7f}, 'port0\x00', 0xa, 0x20000, 0xfffffffffffffffb, 0xa42, 0x2, 0x8, 0x3, 0x0, 0x1, 0x800}) listen(r0, 0xffffffffffffff7f) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) r3 = accept4(r0, &(0x7f00000003c0)=@in={0x0, 0x0, @multicast1}, &(0x7f0000000380)=0x3e, 0x0) sendto$inet6(r2, &(0x7f0000e33fe0)='X', 0x1, 0x0, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000040)={0x0, @in={{0x2}}, 0x0, 0x6, 0x0, 0x0, 0x100000000002d}, 0x98) clock_gettime(0x0, &(0x7f00000001c0)={0x0, 0x0}) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r1, 0x84, 0x6, &(0x7f0000000440)={0x0, @in={{0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0xe}}}}, &(0x7f0000000340)=0x84) setsockopt$inet_sctp6_SCTP_CONTEXT(r3, 0x84, 0x11, &(0x7f0000000500)={r6, 0x6}, 0x8) utime(&(0x7f0000000540)='./file0\x00', &(0x7f0000000580)={0xd0, 0xff}) select(0x40, &(0x7f0000000100)={0x4, 0x8000, 0x4, 0x6, 0x0, 0x1, 0x7, 0x1ff}, &(0x7f0000000140)={0x5, 0x2, 0x1, 0x20, 0xfffffffffffffff9, 0x7, 0x40, 0x4}, &(0x7f0000000180)={0x0, 0xf800000000, 0x0, 0x0, 0x6, 0x81, 0x6, 0x3}, &(0x7f0000000200)={r4, r5/1000+10000}) 22:56:33 executing program 6: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f760070") r1 = socket(0x2000000011, 0x2, 0x0) socket$packet(0x11, 0x3, 0x300) getsockopt$bt_BT_SECURITY(r1, 0x112, 0x4, &(0x7f0000000000), 0x2) sendto$inet6(r1, &(0x7f00000004c0)="957a88ca", 0x4, 0x0, &(0x7f0000000580)={0xa, 0x20008100, 0x5}, 0x1c) [ 843.337344] binder: 4321:4323 BC_FREE_BUFFER u0000000000000000 no match 22:56:33 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = gettid() pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r2, 0x84, 0x15, &(0x7f0000000140)={0x5}, 0x1) lstat(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TUNSETOWNER(r3, 0x400454cc, r4) wait4(r1, &(0x7f0000000240), 0x0, &(0x7f00000002c0)) 22:56:33 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0xfffffff5], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) [ 843.384500] binder: 4321:4323 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 843.391642] binder: 4321:4323 got reply transaction with no transaction stack [ 843.399071] binder: 4321:4323 transaction failed 29201/-71, size 0-8 line 2759 22:56:33 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x0, 0x1000000]}) 22:56:33 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) ioctl$int_in(r0, 0x5452, &(0x7f0000000100)=0x1000) openat$vnet(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vhost-net\x00', 0x2, 0x0) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) r2 = syz_open_dev$dmmidi(&(0x7f0000000180)='/dev/dmmidi#\x00', 0x7f, 0x0) getsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r2, 0x84, 0xc, &(0x7f00000001c0), &(0x7f0000000340)=0x4) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000000)=r0, 0x4) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000040)={r1}) setsockopt$IP_VS_SO_SET_DELDEST(r3, 0x0, 0x488, &(0x7f0000000080)={{0xbd, @multicast2=0xe0000002, 0x4e21, 0x1, 'ovf\x00', 0x26, 0x40, 0x20}, {@empty, 0x4e22, 0x2003, 0x4a, 0x8001, 0x101}}, 0x44) 22:56:33 executing program 6: r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0xfcc, 0x40000) setsockopt(r0, 0x7d, 0x4e, &(0x7f0000000040)="35b7806e22538ce5a446139ba61a72a1618c19148091908a130d213a9221a01369d05b82d8f4e2ce448232cad21afaec7290f4dd861d60f66914887fc58bbfdd8bfcc9058a2bd7f4da17ec970df437b505b5e700db6edff6d2f4a960977267ed10b80f462bb215de377429401417051f31da85c9d197c4e83877896d895457142edabc09ce5e6ca752722de5c8c19c8ac6560a9afa197397883fe1ad6789446091741f7e5c6d82110ccf15079a6a2d7fc2db161fdf2f8d65bcf6f5332e1cfd75bcd34b5f66186da5a1f3bee57c9c305026c1ed353b040997d7afe82cac44ddd6ef6a17c62432aaafc88b410057bd454179bfefd60bce5db6dd624271b3a18df0db92114fd3b3bb0fc71dc21d309d874aa443186396bba268be99fa54ddc473a5509e3cd54239d80baef401d0fcc8f34757a33a601ed6e90fe1cf40c6ab21e912dd38613df1a7e8eda25b9d1853b41cc79933284febaddfe39bb3cb6f6229439e39970f355717a0ffbed21d7252f9bf02d181d8f0b47e9ee255806c304e907855d72c92a6e124524907d8f929ca8e56c940be2aea01f863da34790bf7d0df5f9e6d4ef25f4a80308291a09c72286ca1f320099f88adb4f92486d7c7700e3cd88420eae7087991677790404c0a97b7b79bb8d4c2fa12284a076d1a4dfd26d748a3ecef61148f43ff4dd676cd817a113ae823b9b80bf30900d79927cc7de9b23ac666bfa316cc68a5891446db7ec6d038007d545ada4bdf2288fbfb4f778b08ac37b5732c5b443606a6ed9f1a40cc5a3835bc7bcbad83d1c1f45bdf7eca64a2c1c66dd2804b699bbb45aaf5c968861c848d5304d962f15258a473a91bbd7faf5c517e19a24ba378928429af4f7289d4caa52a53ac8fc7e7a1b30de00daf93f20c28d32d03b0e5964de265884b3f4a487ceae6cc0a18c4421bbb5d9058beb5896ce2c60ac4b416d8ed3ef2211018ec08946553554ecdce297703763a0133e48f5ab1ab2f4fca3ac2923099b017db87145c0a5ea5b4b9a03d7aa0ee1aadd55eefcce57575dd90597ed09c799b0016bec2610efaf78a5b2d02db888cb723340bbe71cc5c42371479761a0ca7af2f67e81631fca27cde82455ace62800a79099bc346f5d4c8b3c1f2b884c47bbae0cb13bc59d2f8a3a868604dcdde56d6ccc684aa3127a0d441efdf2e8089809de0d588a9e33b865ca98c1ac65299a7ec677c0a140c5f1f6553ac15ac6220c236c64b5b07fa0095977d380645e1511d23042d37fd7a1b436628efc8a0f350a70eb00978863a64cc0e8d2286cfa62eb2a64ef760335a5a234709fbc0ac2fbd17faa9ac73d1500615ee59b061f6bc89f2bd9173422fa6cefc628aa5e56f2936d594ac532da3922c3283200349d9a5e8b105e0656cff693436f14c95ddf3868178e8437864b4b90ca4a060df89bd5905168493d0f51d61cf5cec57d4dc5e856c2829294ba1adb192d5fccbe5c9729aa1e46e1f3da4c19a52e789855814acd25ea2cc1411c0525efeca96c3c6ea3cc0f1dec9b707a35b5f46c259b838ac5f9ba454235846d8bf9254e058df34f9e0061ab14d1ac988c27049fa297276f5bf5067df826a2d4d43158ab47a3f9e8c37355d1c11ad5254073eb074c2f3c16f0ceccef03764d0886f3336960f14acc08a954f3025d914ab394da7364d59f6be411450247b0fd513e5c1ae5efca9fb4e1950a36732b8285ccf23cf20b73afc28f47ae53842301a480dd4d121a9f2528d87223616e24340453acc66593633069a96bc0b70fd452aaee9ea4f00400a10d8f9aee312d1a7f801d0977f16685476b876fc4b26269d7fd98a83b424abb925fe5461fca62a5c0edbfc5e5dc125c606a75ca33351fb4aa65200cbf9f89b4225958e4cc17850a272018c38d474a8271c44bbd9398cdedf75c9056a593d4db5e53b87e7285b775863044a8bef97186d58ab14ecadc9e0b403dfb9bf12c6d9acb8d0c322d071598c05f09339e953673c325710fbb117fcdcc00eaeda37541d2a530f3ceb42a4bdfee97ab997d40bd8fef4db411315ec10fb62bd8f74d303e0d973bd11dbbc3d8cf819ea2044e113b2a9bea8b03a13d92e7e132f56d0b9679df04142094698083c6f6718c22818384a98bbf281d7ca45c6ecbcc7809e9974e758bad640c46fb1bff4a65e09430d960a3ccabc07b6c6debb7d1aca52d6ac6e7018b66c74ffee09b79ae0af7f588017af519e95278a3790537d8ab26e2891e1e2290fdf4d4454393161b7a5bb3401ea453120181c10c5a9bcc80627ba99dc74d488b1da9ec0efbe1fafd5932ad4c74694219144c0f3105185c3fa10b6dc60eb62fe36ca45b5d01ce91e58c47a0ca79b4b31c065a322c49d856b4d584f92047f162e266f1702da7bce03801c6ef49d910c55d7b2aae13f66fc03d7a80c0e782cea0df7d4e15bc46207d983242dd96ffd7656cf330d78bb3fa8b9465dffaaf85b535036f6de0e56248780d21b6e07447b5a5f5f4d2ed837cf6d0df8d74bf9bf274cf7584587d008f01fdb97f51527d5e6cede17fcea91e9ebc095078b1fb7a20a40068ae30daa1ef896e4d9eaee22f664a86d41abe65a383139d2e2ed84507a290a01df25b75ea01ad494c3c47fd482c814e9c3a69c58b5527f5c10a0900b3542f455091ac7ff239751b5cad7bf39b045c94a4127d6e9e6165b9f885f16dff973ffba20e5a6bc9a3aae939ef66f139e86b269a5936d7906cc678f70598f730543de71c64fb2649b1540f86cda902406ada73373e148508fb95b44cd8587c831ea46f2905e9ad23cb7be60082133fca5919a43b80cc08f25a5170ab93de4409f48aa2f279355dee915ccaeaad996e8fd609885a847f18f265301488f81f6a55b61a6ad6f9c39717df4ce5688b26e1f04982640d29a599cbd18eb81992769e92bb5c0429b28d7a7ce75e4da7f27cf00cb54b4feae3b1e21834c77aa1430baa7899454e9af4bf17e6375a1a0eaa4169c89c5c1c6f460fd82a36706905b436218496a21cfbf046b0b0a754625bb19e49da2407ebe1211d18ddedf146b7f1dae6ba7205d7fb7b627c4f29eb03b4e08b896f7a9c49e4f476fdd4dedb838450d1f00f580afc249f3d7c2b2382e1e352c8d915d4a75ff8ae25f780d57dd472026736d99da35580d11a2380eaf6930d7f85a4e0ec50cd7375051ab23c17ab870bffd94e7088fd00dfec191ac0ec36fcf334a8bdbeb796a94cab51a7b6e801906fa6b9b68148ebff4bf49cc0bf5578165fd75933668b67d601a7d78d779f8a5fe95c0e64ceea51e15b4f51dffc4f26fa6c700d9e6a20b8f75a9a193e6772f2a387fd2c85c1ea5eaf58c4a74450bcd4ac68337ff23e4f4b437de23284ed0829977369ed6c3d5bc1a0b7b310672c2429d86716b38fe174838cba99554f6cb0b4eb0dbd187a7e24609a220bbef8675c3ee556d3fa5d0508d9f2a9e105ff62c709329d25933bf01aba4c407a610f722827bfcc4e1a2c809697368e54c8d1432953ebfc537c3d351a07e1952e2830f5e0ca81edf6024b262257780e3fb884f6a4ef190eed854c10e802cbcdd0debe5d25519afdfd39c1a997134647b77c85d139d34c95ea64fceba5d40ba472e502fbb67ecf4971f71480f4801a13d10d985663a2406ecc5a77e7c5b47dbfbecba3095da01c732916577e6325e2ad6431bc216ceacac8a07a02190d13222cb888aa8b225da03cf67cf29f5a44d31e71c70c746535ccbbd289361c9926351704fa01d1d260a4be556a26eea168fb46518ee1f5e44dbc5f05a96edbe59e461a35164cadba68a7680dc9cdb5ce1f544c1413f3cfe20d81e1015c93a25393dea1c1d74d497cc5b383f6fe2f881c89f05c2894978fdb3ddbe5fdd2a0ce9d92877d3f156025b575058a462d9035110b290eae0c16223ca8cc5cd4b084410e2dc2da7a8ee27ffa69cfa4885cffd86adcf742cbb5bd99d0a9a26cee0c81cca5bbb283b3e2a018c32d36156f0049a43bae7231abf3ca80d0387136804b84c7d68561343761f88ef96121d613bd36c8b5492972da6107cab4e4ac0c4c6796e07b73f5ceb67f02986869ee0f616e38c9bfb66fdd8e604f928cc2cd46e6acfe4b8b4990c7bb327661ec8b85a40515ffb1847f37dcfe9271a15c224a00bcca39114082c43a98217b311cdeaa2c6c94038f94dcf8e023637dbf905de0a484838bb8046d6828e35864a0948e65b561038ad2ed9711c0e446b4457304491d61533b8b49bd41a36c8fc0cba9b394e2a97db425522a4d20d27e8220da9072b292b0abc495ab3d34bda6636251220f905721b59d2af0d7a3e079e1a9793cf6f537b44d1a82a71d71a3cb37d5b19065f0870a9d2863dc4a074c9525c96caf2989919c3563ac2d439069dce9bb5b62166748cb71a71f5e83a0eccc58ad6e02700f5b5fde1edb7106fa5198ce2d1c4fd2a9360e112df3c1bbbd4b4c503c7bb4ffc8646e59de9dcb6ad2b2915c06015c1c4f3e0b2df2cba55d61c54398ea043cfa51fe8cfdc575f23ee6a8919bcf4168a5731714489c372320287c5452e82be7a75a967ead10a2c709b168cdeea01d308ad7118722e5fcd78bd9ffffdcd9e6614a483e9710140912be26cae61896a627b2ae878831dce444f393325e75b50966129a9c0859a9b3983472472f2c3c8981f8707c506669d3f9f75158b166556fd31300ecead409310992997b2dc36e7f3cb0ede3574c699472f346164b4b13139d8653c327d93abafb59792cbccaeb3e72296fb731d1567ed52be19c7fff265417befb27dd1c7fd4d2290e3fdf3c53073da7085c5b2848ebd2c3c2b00f229ed6bebcb0a5c7dab6e9a6457f9ffb551369a1da6ec8be02858d100d06c67d123c3e82929c9ac2c304883cd984d3cdd2825b26030e0f3555a30e9f750947b05c40b3fd74e1daadf4b4103ce1d6977eeccb4209e708b8df386cd702948811a8607b72da8771741fc2be2f8daf471c7651b9656c055f5e3e58948330ffacb93c9774b8f0287f68b099725fa87f9bc4bd8f9283b3927f2e9f97ee76bc8857d5b4eebc8a6a267d0408187ad74c12eaa9bd620ad3d588740477cdb19042da76e03f633662b84a12411ed28616d6266fc5d706f4d6a8802fc1774d2b55082c2bf7aedda57bb134cc1052f67701bc19e9880fd2404853b8062cdd6a4760ac8609782178b5800e32eecca965bae00944679de7e4e43f3caf33cb42e04e8323bd8214c5c4c1c2832b7c0b0e11beb2c0b066d3a0287d9e44f9eb680c69d2531bddc6512c6b3094cb256e5ded5421241599c6a205ed68908696baffebdbf875dbea3d12f7bb588041d25b7702bdd63841d547197dae61c78f19c57ca2129e538cff749aa55055f65fcdf3dc5bf3ce86c217983e550bd8ed6e634f83b15cd0a57fd0fbe01795bb7a2b0e38fddbb03aa5807de125b464fbfd1541480436ee0552531602da7697486c1e1dc70b248bc6c44e69956d08c6196e2556d1aa72ebc6db0a6958ce4b8c106ae9331c281b1100c3897a635b13eb57377421b11c86ccda60f90d629afe5542235b64a4f0f0d69b51033601274b8fe7e230ec16360902fa2de34f5ab2e90af871b590726b947dab39ecacda4edfa10333fbf2d2addc548093eeb24cd6d2d68c855d3011b8847c4eb48c1a0d958d7f627e4bc381b986264ff3e7d849d5c4a4b4275d474c72daa2c5aebb4b8a28781b14fa6aa09b0989983af63548abc43ba9dce46a2bb4884fa69acb3d11c3326d37ab8c095dcd3921ff026dfbcb6f489aa5cfc652504ded88656d0d9756787acce2e7b56133c70836489", 0x1000) setsockopt$inet_sctp_SCTP_AUTO_ASCONF(r0, 0x84, 0x1e, &(0x7f0000001040), 0x4) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000001080)=0x0) r2 = syz_open_procfs(r1, &(0x7f00000010c0)='net/sockstat\x00') getsockopt$inet6_dccp_int(r2, 0x21, 0x4, &(0x7f0000001100), &(0x7f0000001140)=0x4) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000001180)='/dev/zero\x00', 0x200002, 0x0) ioctl$BINDER_SET_MAX_THREADS(r2, 0x40046205, 0x1) process_vm_readv(r1, &(0x7f00000016c0)=[{&(0x7f00000011c0)=""/225, 0xe1}, {&(0x7f00000012c0)=""/221, 0xdd}, {&(0x7f00000013c0)=""/252, 0xfc}, {&(0x7f00000014c0)=""/214, 0xd6}, {&(0x7f00000015c0)=""/27, 0x1b}, {&(0x7f0000001600)}, {&(0x7f0000001640)=""/124, 0x7c}], 0x7, &(0x7f0000002a80)=[{&(0x7f0000001740)=""/21, 0x15}, {&(0x7f0000001780)=""/131, 0x83}, {&(0x7f0000001840)=""/7, 0x7}, {&(0x7f0000001880)=""/22, 0x16}, {&(0x7f00000018c0)=""/4096, 0x1000}, {&(0x7f00000028c0)=""/146, 0x92}, {&(0x7f0000002980)=""/26, 0x1a}, {&(0x7f00000029c0)=""/103, 0x67}, {&(0x7f0000002a40)=""/58, 0x3a}], 0x9, 0x0) ioctl$TIOCGWINSZ(r2, 0x5413, &(0x7f0000002b40)) bind$pptp(r2, &(0x7f0000002b80)={0x18, 0x2, {0x3, @loopback=0x7f000001}}, 0x1e) getsockname$inet6(r0, &(0x7f0000002bc0)={0x0, 0x0, 0x0, @ipv4={[], [], @multicast1}}, &(0x7f0000002c00)=0x1c) membarrier(0x50, 0x0) r4 = syz_open_procfs(r1, &(0x7f0000002c40)='net/igmp\x00') socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_inet_tcp_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000002c80)) ioctl$sock_inet_SIOCGIFDSTADDR(r4, 0x8917, &(0x7f0000002cc0)={'lo\x00', {0x2, 0x4e24, @multicast2=0xe0000002}}) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r3, 0x84, 0x18, &(0x7f0000002d00)={0x0, 0x1}, &(0x7f0000002d40)=0x8) setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r3, 0x84, 0x6, &(0x7f0000002d80)={r5, @in={{0x2, 0x4e21, @loopback=0x7f000001}}}, 0x84) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000002e80)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000002e40)={0xffffffff}, 0x0, 0x1000}}, 0x20) write$RDMA_USER_CM_CMD_LISTEN(r0, &(0x7f0000002ec0)={0x7, 0x8, 0xfa00, {r6, 0x10001}}, 0x10) setsockopt$inet_sctp_SCTP_ADD_STREAMS(r3, 0x84, 0x79, &(0x7f0000002f00)=0x1, 0x4) connect$pptp(r4, &(0x7f0000002f40)={0x18, 0x2, {0x0, @remote={0xac, 0x14, 0x14, 0xbb}}}, 0x1e) getsockopt$kcm_KCM_RECV_DISABLE(r3, 0x119, 0x1, &(0x7f0000002f80), 0x4) process_vm_readv(r1, &(0x7f0000003040)=[{&(0x7f0000002fc0)=""/13, 0xd}, {&(0x7f0000003000)=""/40, 0x28}], 0x2, &(0x7f0000004300)=[{&(0x7f0000003080)=""/211, 0xd3}, {&(0x7f0000003180)=""/127, 0x7f}, {&(0x7f0000003200)=""/111, 0x6f}, {&(0x7f0000003280)=""/4096, 0x1000}, {&(0x7f0000004280)=""/119, 0x77}], 0x5, 0x0) r7 = openat$urandom(0xffffffffffffff9c, &(0x7f0000004380)='/dev/urandom\x00', 0xa00, 0x0) setrlimit(0xc, &(0x7f00000043c0)={0x4, 0xffffffff}) ioctl$KVM_GET_REGS(r7, 0x8090ae81, &(0x7f0000004400)) getsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f00000044c0)={{{@in6=@dev, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in=@multicast1}}, &(0x7f00000045c0)=0xe8) setfsuid(r8) 22:56:33 executing program 4: r0 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x2001) fcntl$setpipe(r0, 0x407, 0x1) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000002180)='/dev/full\x00', 0x101b00, 0x0) sendmsg$unix(r1, &(0x7f0000002900)={&(0x7f00000021c0)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000002780)=[{&(0x7f0000002240)="1348c42271c0850de1d73c5dfb04978d8a6efd8ad4a893b652ba65eb8dc980a3b21d7961fcad30ab2d12f11f2b98907da7c23e662f0dba87e37a1bf8484f592d757f88018155f833fba728b32abea91d9a17629ea7e3b240ef78f5e2b6172bacde99d62e98151ee43775ab41e4f2e9e39e5dfe4fc918b06fa4c657cbab690ddea385ba1a6c77c7695bec5ef20a1e6550777cbc9185ea2c920ad59287a931adc32b0a413550ae5137e4a581d5e89b6dbe913e7ba83e9b342b9fff2c0b72cb9f5e62425e0cc4fba625fde5eb50a68f9a5a2e79b81239f4fb39df75592efcbe7837bd688a69424f65", 0xe7}, {&(0x7f0000002340)="0f5586c1098e7e098db331dc0896f36237313ee2b81b594a22888f8d", 0x1c}, {&(0x7f0000002380)="a14d", 0x2}, {&(0x7f00000023c0)="336163f467b740fd6fb420eece2d2068e2196d75cac2b9e6194219426daedc774f392a286711df98b55cba0dd8fe51c28ae8abae31fd249006", 0x39}, {&(0x7f0000002400)="ffadba4160d2b83ee06c401a91464fe2c40f3fc011d493595ca441fa8badaffb3117b1efd112092ff3604b3388285bbecc97deefcc8acfe561181b945113414890e84ecb35b16a647f1476bb1a75964233b495f1", 0x54}, {&(0x7f0000002480)="6debd1fe43e88e178f964dc9b008c72a6c7162ab138b7d5a46cdd98977e49e855158265f684f3500ed6e4e990289b37cfab3fbda67c9f208d2311b509c33b4883c8aaf4485a5ce7bd7e54ec2df533b5430d9134dff223d35f5ed90ccc1706287ec8ae9dec0ba6423457aa4dee85cc6cf48284b94b4eabeca5461cbf940b9827fa5a3c31c340e94556ba3afda62a9f67973d35ef95246d93550a0dbf5bd030524687810083a326562f5f1d0c2c618dd3bab756dd3609572d8354ce26431e65ddefb7126f3b5053c0207d5f0a6e67b1d0cd82be7e6133e855f5543b183d116db5fdc", 0xe1}, {&(0x7f0000002580)="a57dc59484d58c6af9aacf0ff723606308da59fa8121fccf746269c47d00c391f494febc9ccb8f762e5cbda55f9f16096b16a68735fb41d73d41a5ea7e41981d4145e9ba156f64b211ff232682773b3cc4bc669eff199edef3605a555fe508919e5f21e35e809a9a763cfa26bfa7a1db27c0423654650377589872dbe585de9d3f5841588de34625757143454a225a497a1c3b62a3bf79a644dd1568389ae886aed612f682c6fa87c9df2b09290f40fdf296ed20ce4966dc8f4fbcd7f237eb0b1c62dcb01b84b641f805128ac62df7f71995ee", 0xd3}, {&(0x7f0000002680)="6b8ce432f9f857bff4c7cfb7f5e92500e037ed2f2d6a1abe42efd8dd34b274f123f5a41dc64f5e37794ef6a9a0f957c77998b05f604865158a04f1e485167af13e", 0x41}, {&(0x7f0000002700)="694b6d5af8a3d291612d6b5f93d520aa8ab6c23c7cbce030d20f25450c7f909eb5ee6d9239b8fcba4a66a15437302c58882d13b7f4ad35f86974cd1215d43cfc9001cbaef668d85457590d7ae048aa862cbf950bbfc3651c07597a977aa0b34f2f6870dc", 0x64}], 0x9, &(0x7f0000002840)=[@rights={0x30, 0x1, 0x1, [r0, r0, r0, r0, r0, r0, r0, r0]}, @rights={0x20, 0x1, 0x1, [r0, r0, r0]}, @rights={0x38, 0x1, 0x1, [r0, r0, r0, r0, r0, r0, r0, r0, r0, r0]}], 0x88, 0x8800}, 0x800) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000002940)) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000002980)='/dev/snapshot\x00', 0x800, 0x0) renameat2(r2, &(0x7f00000029c0)='./file0\x00', r2, &(0x7f0000002a00)='./file1\x00', 0x2) ioctl$PERF_EVENT_IOC_ID(r2, 0x80082407, &(0x7f0000002a40)) r3 = getpgid(0xffffffffffffffff) r4 = getpgrp(r3) r5 = syz_genetlink_get_family_id$team(&(0x7f0000002ac0)='team\x00') sendmsg$TEAM_CMD_NOOP(r1, &(0x7f0000002b80)={&(0x7f0000002a80)={0x10, 0x0, 0x0, 0x1880}, 0xc, &(0x7f0000002b40)={&(0x7f0000002b00)={0x14, r5, 0x4, 0x8, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x1) timer_create(0x5, &(0x7f0000002d40)={0x0, 0x13, 0x4, @thr={&(0x7f0000002bc0)="7113a138eee2d4e5d84b284ce26f3685310b7a6a659fe3cd88eb01aa7ae1b0299e0873937f80da762f0951e8a13e36a76010c3d156cbe12fb0548e9bdd171ee89684130b82555ab0061617620917e1acec0dcf7ca9b5e3b6c597845406c2f00ecc4bdedfe07429ce9a85eb0b040dcfcfc0819140d3df0e7519695155edf001730323f1776b7d35220f5b279b624e58871e23535be78fe545c6cdb8cffc2bf0c12ebd7096e6698a924b972df6ec2f8af346aeb3bcd19b91f2f3359cd122625449e3f7f862896eee339697377b73e8751059f2d9f9ff60f7a2fb0c97", &(0x7f0000002cc0)="71621fc39faf00bd16f4aa25a096b25ea94d947fed2b99c685b3a11b7a2be3fdc7419f24d9e89dce3dc89bdb1ca023cccce7b2468bd2e327c6c009984d3c4b41868dfcd58f42"}}, &(0x7f0000002d80)=0x0) timer_delete(r6) r7 = open$dir(&(0x7f0000002dc0)='./file0\x00', 0x800, 0x90) fadvise64(r7, 0x0, 0xff, 0x3) syz_genetlink_get_family_id$team(&(0x7f0000002e00)='team\x00') fchdir(r1) socket$nl_netfilter(0x10, 0x3, 0xc) getsockopt$inet_sctp6_SCTP_GET_ASSOC_NUMBER(r2, 0x84, 0x1c, &(0x7f0000002e40), &(0x7f0000002e80)=0x4) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000002ec0)={0x10001, 0xc5d, 0xff, {0x0, 0x1c9c380}, 0x5, 0xb}) migrate_pages(r4, 0x9, &(0x7f0000002f40)=0x8, &(0x7f0000002f80)=0xdc4f800000000000) getsockopt$inet_sctp6_SCTP_GET_ASSOC_NUMBER(r2, 0x84, 0x1c, &(0x7f0000002fc0), &(0x7f0000003000)=0x4) r8 = socket$can_bcm(0x1d, 0x2, 0x2) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r2, 0x84, 0x1a, &(0x7f00000030c0)={0x0, 0x2d, "45aad4a87c4cf620334a37459fc6e0acb6fc19647db09c3d879b2d23e8f36895cf5eeb79d0dd2ac06a50909501"}, &(0x7f0000003100)=0x35) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f0000003140)={r9, 0x4}, &(0x7f0000003180)=0x8) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f00000031c0)={0x0, 0x0}, &(0x7f0000003200)=0xc) setuid(r10) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f0000003240)={0x2, 0x10001, 0x7, {0x0, 0x1c9c380}, 0x2, 0x65}) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000003300)=@filter={'filter\x00', 0xe, 0x4, 0x558, 0xffffffff, 0xf8, 0xf8, 0x0, 0xffffffff, 0xffffffff, 0x488, 0x488, 0x488, 0xffffffff, 0x4, &(0x7f00000032c0), {[{{@uncond, 0x0, 0xc8, 0xf8}, @common=@inet=@SET2={0x30, 'SET\x00', 0x2, {{0x7, 0x2, 0xdbb5}, {0x4, 0x9, 0x1f}, 0x1, 0x81}}}, {{@uncond, 0x0, 0xf0, 0x118, 0x0, {}, [@common=@eui64={0x28, 'eui64\x00'}]}, @REJECT={0x28, 'REJECT\x00', 0x0, {0xe}}}, {{@ipv6={@mcast2={0xff, 0x2, [], 0x1}, @dev={0xfe, 0x80, [], 0x18}, [0xffffff00, 0xffffff00, 0xff0000ff, 0xffffffff], [0xffffff00, 0xff, 0xff, 0xffffff00], 'bridge_slave_1\x00', 'veth1_to_bridge\x00', {0xff}, {0xff}, 0x2b, 0xffff, 0x4, 0x4}, 0x0, 0x230, 0x278, 0x0, {}, [@common=@rt={0x138, 'rt\x00', 0x0, {0x7f, 0x20, 0x7fff, 0xfffffffffffffdb2, 0x30, 0x2, [@mcast1={0xff, 0x1, [], 0x1}, @ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}, @dev={0xfe, 0x80, [], 0x1f}, @remote={0xfe, 0x80, [], 0xbb}, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}, @local={0xfe, 0x80, [], 0xaa}, @dev={0xfe, 0x80, [], 0x11}, @mcast1={0xff, 0x1, [], 0x1}, @dev={0xfe, 0x80, [], 0x16}, @ipv4={[], [0xff, 0xff], @multicast2=0xe0000002}, @empty, @local={0xfe, 0x80, [], 0xaa}, @mcast1={0xff, 0x1, [], 0x1}, @mcast1={0xff, 0x1, [], 0x1}, @empty, @ipv4={[], [0xff, 0xff], @multicast2=0xe0000002}], 0x6}}, @common=@frag={0x30, 'frag\x00', 0x0, {0x1, 0x7, 0x0, 0xe1f77b4de788cbec, 0x3}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6, 'veth1_to_team\x00', 0x3eb354e5}}}], {{[], 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x0, 0xfffffffffffffffe}}}}, 0x5b8) 22:56:33 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0xffffff8d], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) [ 843.560365] binder: 4321:4362 BC_FREE_BUFFER u0000000000000000 no match [ 843.597474] binder: 4321:4362 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 22:56:33 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000040)="295ee1311f16f477671070") mkdir(&(0x7f000000dff6)='./control\x00', 0x0) r1 = open(&(0x7f0000039000)='./control\x00', 0x0, 0x0) mkdirat(r1, &(0x7f0000000080)='./control/file0\x00', 0x80) faccessat(r1, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0) [ 843.604750] binder: 4321:4362 got reply transaction with no transaction stack [ 843.612131] binder: 4321:4362 transaction failed 29201/-71, size 0-8 line 2759 [ 843.678054] binder: undelivered TRANSACTION_ERROR: 29201 [ 843.683690] binder: undelivered TRANSACTION_ERROR: 29201 22:56:34 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) read(r1, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(r0, 0x540c, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000016) 22:56:34 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000000)=r0, 0x4) 22:56:34 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x0, 0x7000000]}) 22:56:34 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) 22:56:34 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x2b], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:34 executing program 4: r0 = socket$inet(0x10, 0x3, 0xc) r1 = socket$inet6(0xa, 0x1, 0x0) r2 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000040)='syz1\x00', 0x200002, 0x0) openat$cgroup_procs(r2, &(0x7f0000000080)='tasks\x00', 0x2, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000100)="240000000b0607031dfffd946fa2830020200a0009000100021d85680c1baba20400ff7e28000000110affffba16a0aa1c0009b356da5a80d18bec4c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) 22:56:34 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000006a80)={'bpq0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000006ac0)={'vcan0\x00', r3}) socket$unix(0x1, 0x1, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/audio\x00', 0x4c0000, 0x0) accept$packet(0xffffffffffffff9c, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f00000000c0)=0x14) bind$xdp(r4, &(0x7f0000000100)={0x2c, 0x0, r5, 0x1}, 0x10) setsockopt$sock_int(r1, 0x1, 0x2f, &(0x7f0000000000)=0xbb, 0x4) sendto$inet(r1, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x4004e23, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) connect(r1, &(0x7f00000012c0)=@nl=@unspec, 0x80) 22:56:34 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback={0x0, 0x1}}, 0x1c) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000240)='/proc/sys/net/ipv4/vs/cache_bypass\x00', 0x2, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r1, 0xc0a85352, &(0x7f0000000280)={{0x7f}, 'port0\x00', 0xa, 0x20000, 0xfffffffffffffffb, 0xa42, 0x2, 0x8, 0x3, 0x0, 0x1, 0x800}) listen(r0, 0xffffffffffffff7f) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) r3 = accept4(r0, &(0x7f00000003c0)=@in={0x0, 0x0, @multicast1}, &(0x7f0000000380)=0x3e, 0x0) sendto$inet6(r2, &(0x7f0000e33fe0)='X', 0x1, 0x0, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000040)={0x0, @in={{0x2}}, 0x0, 0x6, 0x0, 0x0, 0x100000000002d}, 0x98) clock_gettime(0x0, &(0x7f00000001c0)={0x0, 0x0}) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r1, 0x84, 0x6, &(0x7f0000000440)={0x0, @in={{0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0xe}}}}, &(0x7f0000000340)=0x84) setsockopt$inet_sctp6_SCTP_CONTEXT(r3, 0x84, 0x11, &(0x7f0000000500)={r6, 0x6}, 0x8) utime(&(0x7f0000000540)='./file0\x00', &(0x7f0000000580)={0xd0, 0xff}) select(0x40, &(0x7f0000000100)={0x4, 0x8000, 0x4, 0x6, 0x0, 0x1, 0x7, 0x1ff}, &(0x7f0000000140)={0x5, 0x2, 0x1, 0x20, 0xfffffffffffffff9, 0x7, 0x40, 0x4}, &(0x7f0000000180)={0x0, 0xf800000000, 0x0, 0x0, 0x6, 0x81, 0x6, 0x3}, &(0x7f0000000200)={r4, r5/1000+10000}) [ 844.437916] netlink: 'syz-executor4': attribute type 1 has an invalid length. [ 844.452626] binder: 4389:4392 BC_FREE_BUFFER u0000000000000000 no match [ 844.470362] binder: 4389:4392 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 844.473437] netlink: 20 bytes leftover after parsing attributes in process `syz-executor4'. 22:56:34 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x300000000000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:34 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000000)=r0, 0x4) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000940)='/dev/null\x00', 0x0, 0x0) getsockopt$IPT_SO_GET_ENTRIES(r2, 0x0, 0x41, &(0x7f0000000040)=ANY=[@ANYBLOB="66696c7465720000000000000000000000000000000000b8fe00000000000000ce0000004fa519e89f3e25319db9f3a25c7b1481b25fde3292ad955805e073b0229464133d9fb4b1cb1ec8fbf69c5963bf8301ff664e4ceeb519569625635c8cf488f49cc9ac7d5433cbe61768c4061463fdd753040b86302312cdb172807f32e2b9992d00474a2dc44480b80469ebee1d44edd570b7c29b86edc9c7e3971167c4bb54513e6b6ab00f786618d790decb5206742fa8265aff51fefbe0b079a56645d09edf8c03bd3e7daa77cefa71a49343fd50344eec36dbbf5de8e2a5533973950bde98111deaea7dd537d2c4ed273c666530356370e3f6b41177fb9e8870ca3c827208478fdffad70c207930f5bc7b3ff49ccc107f9360154d80be9c219c989ef11078feaa26c506fb149a9ac87dea61470c"], &(0x7f0000000a80)=0xf2) ioctl$SG_GET_LOW_DMA(r2, 0x227a, &(0x7f0000000180)) 22:56:34 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x0, 0x4]}) [ 844.477495] binder: 4389:4392 got reply transaction with no transaction stack [ 844.493397] binder: 4389:4392 transaction failed 29201/-71, size 0-8 line 2759 22:56:34 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x2c000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) [ 844.542486] binder: 4389:4413 BC_FREE_BUFFER u0000000000000000 no match 22:56:34 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000001480)="2f65786500000000000409004bddd9de91be10eebf000ee9a90f798058439ed554fa07424adee901d2da75c01f0200f58d26d7a071fb35331ce39c5aeeff5083cf07dd46455c914d4aff1e7cf7ed57c0c2056f5ca933f03cbf82bd13534737339245d31b0041be6281d7e1b4b7099114c571872298dd7f2120e2b6fa2a2e2a2c9c6e0034750b7961fa2c1584c0b5a500ae0ac39bc76a78d9158266759f766a3e8c84c09cf35a214a200421dcbc4cb6ee55476d8ead8882947ffa1fb4c050727beb12c57e06ff59") ioctl$fiemap(r0, 0xc020660b, &(0x7f00000000c0)=ANY=[@ANYBLOB="00000000000000000400000002000000000000000000000001000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000008000"]) ioctl$KDSETKEYCODE(r0, 0x4b4d, &(0x7f0000000040)={0x1, 0x401}) memfd_create(&(0x7f0000000000)='*lo\x00', 0x2) [ 844.588161] binder: 4389:4413 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 844.595287] binder: 4389:4413 got reply transaction with no transaction stack [ 844.602632] binder: 4389:4413 transaction failed 29201/-71, size 0-8 line 2759 22:56:34 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x0, 0x30000000]}) 22:56:34 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="180000020000070000000000000000009500200000000000817369b1e60a7e8466bcca1c11838bec7c61625ddcedd46ae1bd6ec907735fc43fdf9764fb73bd65de27d7564a3e3689e0dee197bf4a4f5c6180273206014aefea725df15905f632784a8c431b2a66c7bdebef6e89f21d392d8b9546ea1001bc70cbf256b567345412a6f6442ab907b7227cb00b498d49756c364de759d74369e8e4776c876f5ef9112cdd577a7d7ff2c0c72b88286eb5dfa2c0043cf06a032e42a8c80532ca27fee2a8bf"], &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000000)=r0, 0x4) 22:56:34 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x2b00], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) [ 844.695597] binder: undelivered TRANSACTION_ERROR: 29201 [ 844.701228] binder: undelivered TRANSACTION_ERROR: 29201 22:56:35 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) read(r1, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(r0, 0x5429, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000016) 22:56:35 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a000000, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) 22:56:35 executing program 4: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x400100, 0x0) setsockopt$inet_sctp_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000100)={0x0, 0x7, 0xfa42, 0x7fffffff, 0x4, 0x6, 0x9, 0x8, 0x6, 0x3d1, 0xfffffffffffffc01}, 0xb) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000006ffc)=0x1, 0x1f5) sendto$inet6(r1, &(0x7f0000000080)="040300000309c14609005375c52cf7c21975e697b02f5c566b2b2ff0dac8897c6b11876d886b6621d8d207ccf73f257e55e86eb29406136fcfffffffffbe62159403c7a6cc6d5ad15dddb43a", 0x4c, 0x0, &(0x7f0000000040)={0xa, 0x800, 0x5, @mcast1={0xff, 0x1, [], 0x1}}, 0x1c) 22:56:35 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x0, 0xffff0000]}) 22:56:35 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="180000000000000000000000000000009500f5000000000000"], &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000000)=r0, 0x4) 22:56:35 executing program 6: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/ppp\x00', 0x80043, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000100)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000019fe0)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) ioctl$SIOCSIFMTU(0xffffffffffffffff, 0x8922, &(0x7f0000000340)={'ip6gretap0\x00', 0xffffffffffffb431}) r2 = memfd_create(&(0x7f0000000080)='-.[vmnet0^\x00', 0x0) epoll_pwait(r1, &(0x7f0000000040)=[{}, {}, {}], 0x3, 0x80000000, &(0x7f00000000c0)={0x16}, 0x8) pwritev(r2, &(0x7f0000000000)=[{&(0x7f0000012000)="ca", 0x1}], 0x1, 0x0) lseek(r2, 0xfffffffffffffffe, 0x4) close(r0) 22:56:35 executing program 7: clone(0x200, &(0x7f0000b6b000), &(0x7f0000744000), &(0x7f0000fef000), &(0x7f0000000140)) mknod(&(0x7f0000000100)='./file0\x00', 0x1041, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000180)='/dev/rfkill\x00', 0x28043, 0x0) getsockopt$inet_sctp_SCTP_CONTEXT(0xffffffffffffff9c, 0x84, 0x11, &(0x7f0000000200)={0x0, 0x4}, &(0x7f0000000240)=0x8) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000280)={r1, @in6={{0xa, 0x4e22, 0x6, @local={0xfe, 0x80, [], 0xaa}, 0x4}}}, &(0x7f0000000340)=0x84) execve(&(0x7f0000000540)='./file0\x00', &(0x7f0000578fe8), &(0x7f0000000740)) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0x2) execveat(0xffffffffffffffff, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000400), &(0x7f00000004c0), 0x0) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000380)={r2, @in={{0x2, 0x4e20}}, 0x9, 0x0, 0x0, 0x200, 0x8}, &(0x7f0000000440)=0x98) r3 = gettid() open$dir(&(0x7f0000000140)='./file0\x00', 0x27e, 0x0) ptrace$setregs(0xf, r3, 0x3, &(0x7f0000000040)="3135a07c9d03ff98a368cad05350f4b2039b24e44e4821affe0778a084d1d7f7008d16dfa3cd0274c75056e143d53be4babf76b81ac0af3b6ce63f92454b9054c0fc91598004668834f33eb17611cab4c058441677817a6b1f2b7ba4ee1966889e3007") 22:56:35 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x300], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) [ 845.513945] binder: 4456:4466 BC_FREE_BUFFER u0000000000000000 no match [ 845.544577] binder: 4456:4466 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 845.551687] binder: 4456:4466 got reply transaction with no transaction stack 22:56:35 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x2], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:35 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x2, 0x0) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000000)=r0, 0x4) [ 845.559088] binder: 4456:4466 transaction failed 29201/-71, size 0-8 line 2759 22:56:35 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f00000000c0)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="180000002d001343000000833c00001d0326000004000000e7d19239b04f9d46a83b32c6b654bfadff6ebab1f6e98fede6003b6326e5b4fb7de323ad6a91879806b11e2630f6b7b76a4e72462583d4b86eeda06563bd7b249b01ff15eec46d44e5501c92a4d1710b372be557746ee9654e0c00e41c110c1a229d6aaa"], 0x1}, 0x1}, 0x0) r1 = syz_open_dev$dspn(&(0x7f0000000080)='/dev/dsp#\x00', 0x0, 0x100) setsockopt$inet_tcp_TLS_TX(r1, 0x6, 0x1, &(0x7f0000000180)={0x303, 0x33}, 0x4) gettid() 22:56:35 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x0, 0xffffffffffffffff]}) [ 845.676454] binder: 4456:4486 BC_FREE_BUFFER u0000000000000000 no match [ 845.711571] binder: 4456:4486 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 845.718706] binder: 4456:4486 got reply transaction with no transaction stack 22:56:35 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000000000000000000000000000950000000000000014c6242e74d3d2b1b739f3284fc45e9c0ee06404dafbb3c49e30a02343e9d43258"], &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000000)=r0, 0x4) 22:56:35 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x2f], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:36 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000000)='/dev/urandom\x00', 0x141282, 0x0) accept$inet6(r1, &(0x7f0000000180)={0x0, 0x0, 0x0, @dev}, &(0x7f00000004c0)=0x1c) ioctl$sock_bt_hidp_HIDPGETCONNINFO(r1, 0x800448d3, &(0x7f0000000040)={{0x1, 0x7, 0xffffffffffff73ef, 0x6, 0x1aba, 0x1}, 0x3, 0x1, 0x40, 0x0, 0x5, "dead49a8bb6f65a7bcf6968a320336c26f89dc4fe2464df9a3eb336c2b43ce4a30deadc1c8c1f70d6883f6d687ff0c74bac790dfb8a753d3ad6b6b05e7868483006744177d80a04e8b432af02d34dfd8b5531bdb09aa3e659a2133bcf956eb5aeb447ded1da6f9edc245c5b8a4f5adc13ea1c9af5a34b0e75732dc95565e19c9"}) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f0000000100)={0x0, 0x88, &(0x7f0000000400)=[@in6={0xa, 0x4e20, 0x9, @empty, 0x3}, @in={0x2, 0x4e20, @broadcast=0xffffffff}, @in={0x2, 0x4e22, @broadcast=0xffffffff}, @in6={0xa, 0x4e21, 0x9, @remote={0xfe, 0x80, [], 0xbb}, 0x10001}, @in={0x2, 0x4e23, @rand_addr=0x1000}, @in={0x2, 0x4e21, @loopback=0x7f000001}, @in={0x2, 0x4e20, @multicast2=0xe0000002}]}, &(0x7f0000000140)=0x10) ioctl$sock_bt_hidp_HIDPCONNADD(r1, 0x400448c8, &(0x7f0000000300)={r0, r0, 0x5de5, 0x5, &(0x7f0000000200)="e33d20763e89ca29a3e8c955d3ee1f933eb60746443d99647a279b6b52c53cf0c0cd626be5b485bf2566b358dbe79d75be06f37e5726ad1e0d214daac919e47f9723ca9f69c02cb716cdcaf68f2bcbc19ef0be702e5104bf9c643711062c376bc5a09019e55fa92432b376c7907ea20517ccacbe51df3a167ee09791043384f93e5ad708c5ef06eb1c68dd48400dd0135175847394dacabf3c231059525a22789a89e510c8e925fce3cbd33ed709157d14455706d110fc9720bb059586c2eb1092e48247584b5ae54aba39fc9477cae92aefa621c157183d697d87fa236ccf0efee8e0914557f5bab7a2ed1e4b1e60466e8c4d", 0x378400, 0x7f, 0x10000, 0x1, 0x3f, 0xfffffffffffffffe, 0x80, "3ada19187d5a7e7acfb7a12278f9bc07a96d43c8719b6a9a4061d883ded9a5358433ca178b6af49b65954b4699a105bfae13f5edba04208cf5e46bf5d2d87a2accee9042c1720f3f9ff47366e216e2ed9d099a01d2ffc4da0090bfa19802d8cd3d3771d60e31b9a731ce3140915ae602fd681c9095bea2d477b3f78d7a2e2b2355074875a4a902a23c919d5307797b91924b7c70fe6fa46a60ac530e4fa110c38a274a8b2d57a380896c7695ef"}) setsockopt$inet_sctp_SCTP_PR_SUPPORTED(r1, 0x84, 0x71, &(0x7f00000001c0)={r2, 0x3}, 0x8) r3 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r3, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2=0xe0000002}, 0x4}}, 0x2e) ioctl$sock_bt(r3, 0x0, &(0x7f0000000000)) [ 845.726090] binder: 4456:4486 transaction failed 29201/-71, size 0-8 line 2759 22:56:36 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=ANY=[@ANYBLOB="180000000000000000000008050000009500000000000000"], &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f0000000340)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) socketpair(0x9, 0x3, 0x100, &(0x7f0000000040)={0xffffffffffffffff}) setsockopt$RDS_CANCEL_SENT_TO(r2, 0x114, 0x1, &(0x7f0000000080)={0x2, 0x4e24, @broadcast=0xffffffff}, 0x10) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000000)=r0, 0x4) [ 845.912778] binder: undelivered TRANSACTION_ERROR: 29201 [ 845.918391] binder: undelivered TRANSACTION_ERROR: 29201 22:56:36 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) read(r1, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(r0, 0x540d, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000016) 22:56:36 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x0, 0x30]}) 22:56:36 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x4400000000000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:36 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0xa82, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000001580)=0x19) fremovexattr(r0, &(0x7f0000000040)=@known='system.posix_acl_default\x00') r1 = syz_open_dev$vcsn(&(0x7f0000000080)='/dev/vcs#\x00', 0x400, 0x101000) ioctl$SIOCGIFMTU(r1, 0x8921, &(0x7f00000000c0)) writev(r0, &(0x7f0000001d80)=[{&(0x7f0000001c00)=';', 0x1}], 0x1) 22:56:36 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x2000, 0x0) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(0xffffffffffffff9c, 0x84, 0x6d, &(0x7f0000000080)={0x0, 0xc3, "da3188a4de9a0ead02e7919a3b1ef9cbe40f1920a8c138c06cedbdf75edde85f6fe748c76b322e98d37ca9aeb98257f88b2d9c76bba4ac52eb221336be185fd714505b32db339a47cf03154c2d9345b33ce45fdcc017dca4c1e524a5365e08e61d5e0240560687aac2757610cbf3947a60042e9bfeaa1d63f6c005b8d20717bdf737d8f6354aa26b87cf6bbd53cda9bed8b2231e0c409d91aaac75846e5bc9111eee3d44e081732469ca2369045bd3b751526477a99e097361b453298c0f375833d3fe"}, &(0x7f0000000180)=0xcb) setsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r1, 0x84, 0x18, &(0x7f00000001c0)={r2, 0xcd07}, 0x8) r3 = socket$vsock_dgram(0x28, 0x2, 0x0) ioctl$SNDRV_TIMER_IOCTL_PAUSE(r1, 0x54a3) setsockopt$sock_attach_bpf(r3, 0x1, 0x32, &(0x7f0000000000)=r0, 0x4) 22:56:36 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) 22:56:36 executing program 6: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/ppp\x00', 0x80043, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000100)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000019fe0)={{&(0x7f0000012000/0x2000)=nil, 0x2000}, 0x1}) ioctl$SIOCSIFMTU(0xffffffffffffffff, 0x8922, &(0x7f0000000340)={'ip6gretap0\x00', 0xffffffffffffb431}) r2 = memfd_create(&(0x7f0000000080)='-.[vmnet0^\x00', 0x0) epoll_pwait(r1, &(0x7f0000000040)=[{}, {}, {}], 0x3, 0x80000000, &(0x7f00000000c0)={0x16}, 0x8) pwritev(r2, &(0x7f0000000000)=[{&(0x7f0000012000)="ca", 0x1}], 0x1, 0x0) lseek(r2, 0xfffffffffffffffe, 0x4) close(r0) 22:56:36 executing program 7: clone(0x200, &(0x7f0000b6b000), &(0x7f0000744000), &(0x7f0000fef000), &(0x7f0000000140)) mknod(&(0x7f0000000100)='./file0\x00', 0x1041, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000180)='/dev/rfkill\x00', 0x28043, 0x0) getsockopt$inet_sctp_SCTP_CONTEXT(0xffffffffffffff9c, 0x84, 0x11, &(0x7f0000000200)={0x0, 0x4}, &(0x7f0000000240)=0x8) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000280)={r1, @in6={{0xa, 0x4e22, 0x6, @local={0xfe, 0x80, [], 0xaa}, 0x4}}}, &(0x7f0000000340)=0x84) execve(&(0x7f0000000540)='./file0\x00', &(0x7f0000578fe8), &(0x7f0000000740)) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0x2) execveat(0xffffffffffffffff, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000400), &(0x7f00000004c0), 0x0) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000380)={r2, @in={{0x2, 0x4e20}}, 0x9, 0x0, 0x0, 0x200, 0x8}, &(0x7f0000000440)=0x98) r3 = gettid() open$dir(&(0x7f0000000140)='./file0\x00', 0x27e, 0x0) ptrace$setregs(0xf, r3, 0x3, &(0x7f0000000040)="3135a07c9d03ff98a368cad05350f4b2039b24e44e4821affe0778a084d1d7f7008d16dfa3cd0274c75056e143d53be4babf76b81ac0af3b6ce63f92454b9054c0fc91598004668834f33eb17611cab4c058441677817a6b1f2b7ba4ee1966889e3007") 22:56:36 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x200000000000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) [ 846.512196] binder: 4533:4536 BC_FREE_BUFFER u0000000000000000 no match [ 846.539468] binder: 4533:4536 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 846.546554] binder: 4533:4536 got reply transaction with no transaction stack [ 846.553946] binder: 4533:4536 transaction failed 29201/-71, size 0-8 line 2759 22:56:36 executing program 4: perf_event_open(&(0x7f0000000180)={0x3, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080), 0x0) r1 = shmget(0x3, 0x1000, 0x444, &(0x7f0000ffc000/0x1000)=nil) shmctl$SHM_LOCK(r1, 0xb) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x125002, 0x0) syz_open_dev$ndb(&(0x7f00000000c0)='/dev/nbd#\x00', 0x0, 0x40280) r2 = syz_open_dev$sndctrl(&(0x7f0000000140)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc0505510, &(0x7f0000000200)={{0x0, 0x1, 0x0, 0x0, "86195c5f6d862e013a2f76442ee8b753ffe8c46107d1ab9600"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "260a799355392df37b409772ec0b18ad45f8393ae38dfa72eb8a4c6cb6de26c4c869de5ed38f81dbb4b0b77d9c52f5836999c6f111f4769edd21d83716cbf3be", &(0x7f00000001c0)}) 22:56:36 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x0, 0x800000000000000]}) 22:56:36 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x318, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) fcntl$getownex(r1, 0x10, &(0x7f0000000040)={0x0, 0x0}) timer_create(0x0, &(0x7f0000000080)={0x0, 0x5, 0x4, @tid=r2}, &(0x7f00000000c0)) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000000)=r0, 0x4) [ 846.634915] binder: 4533:4578 BC_FREE_BUFFER u0000000000000000 no match [ 846.662952] binder: 4533:4578 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 846.670090] binder: 4533:4578 got reply transaction with no transaction stack [ 846.677439] binder: 4533:4578 transaction failed 29201/-71, size 0-8 line 2759 22:56:36 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x3b00000000000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:36 executing program 4: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000001ff0)={0x1d}, 0x10) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") sendmsg$can_raw(r0, &(0x7f0000001fc8)={&(0x7f000000a000)={0x1d}, 0xffd1, &(0x7f0000000ff0)={&(0x7f000000a000)=@canfd={{0x1}, 0xffffff7f, 0x0, 0x0, 0x0, "0327e1b22b5fcef7739c699f5ff986ca08990039576a7d5cb2bdac3fa80acf584ecb5fee496e6866856b76b50200000000000000004e2f9663a918fa1efd9b0b"}, 0x9d8}, 0x1}, 0x0) 22:56:36 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x0, 0x300]}) 22:56:36 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=ANY=[@ANYBLOB="180000060000000000000000000080009500000000000000"], &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000000)=r0, 0x4) [ 846.843517] binder: undelivered TRANSACTION_ERROR: 29201 [ 846.849177] binder: undelivered TRANSACTION_ERROR: 29201 22:56:37 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) read(r1, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(r0, 0x541f, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000016) 22:56:37 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000000040)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000000)=r0, 0x4) 22:56:37 executing program 4: r0 = open(&(0x7f0000000100)='./file1\x00', 0x8040, 0x0) creat(&(0x7f0000000000)='./file0\x00', 0x180) fcntl$setlease(r0, 0x400, 0x0) rename(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='./file1\x00') 22:56:37 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x0, 0x6]}) 22:56:37 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x8000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:37 executing program 6: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = syz_open_dev$dmmidi(&(0x7f0000000080)='/dev/dmmidi#\x00', 0x4, 0x1) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r1, 0x2) chdir(&(0x7f0000000200)='./file0\x00') setsockopt$inet_opts(r0, 0x0, 0x9, &(0x7f00000000c0)="e048d31c18519f68b28e788abcd46762962f498f6ec3a7a62b7ee753bdbfc9c251f88118a4f5fdbd636b98c94006c2c0e79817086a8ac86e9f280b8f7734a4cf5277f464027befb60bd7f789708507c898345b835dac20c34727eb3566547b077888a340fadc19ee11ed7a577524885246bb7a87701f419515682fb4fb98d6f713a2d68829c33605e1e728665d9384a6c705d7efa1bbf728ee3341c519e9af0564840977fa3227a6", 0xa8) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000000)=0x80, 0x16c) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f0000f40ff8)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x4004e23, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) seccomp(0x1, 0x1, &(0x7f0000000240)={0x2, &(0x7f0000000040)=[{0xffffffffffffffb3, 0x8, 0x1, 0xfffffffffffffffc}, {0x3ff, 0xca, 0x6, 0x9}]}) getsockopt$IP_VS_SO_GET_VERSION(r1, 0x0, 0x480, &(0x7f0000000180), &(0x7f00000001c0)=0x40) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000001440)='illinois\x00', 0xfffffffffffffebe) shutdown(r0, 0x1) 22:56:37 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6000000000000000, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) 22:56:37 executing program 7: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x4000a, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) recvmmsg(0xffffffffffffffff, &(0x7f0000001c00)=[{{0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000680)=""/25, 0x19}, {&(0x7f00000006c0)=""/247, 0xf7}, {&(0x7f0000000800)=""/65, 0x41}], 0x3, &(0x7f0000000a00)=""/181, 0xb5}}], 0x400000000000159, 0x0, &(0x7f0000000040)={0x0, 0x989680}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_LAPIC(0xffffffffffffffff, 0x4400ae8f, &(0x7f0000000ac0)={"55c990aa4964e82a3ec457f4c7d69681319b32c4fe546fdaa52a7f1ee7a27d5f71fb895c4bf21bf0301d2a160f646d230ecc224077896302fd1e64ad393ef24145492c44f164e53100dc89f52d25895dcd4320f649fc784145767a5224088c492511d0a5d7bb0c0176706c238dfeee9caae8811ba9d2ec92a4a340c091647ae36123d290d72c375af37957c01aa945bdb6a7a6870069350c7c2ac6b9c032e80d8150743be19fbaf9447badcc1908d174e06fd466e64e24e3c892ee52a4b31338ad67030baeffa5bfa701c1e7bfbd8fd016d87018d05ab11f9e813877bd9cdf0884cbaabe09190f95550884f8a1e6510f6bbe96f86859597bf89741aea068e55b938ebee9d9bff58478513c4b72edbf79f75431b54743ab05d3980b30b2127cf13bf94beba0828a4bb1848bc1f862fac00698e4bd2f4bde3bb35107056c4147c0ed8d7d588ba03c37b82ea384d1db706a8b46ee351812ad747d1045540a48b542996812548270c5af5d27ff72920bebd8371348c7f55a953e236ac13fe737a81bd9b61e30a5e9c526cf61862f5a0a90963c73febe3b66ab29f17b6da74b7647bcc4e527356d57fa1fe3f3dffab39df7b353eda6b839decb4484939f4fc0c84bda1c964941ccf4db1ca0d2c152fd356ac66441c8b68755d533b416d9f7999678227c7a69db08e997252dd6a38fc458d93fac9f1f14f49b7ca4a0b0c8b538d2f30c34503a0975506ae9004b3e5c3d2469cf4e03d9b79dc1499647b5b680a02bdc56c18782c48120dee663918288f068c49d85355d114cfe0c5d1405cf5e37b181f296fa7dc9af116fbe220121fe139739226eefce468f27f5d21ab51ef0e26134c5341cf13799003ceb38d4050c2ba1c9e6decc2d11a8f14a6adadd45e615106b5dd4c07093ba114ac55b4e80d1a3545ab6e8fbf796b908ecc244340fc06e4d4bd6e069b7f0232198ab067a709bcdd4d41500e5dc7032e5993f965d4603033fe61cc523937d7345df42b4f1b62c4daf64f6c29eb2f214b88680bfe19252b67719ccea37d19fe3bfb0c8ad0bd6f4a1df532ec9220269453df5144ff48f63c2ad655b8f20db01b3af95c11f4e7de2bd0a47d47b08b620589a33327bef9ee310505c1736510e88b74281f098099c753d30fcf32f31a0521e32407d689b093f24d07049682ff4662b5b94616699fd704589c0edb02cf3e622088c685564b0c166f9f3cdb12dd8a70684ac6e24570191dda2db2b1965d2397a45060f834405b81fa79204e029b7cd93333dfbef669f3e480fd071f5b87e9fdf984dfe176353ed12ea15484366548336f540a5f1e8b9e19bdeb8d71dce9ecf03d09515bc4bcf7be382176e7e12395ee0f795f76695d0d90eee181d300deb89d7098403ac76309e63f6ca3eade1ce57dcd9de56e24610ed5c470d5540e9f50d068ee8a1431bb3216ae99b18"}) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000280)=[@textreal={0x8, &(0x7f0000000100)="66b91000004066b80000000066ba000000000f30baa000eddb8f05000f89ae6a660f3a22efa80f09f00fc709f20f1ab60d0066b93608000066b80000000066ba008000000f3066b9800000c00f326635000800000f30", 0x56}], 0x1, 0x0, &(0x7f00000000c0), 0x0) ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f00000012c0)={"e451ded145d0fdec431460de156134cbc1c072a52ffcec572456c3f5a186847523be9e1884a2ab71f05ce4b53a955d8738cf0a3d1a000000000000007f6c83d4b257a2b7261dcdbf961639a5976bf8769bb4451120a1cb6b3511ac5fec3f451b5b52f3f1ecb8c3cafee2159de782753b997144c576689dd822add5da7f65c206de64f60e8aaebf61f1267c977193c96f4ed1c64dda0062e21d2242879ad09896baef52f1610436a19a2001b72b683a59370b916e3fc2e54ff6a602082b89bdb1cab587a749befab8ea7e16cc906f00ad4feecfb249de45e81059a320afce7f042cb918bd139b78e5cd971081d382b0a91461f71fd925923a3c23bff4335c639c2bedf3e4f03ebcbbfb36086cc86388790522d36364e453c3b88748fc91a4949b0749941ed62d4dd2329e9aefdb3a0fb20eb924227e24524c990965f7c4c900376860a8ba004fc01072e74052d25f319675df5f69bc8db18b6a219458afbd9f0b057ae630f12105c0adb2b97aa131e6cf5fac8666b93488ffc170f1ff334eaec60ba54d9df2a3bc1fd87783f783bae8f9701d59660984fb8229eb935e174ac97b456938b93a1218d1d1eebe4743ef07900528099c9c612d959b92a9f155e50bf5b05690a648820d8bc1c091f8ad472d5c92dfa998937c760f59aaa70e82361038ddd3e759cc9c50c96ba09344a6b64b29ad361e034726deebf52fb1401e33528b6df1ef85f83ac71c3b4f9c717103236a409612f244ea495fe97440cda2f97c8a1177e9af0572a960147f7e3a9a7422908672e65272328503504e528b004d1adfca7d814a1c0d18faf4430c61d5b40c32e26744f994d294910e5fd7f7df8787566ba9a120db61bcae77c145eb1ca45e268f7a9da5cf09a6a76c1ea3165f576b7b2ce7e55670f74e4a8cf9b944d48c0e1b4adf58a440aacadaec980d9a31295253f1e7b80dac1aa49d4e9521a50b773709c161c48bac2cfed0949beda15de0d78a0540c17be0e2d8963374b456c62f6571b7b634f49c560cbc4a23b2b77445b9c026022d7b5fe05777713cc8ca5009d1e0d0738ed6abbefd54000c3a8e9004790a05f56bf42ef4b9b60cf7e6dda8588d8a96ff5f2f47dd89bdc33e57c744a2b4ed1fc83e5cb13fa334dd0041d13ca3a7cb78e02a328e4a5ab9b9b8a02e0819794e4a9e2ff9eeeb18529b61cf250db1f72e41c29c5b70af48551eb33740bd38503720d54b3437508e8fc817cba05a67008c793f0c05042e257536c0bed690b140666f239974d21cdcd846070d7e506e0a7a34500a647ac343e754f1f07e0dd5c4767bf29459f401bb3d6ecf17b60c26602f325150759b5da60fbee3eed062aa833c83a892b6adb1ecab834e158fd343b036378ca67baf69e299062474e7a475f67016055427985976e533ce1b35725d3e29de7f6900"}) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 847.527518] binder: 4618:4621 BC_FREE_BUFFER u0000000000000000 no match [ 847.557417] binder: 4618:4621 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 847.564636] binder: 4618:4621 got reply transaction with no transaction stack 22:56:37 executing program 0: creat(&(0x7f0000000340)='./file0\x00', 0x142) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) r2 = syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x0) ioctl$sock_inet_SIOCGIFNETMASK(r1, 0x891b, &(0x7f0000000380)={'bridge_slave_0\x00', {0x2, 0x4e24, @local={0xac, 0x14, 0x14, 0xaa}}}) ioctl$VT_SETMODE(r2, 0x5602, &(0x7f00000001c0)={0xfffffffffffffffd, 0xae, 0x4, 0x596, 0x4}) fstatfs(r2, &(0x7f0000000180)=""/34) ioctl$SNDRV_CTL_IOCTL_HWDEP_INFO(r2, 0x80dc5521, &(0x7f0000000080)=""/223) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000400)={'vcan0\x00', 0x0}) setsockopt$inet6_mreq(r2, 0x29, 0x15, &(0x7f0000000440)={@mcast2={0xff, 0x2, [], 0x1}, r3}, 0x14) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000000)=r0, 0x4) socketpair$inet_tcp(0x2, 0x1, 0x0, &(0x7f00000003c0)) 22:56:37 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x0, 0x1c00000000000000]}) 22:56:37 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x4400], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) [ 847.572079] binder: 4618:4621 transaction failed 29201/-71, size 0-8 line 2759 22:56:37 executing program 4: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}, 0x4}, 0x1c) sendmmsg(r0, &(0x7f0000006380)=[{{0x0, 0x0, &(0x7f00000000c0)}}, {{&(0x7f0000000580)=@in={0x2, 0x4e21, @multicast2=0xe0000002}, 0x80, &(0x7f00000004c0), 0x0, &(0x7f00000008c0), 0x5b6}}], 0x2, 0x0) sync() getsockopt$inet_sctp_SCTP_MAXSEG(0xffffffffffffff9c, 0x84, 0xd, &(0x7f0000000000), &(0x7f0000000040)=0x4) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f00000000c0)=0x1ff, 0x4) [ 847.634296] binder: 4618:4637 BC_FREE_BUFFER u0000000000000000 no match [ 847.671701] binder: 4618:4637 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 847.678909] binder: 4618:4637 got reply transaction with no transaction stack [ 847.686316] binder: 4618:4637 transaction failed 29201/-71, size 0-8 line 2759 22:56:37 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x0, 0x600000000000000]}) [ 847.725868] kvm [4635]: vcpu0, guest rIP: 0x9112 Hyper-V uhandled wrmsr: 0x40000020 data 0x0 22:56:38 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x2900], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:38 executing program 4: r0 = memfd_create(&(0x7f0000000100)='\x00', 0x3) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffff9c, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000400)={0xffffffff}, 0x13f, 0x9}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r0, &(0x7f0000000480)={0xa, 0x4, 0xfa00, {r1}}, 0xc) syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0)='IPVS\x00') perf_event_open(&(0x7f0000000140)={0x2, 0xb1, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$IPVS_CMD_DEL_DAEMON(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000080)={0x10}, 0xc, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="10d1ba280f", @ANYRES16=0x0, @ANYBLOB=' \b\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x00'], 0x14}, 0x1}, 0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffff9c, 0x8904, &(0x7f0000000040)=0x0) r3 = syz_open_dev$vcsn(&(0x7f00000001c0)='/dev/vcs#\x00', 0x6, 0x8040) ioctl$IOC_PR_RESERVE(r3, 0x401070c9, &(0x7f0000000280)={0x9, 0xd2}) ioctl$BLKPG(r3, 0x1269, &(0x7f0000000380)={0x8, 0x3ff, 0xae, &(0x7f00000002c0)="4205341f2eabbfe285d17dcda2d848938ac76ec599c8f8754bbf3cc710b0ce8514d47461490a34dc778ca15ea3e5dae654a277b48ad86cf76b899190b4511f578afcc772f0b78b38c8824a845214cb23dac0ff771a41f7fbbcf384bbd33f147759704320491d82d1d15cb9cc5f72fdb49a239d2a95b063aba49f3cd8de1782452b259651fbe7c926851f5fff732e81a59257ca721a17e18db991e340ce4a4f7dfbcb090dd9adfc3a318f6413c0ec"}) sched_getscheduler(r2) r4 = socket$nl_generic(0xa, 0x3, 0x10) setsockopt$netlink_NETLINK_RX_RING(r4, 0x29, 0x22, &(0x7f0000000000)={0x0, 0x20000}, 0x10) 22:56:38 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) [ 847.768195] kvm: pic: non byte read [ 847.784470] kvm: pic: non byte read [ 847.792442] binder: undelivered TRANSACTION_ERROR: 29201 [ 847.798076] binder: undelivered TRANSACTION_ERROR: 29201 [ 847.798664] kvm: pic: non byte read [ 847.865147] binder: 4660:4661 BC_FREE_BUFFER u0000000000000000 no match [ 847.878550] kvm: pic: non byte read [ 847.902568] kvm: pic: non byte read [ 847.910412] binder: 4660:4661 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 847.917106] kvm: pic: non byte read [ 847.917690] binder: 4660:4661 got reply transaction with no transaction stack [ 847.926258] kvm: pic: non byte read [ 847.928462] binder: 4660:4661 transaction failed 29201/-71, size 0-8 line 2759 [ 847.946987] kvm: pic: non byte read [ 847.955880] kvm: pic: non byte read [ 847.963955] kvm: pic: non byte read [ 847.974086] binder: 4660:4669 BC_FREE_BUFFER u0000000000000000 no match [ 847.984879] binder: 4660:4669 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 847.992054] binder: 4660:4669 got reply transaction with no transaction stack [ 847.999406] binder: 4660:4669 transaction failed 29201/-71, size 0-8 line 2759 [ 848.050736] binder: undelivered TRANSACTION_ERROR: 29201 [ 848.056399] binder: undelivered TRANSACTION_ERROR: 29201 22:56:38 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) read(r1, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(r0, 0x5451, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000016) 22:56:38 executing program 0: r0 = dup(0xffffffffffffffff) setsockopt$ALG_SET_AEAD_AUTHSIZE(r0, 0x117, 0x5, 0x0, 0x2) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r2 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f0000000000)=r1, 0x4) 22:56:38 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x0, 0x7]}) 22:56:38 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) 22:56:38 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0xf5ffffff00000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:38 executing program 4: r0 = socket$inet6(0xa, 0x2, 0x0) unshare(0x64000400) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") sendfile(r0, r0, &(0x7f0000001c00), 0xb37b) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f00000019c0)='/dev/mixer\x00', 0x20202, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000001b80)=@broute={'broute\x00', 0x20, 0x1, 0x138, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20001a40], 0x0, &(0x7f0000001a00), &(0x7f0000001a40)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x5, 0x18, 0x88ff, 'vlan0\x00', 'veth0_to_bond\x00', 'tunl0\x00', 'vcan0\x00', @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [0xff, 0x0, 0xff, 0xff, 0xff, 0xff], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [0x0, 0x0, 0xff, 0xff, 0x0, 0xff], 0x70, 0x70, 0xa8}}, @common=@dnat={'dnat\x00', 0x10, {{@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, 0xffffffffffffffff}}}}]}]}, 0x1b0) r2 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) ioctl$ASHMEM_SET_SIZE(r2, 0x770a, 0x0) r3 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x2000, 0x0) r4 = getuid() r5 = geteuid() r6 = getuid() r7 = getpgrp(0xffffffffffffffff) r8 = getuid() r9 = getgid() sendmsg$netlink(r3, &(0x7f0000001980)={&(0x7f0000000040)=@kern={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000018c0)=[{&(0x7f0000000140)={0xe4, 0x3f, 0x2, 0x70bd2a, 0x25dfdbfd, "", [@generic="4ed0e24d6288a55069b00da66f60848a626ad3de6c82fe94a2e89fc713f214c91f0328a7a5e5ba350cb8ac37f61af267292c98b99281f30111350a2d2fea01d0442544778d6dab440b447d4ffddc5069afb0ddcfda0b8a13cac92bdace22f6c0aeb92680476aad2f12d4032913a5e79fac7d14c65bd977d6bd4075fd6483f4eab277f9298f5dae99f8d967e22b41bc5e81f08cbbe5455a15ff12544afd4e6a35031551bfee39976d56df82116bc16456f2e2477e202e977ce85fdd", @typed={0x8, 0x14, @u32=0x586}, @generic="2ffd1e9e61916e", @typed={0x8, 0x2c, @uid=r4}]}, 0xe4}, {&(0x7f0000000240)={0x1370, 0x2e, 0x1, 0x70bd2a, 0x25dfdbfc, "", [@nested={0x2a8, 0x15, [@generic="c43314ded297af1faf1865986616424254aabf017eac784e9a339c3af2ff0cc2341afd3e32d367876a8bb2d95a858089a5bad6efc561b208ccb33dd846bbfbb4fed645a66e4fab6ae537e56ae8622ae430f3e0633bb53bd17613a55b7d7cf926adf28821aadd0b80332f79972717f43680a79e249855bd56966a5a7813b512dcdd642ed2c116ac602e0b52c439dae0dfdbdffcac863d1e91eaf951d7f06ccd437a90cb5410398815bfb7cd5652b0931153bb2165fc5e60ade72960292d27b92f5454cdb7680c4b705490d9e984a41b0a41bbc3d8aa63976cd4d1e2d7353198987e9743f7", @generic="22d21ea9b1cdf7749426552142cee099fefd0aa10df3b8b8957ae5499ac0999a522cdc0dd2b3ae1092b25fe930b39a06b5d1834cba67e5cf3849fab64cd36d1a698dcd3240e5207af03fbc350db53488037781172f100066633f381bab856563276b2920cc7b03df66704da627f4d1d750ba4ee8", @typed={0x14, 0x4b, @ipv6=@remote={0xfe, 0x80, [], 0xbb}}, @typed={0x8, 0xf, @str="c800"}, @typed={0x4, 0x6e}, @generic="b157a89f65a543a013ad228a724a4e8457a43a4fcf1437b631498a90d97b6048a8a4b5c27db1be8fc3042949f2d558a43644d18bd07f66567ab00038352b5838d784a569d62692abad1a07ccc6e1f769fa094c6a41ccb0e6d769c3ab50938fa9f181d4e43622338002ce82ad95b79c920b8f29fd2cc339b8d8ea183868c1ef0e317ae5697e77a51242592474a9e9f6bd9bc701a1c5d6bade0db050c07b9e10e9a06fb9a437c13f0f4d6b72eeb3cada0b1e7406198a41460a124c59c59e69581978361b5d2bdcf13aaac61bd27f057d9f5cbb900fefa587", @typed={0x8, 0x2, @uid=r5}, @typed={0x8, 0x61, @uid=r6}, @generic="3053a329ed0c27842fd72d51681842ab4fa8d7a1749999999132a4649481e520a0f89eeaf2c8f9c2f6b9698f8aa537323e1be7242aeecb8fb732bfbc491140f9abe53c"]}, @nested={0x1004, 0x59, [@generic="749dd6224f25d08be8aece42de1d7d8b386f881248da8edd8d5798055c11a41bac8fc1b7656f318db12194ebd3abd4a3ef76fa929ad7bdcf40b151c35d7f50dd574a0c940b7d35c7219df65ada0f97a630d4679727dcdcb53566112ca1eb266af1c520c874286adf357cbe725191da685ad78ee4ae6a9c0c3efcde3c1eb8e781b5da30686e9c947e03561782d72850e49487b48f10b59319a0cfcc39c963c39eb51a990284b5df13c658c20ab5da4e33d98be3110f7b68497a24849f9f43390fbe2193605ffac15c0d334faf6998294312b2e810bd201ffffcb89dce8461fce9000768ec901abdca994773b8777db68ff4ec8a7a81de3173c6f198d9b88e34d168bad40aac3d124392a68e184ee437d11a5c3b80f58603fb62990677e143c3c12b4c1dab9cbb25dd62e5fcd3552c25dbd2ddd84c473eeb92d65ac549ae505d9332b37a23dc8cac167376f6234e2effb733d1fb0ccd41a88dfff9219bc3b0362951deee6f64edbdd31f30705e97e3b7d650c92ee374c4bcfa8826fd925688b30de85da610924422389f4a8c07394a7c21398ec549a0d75e848c34d1fcec569ff5f7d7e1d904b99e89d63c97ceda8e397e7cc2cbeac2ff53effd66c77cafed9c8e4326f75600c345435498998ab92a85801ad06ded25fd641a7685696a0c95741a7dbc7903e23c259c9f59742ede740684d0a3a2ed1809d960ba20b0939fc6870a280c45b90f5d3eec69995f9b2da7d264250ce4c116d4c1421bc0f8f73091908679f2fdb01a8f20942d06fd9bf8c76464b9ca361073957d1b96cc7586798d5e63f7ba02023b12cda2c495170f5aee4a09786e69076dd05c8def4bdcb48b0216735409f34a329ecc903bce3b00b9413c6f99daf0374af2cb4b2bb835cc6f3bff636611809453a6516e1b1d11d03e2b2ba283e3f040e74f1362eaf00de9868a27d36c4623d1c6d59f8021828eac0c83fcd0ca5f6f08b5e06fd4f0e76838b901f92b439c8b3f132ddf886cbbd8190d8955f665d10ba5c09cd0833f33d4b743a1ab3b5b4b39dc89ba7c67718d0841935d7909a2324c8ab87556c56c6b923e91a113bc9f6aa626a2f71d9fb97c2b666eeef960950b1e553478a6b810ed39fedf67b79085b86c43bbd830ce756b6f618f5ad4a3396202bbd1398e1c4dcbd482fcf5b1646b22b6c72a315f17630a84ed042f1c5350813483e16c8594945c6ed09d8fc0b2c44d7915448014ee337e632a99c3d331d0908ae9d135992f2a42451d447c0268bbb6858cf36fd02d31278c8bf89517d1413f5ec8d33e3827c9e166bf209bbf5d56fe06cccc936687d9e0135c1785415ba56753f0126e629e79431e525c42ad4daeb9ced3f673b48f046146001b71d749f47280ff03cf2768af694e2fa2c0963e530be29deae3d56fcdcc3a0e02bfc2e5c92094d9b4e83e089b428af498335271e0830b504357ff2c02033a6dcdca1f8f7e6a556826f5e71a0680f9db530a7c3c878c611e1879bbfb51a978f32864e7d260f3a5924120f2a754dfd57bf70474515fb265e5f8f6d62d76c2f9b2f7037982080e0fced104911a38139d24b38b39455f963a44e11f58ef2ef3f89c7770f4e6bfa80e8fe906c22fae2c7594bc2a4a4d23cd40a579f1cac73528dd3de5a8e0bc32f2c6f922708b67f9a6ad051856f90f8b434299daa0e1fcbde0f1c1ae6ba538ccbf06749c282055d3b6959f5e2ef9956598b2858edfff9e6db543d79399b146289ff118c6c2bee0483a2db53c1ad43e5a7506d3a6553e4385c13a8c5ace631a21434cc9edfe46bf5fdab5c1992a932e2becf15baf5369608b2aee967794031dd0508cc131b32bf0146a3cf46ec6f6622c0aaa6996057e53d6df9a0664a901e10e923222bbe8fcfb2e2561bb94d49f431d9ad02f4cbd8863345c2169d8700d1684ac3c1d5a4ebc429909008b540bbf19ecae34b2c6eea44a9663790b12aceccf517eeb6fbc87d868dc68f1d8032f00799e2bebca671ad5389a1e8e05ee90cd83af268911df080e18930aabda33960d4cdee8baf12a8187ee717e93b23435a94a90c0c72305603576592cb18f516f1e698546d54bf4b01754d437e02f623160c926ef8283bb280e2ae1b3d2875396016dfdad2be48896efef07d4c5264b53ec167db93dd912de7d0725ec805b28192cb9192710185d54851fa07336cd47da8538967fdd04ca12f2e2a3aa7c4bd924e2b2d69e238334e5432f525a6b5765460febd5ac0aae38be6d2ebd250f3cc7fbe755edf0301d059058cac76834647b56ba6963b27384188ac524a5bf51ba9c2be2ee9a8ffc80755a7abf45d476cd56739b3e8342175ba8ad09aacb903fcd168ee9735cb39d04e877822912555b1a3ceb01616d44be2cea5ac12918709a850963e22d36140b8108b53684db8dbda2ddac18165aeeb78bf5bb9bbf010ea2463d6e7a09e0cb05a8425e50636951c828ff4555dd1193d5bf51b7e0c68149cc9d5aad7e84976794fc7586ef4352bef1b7303452335fc4a64d5413fde996b5d9de7d4462785abf52187af4da3be816ae2fc6ce51f979209cad417eaa58d5351395fc4070ead048046be3c9b15f98e78110e48a6b0b51c7b7e945f3c58b698010a7723a846a60db80b0037701f3eff8b1690a2a1608983aba1e1b4b4fb7a47c29cd8e0e85e656550d23d781eb514e9455c84e9f49b23e26512d34a04b8f2982c8e5934cd6c7492dabad602601e08a6596a4761770f8068fd558ede472b04f7410efefdc2f1ffb3d740ae972bdf6863ad972f6167a66d9723266cfc5f8d08ddc1811ad9dc605c58ea07e7a990632237b1ab4f32a3ecc88cc3ac1301ac72dcc5b29cc58ffbef409fd5e3dd926ef7be4104ebb2d28302eaa20797304849e824efd98244e3e80311c1ab5d1cfdc026f6729670d14278ef33922e25879af6a336799a6ff9ee437d63f4f6b905d58d37e8fb66576c65c0a96da53ccbf93f1f392126a6ed5a7e6f869b87dab408034e3cd5f2fa65bfb5f5001239eb5928e817e27df6f53da8336e43030a9521872a06bef2bdb4a71a813461b65335ad735ca648efbcbdf2fed31521f5162a9851377d09dea94d92d2ba337ab7453dce46bce54bf0599a25d9f5d6c5ee837acdbe845ae3a1883d98b46a94692d26fc28c95af9663b5d7f4759ed80514f6d6f3a7c14a843ea404a96e8549dc4947ddea482c8444d1c262483043dd9d9a7f25d02239b243da82277666b85a602c39c72a48979b5008eb7e95581e0f556643b6a282293a097a0f0ca076d16655da1fd4a5aa8c6a9c047d0a70a57c8f306ebf3ecb25b7c913d38530c2a544f4c2496a140ebc473e1f55c85c53bf2345e0a2fe6e4f41458335465104229f09fa19582d5fcb00537e1e7983380d249f5dd8abc176b62f8769bc663d8d9f1aa8d4305e50cc5694961cf941253e7046b118fe1764699e3da1e629fc757ddcc4ba593ca3e7084cee78d9033a1dfa3c4c67af0d9887f404df5b6dc143b7b703ad88b6660598a355c72738fd53b642506799cc8f9ce8e092990d8001e5f70ba04315e78a433a470328480cd9aec06ce93dba5b102577f38a4a6f2d64cf375907bf48b3d5a42a547dbe07ab62924e92176543e7795c69add114bb5492d742c5f18b6e99752fd9751c7148210b9756281d4e14976b1a69bf522044939dc07f98bf64cfba5bb93bfa00fb3f7ef6e02eaffd1aa503e9cb46c852e8e337b90365171780e753748bc377e254c5e4068343ea2871dd892b3672e3309adc56ed86a3eb46224b2d5111cda3cf2fdff19d24ffe38c3efedfab6fadbb5db4ed6a9a89f78bb437a2bcafd86a3029322f95793c67e45383aab2c2f5219349cc235ca66269c45537acb8b130363c879361da94a0b30a9186e46de797aeeabbc7689327282f01b3f97bdfe7f4cf42b7c864710ffdb0d73a8e746707dba5e4cd16a018aac3439a9a15e1f207857953d8f619c3ec6a68d9b6a71cb511bedbd6306603b6e57b16271e5d0e897a4bcb2b3967c452b847af363a906473ad6c06cd1dddbccd5faf9bff96a397f0e1b3f753087ea588656023c8c902426d55dade0b1d39ad83587807a516b674052f22927111ea84343fa582fa6f35903dbab74165f90c8fce5e158fe360f9d732644a0a178dbd05785a6b901390c3b17c9c115098c886f8f3c42354c289d133c0291684bc78a5f20cbf62e54b4ad77d835fad47ba726fb664dbca418a835d7dc40af054ec939d4b41d52a9b77e8f595846472a7ed6c0efd1d41d22e5324395b14cb3764057f52e462d44d66a047651179f74c5e6e8059ae8e6e847b8c9cf5e8b10befe4f1d346efa352c8be80e601c5ee8a8e797d333364da07a4216c873f5d83baa962319e589e000a9cbe678fb82a9e25632b5dc547e7c538b0534f795077efb7e8b409f565ea967b1f1b853d51fea81559a7829e77ac09579cb92a8711b51812802f5cc925e51016a70b1f0a599eee6199d06485cd3f160b816a7386dece066d932c5ed6412d9a66b53dad327491434dcd0a5d38d150a339da044f785f7e0c35d70b50940804eed3f3d352dc2ed51c8c70ded6a55bdcac102479fccc322bf10e2225290e3854bce81fb469fb61e6a8fa7cd3858770f339c77815e2993323e6963116761c4cff9a4241b6bb912319078379f3c1b96cbc7eebcbd91bd7ea22c151617c88a1afee28cad568ce1046a7aba72c822dbef6a29606bc8c14b793ba761fc1cb0110940df97bbbaeb2f26bac441b69941df807ebc629399e72600a981193f5a6e32529b9f6c3e8878edeeeb77fcb5dcc8120967e955abfb9b59a1e44062d8eac7f79b73b9973c07670d1a4c6c7d6ed575fc2cddbcb8c2ccf297c18e3183a2dc40acb4920f75ebab8a503eb527c727361493b930e8c4901b5d450c96472f7442012dbdd5ab6035ca2cd52bacdd4e614e3288a418c5c67db99e9085134043f1ee1f0c0298f1c51921fe8325c6fe5a850871e359d07b3d278031563d2934bf3059461428de94da5588ca5a54ab0c0f7e6cadffc1540c4be9703408cc4e4421d07356b66ac787be1d01723f2546e816f981ceef75714caf20c5fec2b8d0bb19bfb1816ca0a3877c0a23475094c171ee9c6ae38100db24fcca90ed3ec4d7f787c7f6f136fdc69c01490d9e6d872838f5df163273dd4b7277b3e752483c6a0c36eaf4ea0c7103ad15d183fa0b75f0dce95a70ce0b3dd92433d952cfdaf2e278170391ff5b861cde5684b945ee2a7b7097c668a8a51b20e58a7b20a32f67bda0965267d57af26298aac6586f2264f717acb9ec6bf8987e7b252bc862adf07d2df541570ad4d7052a20472faa343a63f969e0f8266bdff409b9ebc05a6c70162dc79d4ae5e5f63376d6810263589f416e018fd62cd3393302227a9a804052356e59703375ee7010414b891e9df6e62e170b3fcdedbc7435888a05acde3551e467ca494c22a274b13fce9a7755b4d1236062e6f81a086be4300f0d584cda92d33ae50ff3ccb850fa8f4908365a0f7055402f2704128802c5b558bedabb1d0fa33d5f0da7904d62cfc82fce40d856a2b7147eff1dd0d966aa6408dea2cf73371d52c9060a81d75c0d70dfeec471f685c7343eb055618fda327f61f06bdf4697ab84afe224ab0b40aa9d2412f40e820adfba56632a89ded2dbb834a661a20116a559f09781d4076c5215b72c92c57cea6cea9cdab75337a293cdfcfd39c77bc26bf7ac363194eafdef79e5556620991197dd550da1ee9f16ef0816e1de476feee660d2539103eaa8d49347eca76fabfd2f73cf97b"]}, @typed={0xa8, 0x4, @binary="67208e94ec9f04575faa1bbf43ff3fc503eecc2bb3f8c82effe575ecbcd82de15d2a0bc3d0c32d700be9587d7b2a1859ed2b941bde39e0c5d4668b93c3f265db48720a28dca8d5f8a83c25a2119e063e7ca36d0cc9715cebf6ef8e5cd0381376dd0c430807a817cee267e3c25f36434b90bef23e99b82b280fa3b70dc0336de8d5f0c25a19c6f466633b87f9ed9566ec09163b614987846b312410b653c4afc0706955"}, @typed={0xc, 0x1c, @u64=0x10001}]}, 0x1370}, {&(0x7f0000000080)={0x10, 0x3d, 0x9, 0x70bd29, 0x25dfdbff}, 0x10}, {&(0x7f00000015c0)={0x2f0, 0x38, 0x4, 0x70bd26, 0x25dfdbfc, "", [@generic="6932acecf89ac692409cf004f5550192b24c526a287932f31662deeaf5be987139052f11fbaa9e44f3fe6620660a01a2a27cc37a8a135bff9b67f59b2146cd44c276286e9003575e9233920182804e6f3f852ecc7ac63ae5da8df775733254464cfb6ee803a3eb2d814897f38667bc4c", @generic="3037f0bd6fe8e09604b71d4b4a7c0b7cc4a88e665bcfd33d6890086476fae0be2f091ec8d41da0271caeb739c1eac760048399f250bcef", @generic="bd9099c2faf1b56620b381ee2e081d3cbeef2008605a33c268da55688c03c8813a44554bc94bef33ce91f517064a38be3039fa39134439049ed1bb3f2eabe8579af9d7bd2e5e2afea175aa9077cd9249a90580118914a46b1ffbcc9d4302001621751c0f72aaca2c6f5fe7edb2651d5cc3fbd03b7ff7c79ea3a36ed2e6357b62b1e557ebfc68485fab8896e34954c82af7247e78f257e1647b814c810a84da1220343452e7b038ad3a91a0", @nested={0xa8, 0x36, [@generic="1a3a9951cadf7266a4d5bb67db905a8707fb4bd79c08dbf3c52cc03a884cea28ff1ebc555dcc53dde5ffa97487ce4c88d6fe72442850b892a86151a18efb9c69eae49d3aa933ea0f13938234f5f03cac58929b8de29239d1b1fc0c3d3007ba27c20baa717d8bd9564f34cc2d4b6862dcda37bdbc4c4e62ffc486d4143e08e4a85ef6a199ce140a6c2b180eeafc6e", @typed={0x10, 0x93, @str='/dev/ashmem\x00'}, @generic="eef98f"]}, @generic="0da7cea12d2056f86a76e9673fe6151947fae539cd09d39640ae065688039b4a786746dd522cf9e2ba230f1e6b98f432ebb213fd4967fa80241592cc4a56b36069be3434a9dd20af63466174c089af75967ae867ff95e5d8919d66fed4a9d273cdd13c8316f35efdd30592fea329d4c10e50fb2fb5d431fe160ec096ec8b05264cee", @nested={0x64, 0x3d, [@typed={0x50, 0x85, @binary="f9ee99aa2ac11f9cf65f50df3491a6d629d238e017a0d6d05b7562a4cfbe2b321ea61c635adf7ea2ddf3e0988613e325d518a08dfeb82d74603faae432f48a088143f7a199b0d8a91011f0"}, @typed={0x8, 0x23, @fd=r0}, @typed={0x8, 0x2e, @u32=0x200}]}]}, 0x2f0}, {&(0x7f00000000c0)={0x18, 0x2b, 0x60a, 0x70bd29, 0x25dfdbfb, "", [@typed={0x8, 0x4, @u32=0x8000}]}, 0x18}], 0x5, &(0x7f0000001940)=[@cred={0x20, 0x1, 0x2, r7, r8, r9}], 0x20, 0x60dac1f0fbfd752c}, 0x800) 22:56:38 executing program 7: capset(&(0x7f0000000000)={0x40001998032f}, &(0x7f0000000040)={0x0, 0x10000000}) setgroups(0x0, &(0x7f0000000240)) r0 = syz_open_dev$admmidi(&(0x7f0000000080)='/dev/admmidi#\x00', 0x80, 0x20000) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f00000000c0)={&(0x7f0000ffe000/0x1000)=nil, 0x1000}) 22:56:38 executing program 6: r0 = socket$inet6(0xa, 0x80804, 0x10bf3665) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = memfd_create(&(0x7f0000000380)="00000600", 0x3) execveat(r1, &(0x7f0000000000)='\x00', &(0x7f0000000280), &(0x7f0000000500), 0x1000) 22:56:38 executing program 7: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x1, 0x26, &(0x7f0000000480)=ANY=[@ANYBLOB="856429000000001500000000000000a66ab15c1f0179bb368830f4ef42a4546fa89cec9efd4bb66dfb0662dd1864d505743e277bd0eb0d14939e41798e250d5c060b91efe4eb0e2fd96be4759f602f9256b8bd39cd8510fcfdf8447447d39aa9623f4da3aedcf8622fc90e5850192b29b3d7b3ea0ff4e6b34457b5bdb7417f239347c7e9e23aa0995034fde7356219e70a8672ab8751a61d2234ddb7ad9c93422fbe4d8edebfc82a73ed1b2db2af7b8165882c08ce0aa19cc8d6bbe8ed7e730585942726b67a0b8e75df96fb749d39130afb919cdab288d91701000027c385ae6128211cae7dbb111859b67e9c166df81b7123521da9f0fb1aa7533af9b6c1c9854257fb2416cec9976e38d637fa22e1d14ee51d18588c09cb369ccebf948b6b24f77221adf5f6a209000000cea0421d7c5ccae8aeb7a9e26c77fb815f03430090f11915581d19ba821dcf40631e1cb8b899da1dde153e52ac473982b13d1750c1a63c5caecada9de98b11ac6924143a8a92a8953744685c85df4e0f9e59e619f4dbb59bf1f3cb5d386e317560414cff71a809f6042838fbce9e647bc9dfe2070d8ccb41434d5fc4238c2a52110e42eebda4df7cbe89b46ffeb6165d622e3223e0807b68e966846d9772"], &(0x7f0000e6bffc)='GPL\x00', 0x1, 0x99, &(0x7f000000d000)=""/153}, 0x48) r0 = socket(0x2, 0x1, 0x0) mkdir(&(0x7f00000002c0)='./file0\x00', 0x20) add_key(&(0x7f0000000140)='cifs.spnego\x00', &(0x7f0000000380)={0x73, 0x79, 0x7a, 0x2}, &(0x7f0000000940)="f2ad594f5334f2d4423c1c2a91f4cb19d178b124a8f5eb0bee785172b0a14ff3d9bcdac1e17c7b06d24befc49a199d8192d4b5199be81c369fe175aa554a957a837037ea4c51e5f490b69dd015664fed25a27e9e0ec9a0e2100443570bc94f6c83dc544edafcca4941ff8ed5a58fb1b27545e961d23979c83372132367e5ad22f20f15fe3311ba974e6c3ab7540127688d23bce90b6867a2b75aa86db9ba8baaba3bb74c4dc8a0490f01aec0d63898f413fc0fffc2cdef3c6e2caafd8a5c9398d50ed1b69bea555c1657c4198324984adf61e805e10921479cb38b7bb17fff123324f244a07bd5e442bd45", 0xeb, 0xfffffffffffffff8) request_key(&(0x7f00000003c0)='trusted\x00', &(0x7f0000000400)={0x73, 0x79, 0x7a, 0x2}, &(0x7f0000000440)='net/ip6_flowlabel\x00', 0xffffffffffffffff) keyctl$negate(0xd, 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000800)) setsockopt$bt_BT_SECURITY(0xffffffffffffffff, 0x112, 0x4, &(0x7f0000000080)={0x0, 0x9}, 0xfffffffffffffcb7) r1 = getpgid(0x0) syz_open_procfs(r1, &(0x7f0000000340)='gid_map\x00') r2 = socket(0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000000), 0x4) socket$inet6(0xa, 0x202000000802, 0x0) r3 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/qat_adf_ctl\x00', 0x10002, 0x0) ioctl$TUNSETLINK(r3, 0x400454cd, 0x207) getsockopt$IP_VS_SO_GET_SERVICES(r2, 0x0, 0x482, &(0x7f0000000180)=""/39, &(0x7f00000001c0)=0x27) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(0xffffffffffffffff, 0x84, 0x1e, &(0x7f0000000100)=0x5, 0x4) fcntl$setlease(r0, 0x400, 0x1) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000300)={@loopback={0x0, 0x1}, 0x3, 0x0, 0x2, 0x2, 0x10001}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000040)={@loopback={0x0, 0x1}, 0x1000000800, 0x2}, 0x20) r4 = syz_open_procfs(0x0, &(0x7f0000000040)='net/ip6_flowlabel\x00') pread64(r4, &(0x7f0000000200)=""/159, 0x9f, 0x3) 22:56:38 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x2f000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:38 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x0, 0x700000000000000]}) [ 848.591904] binder: 4686:4689 BC_FREE_BUFFER u0000000000000000 no match [ 848.603431] IPVS: ftp: loaded support on port[0] = 21 [ 848.613211] binder: 4686:4689 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 848.620436] binder: 4686:4689 got reply transaction with no transaction stack [ 848.627843] binder: 4686:4689 transaction failed 29201/-71, size 0-8 line 2759 [ 848.684675] binder: 4686:4705 BC_FREE_BUFFER u0000000000000000 no match 22:56:38 executing program 6: openat$vnet(0xffffffffffffff9c, &(0x7f0000000500)='/dev/vhost-net\x00', 0x2, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r0 = add_key$keyring(&(0x7f0000000100)='keyring\x00', &(0x7f0000000140)={0x73, 0x79, 0x7a}, 0x0, 0x0, 0xfffffffffffffffb) r1 = syz_open_dev$sndpcmp(&(0x7f0000000280)='/dev/snd/pcmC#D#p\x00', 0x3ff, 0x20000) getsockopt$inet_sctp_SCTP_CONTEXT(0xffffffffffffff9c, 0x84, 0x11, &(0x7f0000000300)={0x0, 0x8}, &(0x7f0000000380)=0x8) setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r1, 0x84, 0x76, &(0x7f00000003c0)={r2, 0x7ff}, 0x8) r3 = add_key$keyring(&(0x7f0000000480)='keyring\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a}, 0x0, 0x0, r0) add_key(&(0x7f0000000000)='dns_resolver\x00', &(0x7f0000000080)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000180)="c6a34e987940ea478d9bd365b9e4621e334652733324b7773a3df8a7504d9e18e2e4a839fcd9030000000000000028945d12a9caae603ff81c4dc32ed3d70fb5d4c5b866305249060000005277822d0e0616a2e5b74c48e38b9936f298c6feec95ad327c724ec507bd34b94e99623f014bf81ea54900ac54a99aa04e1a7f000000e8d3bfa2f3abce9736aac3e0b19d5a697bc438cd49bc1cf3af72c2180bbee78e9a7237c02e10ac77e3a4fd8a6e2bdca6a9a1d7da1a3e559fdafb6703c73b3c4c10865302fb324f16327996273625d9f0a54ef16bdb08f22ed11fd80b74eb861aebe51b0912c0f79486c25c49524ffe4f00", 0xf2, r3) request_key(&(0x7f0000000040)='dns_resolver\x00', &(0x7f00000002c0)={0x73, 0x79, 0x7a, 0x3, 0x1000000}, &(0x7f00000000c0)='\x00', 0x0) perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 22:56:39 executing program 0: r0 = socket$bt_bnep(0x1f, 0x3, 0x4) fchmod(r0, 0x40) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=ANY=[@ANYBLOB="18000000000000000000000000000000000000"], &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000100)='/dev/hwrng\x00', 0xb02, 0x0) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffff9c, 0x84, 0xf, &(0x7f0000000140)={0x0, @in6={{0xa, 0x4e21, 0xfffffffffffffff9, @dev={0xfe, 0x80, [], 0xd}, 0x688}}, 0x401, 0x1f, 0x7, 0x2, 0x5}, &(0x7f0000000340)=0x98) setsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r2, 0x84, 0x6, &(0x7f0000000380)={r3, @in6={{0xa, 0x4e21, 0x0, @mcast1={0xff, 0x1, [], 0x1}, 0x9}}}, 0x84) r4 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r4, 0x1, 0x32, &(0x7f0000000000)=r1, 0x4) [ 848.730729] binder: 4686:4705 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 848.737930] binder: 4686:4705 got reply transaction with no transaction stack [ 848.745318] binder: 4686:4705 transaction failed 29201/-71, size 0-8 line 2759 22:56:39 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x89ffffff], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:39 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c00, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) [ 848.842731] binder: undelivered TRANSACTION_ERROR: 29201 [ 848.848475] binder: undelivered TRANSACTION_ERROR: 29201 22:56:39 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x0, 0x6000000]}) [ 848.913605] binder: 4730:4731 BC_FREE_BUFFER u0000000000000000 no match [ 848.960624] binder: 4730:4731 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 848.967875] binder: 4730:4731 got reply transaction with no transaction stack [ 848.975308] binder: 4730:4731 transaction failed 29201/-71, size 0-8 line 2759 [ 849.050824] binder: 4730:4740 BC_FREE_BUFFER u0000000000000000 no match [ 849.064926] binder: 4730:4740 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 849.073198] binder: 4730:4740 got reply transaction with no transaction stack [ 849.080548] binder: 4730:4740 transaction failed 29201/-71, size 0-8 line 2759 [ 849.112555] binder: undelivered TRANSACTION_ERROR: 29201 [ 849.118098] binder: undelivered TRANSACTION_ERROR: 29201 22:56:39 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) read(r1, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(r0, 0x5413, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000016) 22:56:39 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x17fff, 0x0) ioctl$TIOCGSID(r1, 0x5429, &(0x7f0000000040)) ioctl$PIO_FONTRESET(r1, 0x40096101, 0x707000) 22:56:39 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vga_arbiter\x00', 0x200c00, 0x0) ioctl$GIO_FONT(r1, 0x4b60, &(0x7f00000000c0)=""/112) ioctl$sock_SIOCBRADDBR(r0, 0x89a0, &(0x7f0000000040)) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r3 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r3, 0x1, 0x32, &(0x7f0000000000)=r2, 0x4) 22:56:39 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x2b000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:39 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000480)='/dev/ptmx\x00', 0x201, 0x0) ioctl$TCSETSW(r1, 0x5403, &(0x7f0000000040)) write$binfmt_aout(r1, &(0x7f00000000c0)=ANY=[], 0xffffff78) ioctl$TCSETS(r1, 0x40045431, &(0x7f00003b9fdc)) syz_open_pts(r1, 0x0) ioctl$TCSETSW(r1, 0x5403, &(0x7f0000000140)={0x0, 0x0, 0x0, 0xaf2}) read(r0, &(0x7f00000002c0)=""/19, 0x13) 22:56:39 executing program 4: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000ac0)=@broute={'broute\x00', 0x20, 0x4, 0x938, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000b40], 0x0, &(0x7f00000001c0), &(0x7f0000000b40)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{{{0x11, 0x0, 0x0, 'veth0\x00', 'ip6tnl0\x00', 'bcsh0\x00', 'bond_slave_1\x00', @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], @link_local={0x1, 0x80, 0xc2}, [], 0x2d8, 0x340, 0x370, [@bpf0={'bpf\x00', 0x210, {{0x1, [{0x6}]}}}, @cgroup0={'cgroup\x00', 0x8}]}, [@common=@mark={'mark\x00', 0x10}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x8}]}, @common=@CLASSIFY={'CLASSIFY\x00', 0x8}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{{{0x1f, 0x0, 0x0, 'ip6gre0\x00', 'gre0\x00', 'veth0\x00', 'veth0_to_bond\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @link_local={0x1, 0x80, 0xc2}, [], 0xc0, 0xc0, 0xf0, [@nfacct={'nfacct\x00', 0x28, {{'syz0\x00'}}}]}}, @common=@NFQUEUE0={'NFQUEUE\x00', 0x8}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x2, [{{{0x9, 0x0, 0x0, 'syzkaller1\x00', 'rose0\x00', 'team_slave_1\x00', 'vcan0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x70, 0x70, 0xa0}}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x8}}, {{{0x11, 0x0, 0x0, 'nr0\x00', 'yam0\x00', 'ip6tnl0\x00', 'team_slave_0\x00', @empty, [], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], 0x2f8, 0x348, 0x378, [@bpf0={'bpf\x00', 0x210}, @helper={'helper\x00', 0x28, {{0x0, 'tftp-20000\x00'}}}]}, [@common=@LED={'LED\x00', 0x28, {{'syz1\x00'}}}]}, @common=@STANDARD={'\x00', 0x8}}]}]}, 0x9b0) r1 = socket(0x10, 0x3, 0x0) syz_emit_ethernet(0x1, &(0x7f0000000000)=ANY=[@ANYBLOB="cdbf0e000084da80c200000086dd6002290f00383a00fe8000009c086c625a0200000000000000000000000000000000ff"], 0x0) ioctl$sock_ifreq(r1, 0x89f0, &(0x7f00000000c0)={'ip6gre0\x00', @ifru_data=&(0x7f0000000000)="ac8be4abd0f79d6325ae476aab5970a3131f2fb4bbfb3c75500e33d0612f430d"}) 22:56:39 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x0, 0x1c000000]}) 22:56:39 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x74, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) [ 849.595846] binder: 4748:4749 BC_FREE_BUFFER u0000000000000000 no match [ 849.635264] binder: 4748:4749 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 22:56:39 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x0, 0xe000]}) [ 849.642372] binder: 4748:4749 got reply transaction with no transaction stack [ 849.649761] binder: 4748:4749 transaction failed 29201/-71, size 0-8 line 2759 22:56:39 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/sys/net/ipv4/vs/ignore_tunneled\x00', 0x2, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000003fe8)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) signalfd4(r0, &(0x7f00000001c0)={0x3}, 0x8, 0x0) accept4$inet6(r0, &(0x7f0000000200)={0x0, 0x0, 0x0, @mcast2}, &(0x7f0000000240)=0x1c, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) tee(r2, r1, 0x3f, 0x0) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r2, 0x84, 0x8, &(0x7f0000013e95), 0x4) setsockopt$sock_timeval(r2, 0x1, 0x6, &(0x7f0000000000), 0xffffffffffffffc4) r3 = openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x81, 0x0) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000080)={0x0, 0x2}, &(0x7f00000000c0)=0x8) setsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r3, 0x84, 0x18, &(0x7f0000000140)={r4, 0x8}, 0x8) close(r2) close(r1) 22:56:39 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x4], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:39 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=ANY=[@ANYBLOB="180000000000000000000000000000000000000000000000"], &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000000)=r0, 0x4) [ 849.742760] binder: 4748:4779 BC_FREE_BUFFER u0000000000000000 no match [ 849.794450] binder: 4748:4779 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 849.801613] binder: 4748:4779 got reply transaction with no transaction stack [ 849.808995] binder: 4748:4779 transaction failed 29201/-71, size 0-8 line 2759 22:56:40 executing program 4: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_sctp(0x2, 0xb, 0x84) getsockopt$IP_VS_SO_GET_SERVICE(r0, 0x0, 0x483, &(0x7f0000000280), &(0x7f0000000240)=0xfffffdde) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x82c42, 0x0) 22:56:40 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x33], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:40 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa000000, 0x0, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) 22:56:40 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000000)=r0, 0x4) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x202000, 0x0) [ 849.921189] binder: undelivered TRANSACTION_ERROR: 29201 [ 849.926825] binder: undelivered TRANSACTION_ERROR: 29201 [ 850.002737] binder: 4803:4805 BC_FREE_BUFFER u0000000000000000 no match [ 850.024192] binder: 4803:4805 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 850.031552] binder: 4803:4805 got reply transaction with no transaction stack [ 850.038918] binder: 4803:4805 transaction failed 29201/-71, size 0-8 line 2759 [ 850.071416] binder: 4803:4811 BC_FREE_BUFFER u0000000000000000 no match [ 850.083516] binder: 4803:4811 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 850.090708] binder: 4803:4811 got reply transaction with no transaction stack [ 850.098171] binder: 4803:4811 transaction failed 29201/-71, size 0-8 line 2759 [ 850.126072] binder: undelivered TRANSACTION_ERROR: 29201 [ 850.131711] binder: undelivered TRANSACTION_ERROR: 29201 22:56:40 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) read(r1, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(r0, 0x5412, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000016) 22:56:40 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x0, 0x1c00]}) 22:56:40 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x3], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:40 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x802, 0x0) ioctl$SG_SET_COMMAND_Q(r1, 0x2271, &(0x7f0000000040)=0x1) openat$full(0xffffffffffffff9c, &(0x7f0000000140)='/dev/full\x00', 0x101240, 0x0) ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f00000000c0)={&(0x7f0000ffc000/0x1000)=nil, 0x1000}) r2 = epoll_create1(0x0) close(r2) ioctl$KVM_GET_FPU(r1, 0x81a0ae8c, &(0x7f0000000280)) setsockopt$sock_int(r1, 0x1, 0x2f, &(0x7f0000000080)=0x4, 0x4) 22:56:40 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=ANY=[@ANYBLOB="1840000000000000040000000000000095000000817e0000"], &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x0, 0x0) write$cgroup_type(r2, &(0x7f0000000080)='threaded\x00', 0x9) ioctl$KVM_ENABLE_CAP(r2, 0x4068aea3, &(0x7f00000000c0)={0x74, 0x0, [0x6, 0x3, 0x0, 0xf8]}) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000000)=r0, 0x4) 22:56:40 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) 22:56:40 executing program 6: r0 = socket(0xa, 0x1, 0x0) uname(&(0x7f0000000000)=""/187) recvmsg$kcm(r0, &(0x7f00000021c0)={&(0x7f0000000140)=@rc, 0x80, &(0x7f00000000c0)=[{&(0x7f00000001c0)=""/4096, 0x1000}], 0x1, &(0x7f00000011c0)=""/4096, 0x1000, 0x4c}, 0x2) getsockopt$inet6_int(r0, 0x6, 0x23, &(0x7f0000000100), &(0x7f0000013000)=0x10) 22:56:40 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4d8fe459, &(0x7f0000000140)="295ee1311f16f4776710703c3221856499de765894d5df56c4ca2154c0fc71c87394a4054d673691c0d24b8de64675d8b77d76dfe11ff0286eb525dad3c85904c3191a112a8be1555340155d44501adb170df498845f9be6695bc26c664cd01c") r1 = socket$inet(0x10, 0x3, 0xc) sendmsg(r1, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000040107031dfffd946fa2830020200a0009000100001d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) [ 850.707711] binder: 4830:4832 BC_FREE_BUFFER u0000000000000000 no match [ 850.726358] binder: 4830:4832 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 850.733463] binder: 4830:4832 got reply transaction with no transaction stack [ 850.740844] binder: 4830:4832 transaction failed 29201/-71, size 96-8 line 2759 22:56:41 executing program 6: openat$mixer(0xffffffffffffff9c, &(0x7f0000000100)='/dev/mixer\x00', 0x0, 0x0) r0 = socket$nl_generic(0xa, 0x5, 0x84) sendmsg(0xffffffffffffffff, &(0x7f0000001880)={&(0x7f00000001c0)=@l2={0x1f}, 0x19d, &(0x7f0000000240), 0x1000000000000353, &(0x7f0000000280)=ANY=[], 0x2a784d34d8ba1e6c}, 0x0) getegid() rseq(&(0x7f0000000000), 0x20, 0x0, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000000100)='/dev/nullb0\x00', 0x4002, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x10, r0, 0x10008000000000) chown(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) 22:56:41 executing program 4: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$tun(&(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={"79616d300001178b00", 0x80401a}) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x1, 0x31, 0xffffffffffffffff, 0x0) ioctl$TUNSETVNETLE(r0, 0x400454de, &(0x7f0000000040)) r1 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0xfffffffffffffffd, 0x101000) ioctl$VHOST_SET_VRING_NUM(r1, 0x4008af10, &(0x7f0000000080)={0x1, 0xffffffff}) ioctl$KVM_HAS_DEVICE_ATTR(r1, 0x4018aee3, &(0x7f0000000200)={0x0, 0x4, 0x8, &(0x7f0000000100)=0x4}) mincore(&(0x7f0000086000/0x3000)=nil, 0x3000, &(0x7f0000000340)=""/4096) 22:56:41 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x7], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) [ 850.757266] netlink: 20 bytes leftover after parsing attributes in process `syz-executor7'. 22:56:41 executing program 0: bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=ANY=[@ANYBLOB="18000000000000000000000000bb11f475be6f6c15000000"], &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r0 = syz_open_dev$admmidi(&(0x7f0000000040)='/dev/admmidi#\x00', 0x4, 0x87697a3ec595915b) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r0, 0xc05c5340, &(0x7f0000000080)={0x8, 0x8001, 0x1, {}, 0x1, 0x7f}) openat$nullb(0xffffffffffffff9c, &(0x7f0000000180)='/dev/nullb0\x00', 0x250001, 0x0) ioctl$SIOCSIFMTU(r0, 0x8922, &(0x7f0000000140)={'ip6gre0\x00', 0x4}) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) ioctl$SG_SET_COMMAND_Q(r0, 0x2271, &(0x7f00000001c0)=0x1) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000000)=r0, 0x4) socket$vsock_dgram(0x28, 0x2, 0x0) ioctl$EVIOCGRAB(r0, 0x40044590, &(0x7f0000000100)=0x2fe7) 22:56:41 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x0, 0x0, 0x100000000000000]}) [ 850.840540] binder: 4830:4853 BC_FREE_BUFFER u0000000000000000 no match 22:56:41 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x1000, &(0x7f00000000c0)="295e80311f16f404001070") getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r0, 0x84, 0x66, &(0x7f0000000000)={0x0, 0x2}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000000080)={r1, 0x2, 0x30}, &(0x7f0000000100)=0xc) r2 = socket$inet6_sctp(0xa, 0x200000000000005, 0x84) setsockopt$inet_sctp6_SCTP_MAXSEG(r2, 0x84, 0xd, &(0x7f00000003c0), 0x4) [ 850.885946] binder: 4830:4853 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 850.893116] binder: 4830:4853 got reply transaction with no transaction stack [ 850.900458] binder: 4830:4853 transaction failed 29201/-71, size 96-8 line 2759 22:56:41 executing program 6: r0 = socket$inet6(0xa, 0x2, 0x401) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000ac0)=@broute={'broute\x00', 0x20, 0x4, 0x810, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000280], 0x0, &(0x7f00000001c0), &(0x7f0000000200)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff010000001100000000000000000076657468300000000000000000000000697036746e6c3000000000000000000062637368300000000000000000002200626f6e645f736c6176655f3100000000aac8aa3c71bb0000000000000180c20000000000000000000000d000000038010000680100007374617465000000000000000000000000000000000000000000000000000000080000000000000000000000000000006367726f75700000000000000000000000000000000000000000000000000000080000000000000000000000000000006d61726b00000000000000000000000000000000000000000000000000000000100000000000000000000000000000efffffffffffffff00434f4e4e5345434d41524b00000000000000000000000000000000000000000008000000000000000000000000000000434c4153534946590000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff010000001f00000000000000000069703667726530000000000000000000677265300000000000000000000000007665746830000000000000000000000076657468305f746f5f626f6e64000000aaaaaaaaaa000000000000000180c20000000000000000000000c0000000c0000000f00000006e66616363740000000000000000000000000000000000000000000000000000280000000000000073797a300000000000000000000000000000000000000000000000000000000000000000000000004e46515545554500000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008939fdbf2f0c8112fa00000000000002000000ffffffff020000000900000000000000000073797a6b616c6c657231000000000000726f73653000000000000000000000007465616d5f736c6176655f31000000007663616e300000000000000000000000000000000000000000000000aaaaaaaaaa0000000000000000007000000070000000a0000000434f4e4e5345434d41524b0000000000000000000000000000000000000000000800000000000000105d00110000000000000000006e72300000000000000000006d30000000000000000000000000697036746e6c300000000000000000007465616d5f736c6176655f3000000000000000000000000000000000aaaaaaaaaa000000000000000000f802000028040000580400006270660000000000000000000000000000000000000000000000000000000000100200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e400000000000000000000000000000000000000000000000000000000000000000093c4000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000068656c7065720000000000000000000000000000000000000000000000000000280000000000000000000000746674702d323030303000000000000000000000000000000000000000000000000000005345434d41524b000000000000000000000000000000000000000000100000000801000000000000000000000000000073797374656d5f753a6f626a6563745f723a6576656e745f6465766963655f743a73300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000ef92fc18632d758a335f4487528861159e23cdac7e58dafd2dfc273a91c883f5d93e3a4fe36c732626aca4f72e029e8450883e36f52c5cb5c1affcfb1399391ce74feb076f57b8b39cf5897a29c62cfea55b81122c2ef2cc6350b3f2a6ffa74dce948b0881d5db3def8d819b36fca644e7513a75e99616fba76aba1c4cd8a142d32bc62ae67ec500cef6cb"]}, 0x917) 22:56:41 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x1000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) [ 850.972510] sctp: [Deprecated]: syz-executor7 (pid 4867) Use of int in maxseg socket option. [ 850.972510] Use struct sctp_assoc_value instead [ 850.995337] kernel msg: ebtables bug: please report to author: Wrong len argument [ 851.090007] binder: undelivered TRANSACTION_ERROR: 29201 [ 851.095668] binder: undelivered TRANSACTION_ERROR: 29201 22:56:41 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) read(r1, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(r0, 0x541d, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000016) 22:56:41 executing program 4: r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000100)={&(0x7f0000000480)=ANY=[@ANYBLOB="1c0000005e000502000000ff000000000000000008000000d2000000"], 0x1c}, 0x1}, 0x0) 22:56:41 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x0, 0x0, 0x600000000000000]}) 22:56:41 executing program 0: r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x143180, 0x0) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000080)={{0x2, 0x4e23, @broadcast=0xffffffff}, {0x7, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}}, 0x0, {0x2, 0x4e24, @broadcast=0xffffffff}, 'bridge_slave_1\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r2 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f0000000000)=r1, 0x4) 22:56:41 executing program 6: mkdir(&(0x7f0000000100)='./file0\x00', 0x10) mount(&(0x7f000000a000)='./file0\x00', &(0x7f000000aff8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000001c000)) chdir(&(0x7f0000000780)='./file0\x00') r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ioctl$BLKROTATIONAL(r0, 0x127e, &(0x7f0000000040)) ioctl$PIO_FONT(r0, 0x4b61, &(0x7f0000000000)="6007d038840beff2fe46226cb3cab676bb41799f80aaa39475a2e7c3144c6e51b67e6f30e21954abd5303792e83b488803e4da3245d0397548a16e59dad671") syz_fuse_mount(&(0x7f0000000080)='../file0\x00', 0x0, 0x0, 0x0, 0x0, 0x1021) ioctl$sock_bt_bnep_BNEPGETCONNINFO(r0, 0x800442d3, &(0x7f00000000c0)={0x100, 0x4, 0x81, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x10}, 'bond_slave_1\x00'}) 22:56:41 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) 22:56:41 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x3c000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:41 executing program 7: socketpair$inet6_sctp(0xa, 0x1, 0x84, &(0x7f00000002c0)={0xffffffffffffffff}) accept4(r0, &(0x7f0000000040)=@pppol2tpv3={0x0, 0x0, {0x0, 0xffffffffffffffff, {0x0, 0x0, @loopback}}}, &(0x7f0000000300)=0x80, 0x80800) getsockopt$inet_sctp6_SCTP_MAXSEG(0xffffffffffffff9c, 0x84, 0xd, &(0x7f0000000100)=@assoc_value={0x0}, &(0x7f0000000140)=0x8) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r1, 0x84, 0x17, &(0x7f0000000200)={r2, 0x4, 0x64, "6ab28869010981618ba2ab3ef5b258c7b84b6f7ab1fa856fa21b23cb1184242d66e0fb2e2d45471969c880d2f16ec9d3f5be7aa683eb435d07236a170bd4ac2daa47268b39d6e9d8e8b285706c4a2775822dec960484c3ca44a9094eb8340c2211f34794"}, 0x6c) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xae0000)=nil, 0xae0000, 0x0, 0x4d031, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) [ 851.778787] binder: 4890:4892 BC_FREE_BUFFER u0000000000000000 no match 22:56:42 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x3b00], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:42 executing program 6: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000280)=0xe) ioctl$FIONREAD(r0, 0x541b, &(0x7f0000000080)) 22:56:42 executing program 4: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$unix(0x1, 0x801, 0x0) r0 = socket$unix(0x1, 0x1, 0x0) bind$unix(r0, &(0x7f0000003000)=@abs={0x1}, 0x8) connect(r0, &(0x7f0000000040)=@un=@abs={0x1}, 0x80) [ 851.827753] binder: 4890:4892 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 851.834899] binder: 4890:4892 got reply transaction with no transaction stack [ 851.842451] binder: 4890:4892 transaction failed 29201/-71, size 16-8 line 2759 22:56:42 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=@framed={{0x18}, [], {0x95}}, &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = openat$urandom(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/urandom\x00', 0x8000, 0x0) getsockopt$XDP_MMAP_OFFSETS(r1, 0x11b, 0x1, &(0x7f0000000600), &(0x7f0000000680)=0x60) r2 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f0000000000)=r0, 0x4) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='reno\x00', 0x5) setsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, &(0x7f0000000080)=0x6, 0x4) 22:56:42 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x0, 0x0, 0x3000000]}) [ 851.954455] binder: 4890:4922 BC_FREE_BUFFER u0000000000000000 no match [ 851.990780] binder: 4890:4922 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 22:56:42 executing program 6: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000005ff7)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000009fe8)={0x80000001, 0x1a, 0x4, 0xffffffffffffffff}) r2 = socket(0xa, 0x1, 0x0) ioctl(r2, 0x8912, &(0x7f0000000240)="c626262c8523bf012cf66f") mmap(&(0x7f0000004000/0x4000)=nil, 0x2, 0x0, 0x6012, r1, 0x2000) r3 = socket$inet_dccp(0x2, 0x6, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x4e22, @multicast1=0xe0000001}, 0x10) 22:56:42 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x2c00], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:42 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3bb, &(0x7f0000000000)=ANY=[], &(0x7f0000000340)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9155347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d125939367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3cdbe04046427fde9f58d59221b8b3210af1b6b403d8a14f3141317c4a7e3ea570a85de416e367c94b289a89866abc0c14d72f6af6e16aeb81addc2bcd132c56b858cd2f94dd66770d8d063edbf8bda8d446c12f97642be7050e3bdb852f05b37079c2da0a7ae9c78b09799c5b0c31646d09021cc193da004f19bf95b46d39fadaf49bb1f8ea86c049d988329759c75e648697ad2fb2257e995b0517d92bb5d7428de10764d85f2337fbfc1e77caccf83d6522b1629dc7fe4c4b0678bb55c0283f48b2918827e1ce993e138298fe715dc78246e5185736c3d96ae3475881bb582e9d13d0b20db18dbb685cde3c37943d8a88158212b7455eb3d11bd66fda805ad32b199cb1174040e3ff17d050da89097c24eff9377b96e996715db40225af76267cd2907113235bd2d434bcbd79ae06f25130b60e3f4378e3bda6d1c84b2fd757bc0d7712bbe5b50bb76c4444b0683fd27acf81e224a478b991cb2510a86ae3a2382eceb0d54984ea6c5b3d29dbf28b4b5b98a7933e13235739a3ec89750e4bdabd8aba3d5f1adda2c51fd590b999d6370da01b1c0bd496e018fcdf956b9edf102e43f146b2084f89a5e9b78082b8956056d46c09ea3fc0ce9f2", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000040)=r0, 0xfffffffffffffcd0) [ 851.997948] binder: 4890:4922 got reply transaction with no transaction stack [ 852.005353] binder: 4890:4922 transaction failed 29201/-71, size 16-8 line 2759 [ 852.114231] binder: undelivered TRANSACTION_ERROR: 29201 [ 852.119894] binder: undelivered TRANSACTION_ERROR: 29201 22:56:43 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) read(r1, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(r0, 0x5450, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000016) 22:56:43 executing program 7: r0 = memfd_create(&(0x7f0000000300)="0000000010573860b48e03ab0b8110408d893dac540318386fc7e2d740bd31e757e1ae2e3d919d036f2e3d2a17abca4287afd240c0f4b24d623af9f16312755a71654bf931e5704191541d13f5762dadc275e112a8030bf0621fa161bc744923b22b21b6ababbc86cdc1e0a0569fbd31345e7978c3c7175089f36fc12006e0575ef969c45e8fb854b36f9a3319fb30c0a76fe0f7a3ccb89b7c7bbede0de110c40d2ed349c687122fa098892b87a16cc3540fdf9cb289a4509aaddcb1e389bf2239dcd6c886587dcefea2204935721c83bacd0f177f5f229407ced0623ac9e98abb967cf5fd5b867eb063f3ba1e0e046aeb0da0312d171f4aa734acc712e6f7273a832227698f5c25fc87f25e961c3fdc9d4e0f2a1ec6a0ef46662046e9ff54f225e07b831d6bc401043f360748cdbb1e750d1d3de8f0b8bddb94362933c22f69bc71c1d69edc4c49f191925f48b6c41c1fd5deebe6981ea2b653f17d8ead11da91fdc4f377722ce6332852d3101c063105191e585ba7cbd3fe352a3e1889c84f626500000000ff2e70", 0x2) write(r0, &(0x7f0000000040)="16", 0x1) sendfile(r0, r0, &(0x7f0000000100), 0x7) fcntl$addseals(r0, 0x409, 0x8) fsetxattr(r0, &(0x7f0000000000)=@known='system.posix_acl_access\x00', &(0x7f0000000080)="02000000b2de30925a1d964243791761ef9e39fb6ca87aac88e2eca883369ed56870d13d9b4ead92a681770568e16fd47240f2", 0x4, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") clone(0x0, &(0x7f0000b6b000), &(0x7f0000744000), &(0x7f0000fef000), &(0x7f0000000000)) 22:56:43 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x0, 0x0, 0x700]}) 22:56:43 executing program 4: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'echainiv(aegis256)\x00'}, 0x58) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000080)=0x0) getpgid(r1) r2 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x2, 0x400200) setsockopt$XDP_UMEM_REG(r2, 0x11b, 0x4, &(0x7f00000001c0)={&(0x7f0000000100)=""/153, 0x0, 0x800, 0x80000001}, 0x18) setsockopt$ALG_SET_AEAD_AUTHSIZE(r0, 0x117, 0x5, 0x0, 0x9) 22:56:43 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff7f00000000, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) 22:56:43 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000006dd7d25ee77f2a77084d5110a0b88614a0036a1ca1c9fc9e57cbedd5f3b11c1d3000000000000109500000000"], &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) r2 = syz_open_dev$midi(&(0x7f0000000080)='/dev/midi#\x00', 0x401, 0x501000) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_NEXT_DEVICE(r2, 0xc0045540, &(0x7f00000000c0)=0xa8) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000000)=r0, 0xffffffffffffff0f) 22:56:43 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x3a00], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:43 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x3a000000], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) [ 852.863464] binder: 4951:4956 BC_FREE_BUFFER u0000000000000000 no match [ 852.884548] binder: 4951:4956 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 852.891641] binder: 4951:4956 got reply transaction with no transaction stack [ 852.899099] binder: 4951:4956 transaction failed 29201/-71, size -554050781184-8 line 2759 22:56:43 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000000140)=ANY=[@ANYBLOB="180000000000000000000040000000009500000000000000770667927600006d60a6237246b1decf53586f05d449ab659f7f4824fcc5fbdff2cdfcab6153c7fdccbe11e02fa2fac9190bc825cfb504df864f671252ba82d3308832a2890cd47e0bd6367cbef3014d934ed3a5"], &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x0, 0xfb, &(0x7f0000000040)=""/251, 0x0, 0x1}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000000)=r0, 0x4) 22:56:43 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x0, 0x0, 0x30]}) 22:56:43 executing program 4: r0 = add_key(&(0x7f0000000040)='id_legacy\x00', &(0x7f0000000080)={0x73, 0x79, 0x7a}, &(0x7f0000000280)="80", 0x1, 0xfffffffffffffffc) keyctl$restrict_keyring(0x1d, r0, &(0x7f00000000c0)='dns_resolver\x00', &(0x7f0000000340)='(!\x00') r1 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000000)='/dev/urandom\x00', 0x41, 0x0) getsockopt$inet6_tcp_buf(r1, 0x6, 0xd, &(0x7f0000000100)=""/99, &(0x7f0000000180)=0x63) [ 853.007625] binder: 4951:4980 BC_FREE_BUFFER u0000000000000000 no match [ 853.038461] binder: 4951:4980 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 853.045578] binder: 4951:4980 got reply transaction with no transaction stack 22:56:43 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x6], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:43 executing program 7: r0 = memfd_create(&(0x7f0000000300)="0000000010573860b48e03ab0b8110408d893dac540318386fc7e2d740bd31e757e1ae2e3d919d036f2e3d2a17abca4287afd240c0f4b24d623af9f16312755a71654bf931e5704191541d13f5762dadc275e112a8030bf0621fa161bc744923b22b21b6ababbc86cdc1e0a0569fbd31345e7978c3c7175089f36fc12006e0575ef969c45e8fb854b36f9a3319fb30c0a76fe0f7a3ccb89b7c7bbede0de110c40d2ed349c687122fa098892b87a16cc3540fdf9cb289a4509aaddcb1e389bf2239dcd6c886587dcefea2204935721c83bacd0f177f5f229407ced0623ac9e98abb967cf5fd5b867eb063f3ba1e0e046aeb0da0312d171f4aa734acc712e6f7273a832227698f5c25fc87f25e961c3fdc9d4e0f2a1ec6a0ef46662046e9ff54f225e07b831d6bc401043f360748cdbb1e750d1d3de8f0b8bddb94362933c22f69bc71c1d69edc4c49f191925f48b6c41c1fd5deebe6981ea2b653f17d8ead11da91fdc4f377722ce6332852d3101c063105191e585ba7cbd3fe352a3e1889c84f626500000000ff2e70", 0x2) write(r0, &(0x7f0000000040)="16", 0x1) sendfile(r0, r0, &(0x7f0000000100), 0x7) fcntl$addseals(r0, 0x409, 0x8) fsetxattr(r0, &(0x7f0000000000)=@known='system.posix_acl_access\x00', &(0x7f0000000080)="02000000b2de30925a1d964243791761ef9e39fb6ca87aac88e2eca883369ed56870d13d9b4ead92a681770568e16fd47240f2", 0x4, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") clone(0x0, &(0x7f0000b6b000), &(0x7f0000744000), &(0x7f0000fef000), &(0x7f0000000000)) [ 853.052950] binder: 4951:4980 transaction failed 29201/-71, size -554050781184-8 line 2759 [ 853.223814] binder: undelivered TRANSACTION_ERROR: 29201 [ 853.229476] binder: undelivered TRANSACTION_ERROR: 29201 22:56:44 executing program 2: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000d53fc1)={@link_local={0x1, 0x80, 0xc2}, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x67, 0x0, @rand_addr, @broadcast=0xffffffff}, @icmp=@parameter_prob={0x21, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}, @multicast1=0xe0000001}}}}}}, &(0x7f0000ea3000)={0x0, 0x0, [0x0, 0x0, 0x400000000000000]}) 22:56:44 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x8, 0x3, &(0x7f0000346fc8)=ANY=[@ANYBLOB="180010000000000000000000000000009500000000000000"], &(0x7f0000000200)="57504c00a4e10f98fcc55de1b8146f6a73ea1519815b00b9f7dd331c050bd9eb6bf9a4913f88a7d36222be4d2dfef78953bd70ecf4d172fc137d1f92cf019c9374c17276f9a2b38ff4d9ef49b2dd94928a56af064db56742a99ff1ed897b419f38dcabc5cecb345691313534637e60b76d6703c27d2a9154347ee9740a488f28c032f2a52ffeed5fcdfda6fc4b4d86f97ff0891d1259367e90747d42ce13951137006031dc83e1113c9875532ca615755669a2a14c7bc5c15d44be3127818361c26362cbf9160ac6a76b5496f6641415597084ba242cf1a46927508d747beb0751156431876973036358cd336921469e54bd5c34be843f23e07e8b32c7a2bb0c75e7c010c6753a4068b4a46b0bd2e9901b8b7bfdf282a3b58f314002d5a24bf03c4eb8c3", 0x1, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) r1 = socket$vsock_dgram(0x28, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000000)=r0, 0x4) 22:56:44 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = memfd_create(&(0x7f0000003ffa)='w0\x00\x00\x00', 0x0) mount(&(0x7f0000000140)='.\x00', &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)='afs\x00', 0x10000, &(0x7f0000000200)="65b5328661598162e40a02c3229a99f18d6edac59e77bbb79a81f32bd3034ec63f224a6facc8391e1db6a450d8f466d941") socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000a8eff8)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_int(r3, 0x1, 0x7, &(0x7f0000ac5000), 0x4) setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, &(0x7f00000000c0)=0x10000, 0x4) sendmmsg$unix(r3, &(0x7f00000bd000), 0x80, 0x0) r4 = memfd_create(&(0x7f0000000080)='dev ', 0x3) write(r4, &(0x7f0000000040)="16", 0x1) sendfile(r3, r4, &(0x7f0000000000), 0xffff) fcntl$addseals(r4, 0x409, 0x8) lseek(r4, 0x0, 0x4) close(r2) dup2(r1, r4) 22:56:44 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0x60, 0x0, &(0x7f0000000480)=[@free_buffer={0x40086303}, @request_death={0x400c630e, 0x0, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300, 0x8, &(0x7f0000000000), &(0x7f0000000040)=[0x0]}}], 0x13, 0x0, &(0x7f0000000380)="10c93fc7bc334cae0cec03a18455fa6144fe0e"}) writev(0xffffffffffffffff, &(0x7f00007af000)=[{}], 0x1) 22:56:44 executing program 1: syz_emit_ethernet(0x52, &(0x7f0000000700)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, [], {@ipv6={0x86dd, {0x0, 0x6, "0f8e3f", 0x1c, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x3a], 0xaa}, {[@fragment={0x3a, 0x0, 0x0, 0x3}], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f0000000840)) 22:56:44 executing program 6: r0 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f00000002c0)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000000300)="848432503e1ac2bae9d92c5d144121fbb1962144eae8978bd4f065eadead9ca85fd3c49e925de4007488bf80a2152f25efb149bbddc4493ad0c625b2e5cfabf2f745b9a6586673f693fc49f3b2e10e38afb34f9befefa874c9e7033ccc0e967bec6de22d59ece236cb34ca95781888a02e9796e3342b40b123e5f81ff5e36b907efecba4cfbf634fd3fe7f546dba4cdcc4fe13ac83893eef8276820db8efd0e90729fb71a71d96dd945238acddb8375d4b349d571748902d266efb9ab909b8b6", 0x11e, 0xfffffffffffffffd) r1 = add_key$user(&(0x7f0000000140)='user\x00', &(0x7f00000001c0)={0x73, 0x79, 0x7a}, &(0x7f0000000200)="1f", 0x1, 0xfffffffffffffffe) keyctl$update(0x2, r1, &(0x7f0000000a00)="4c4e334d5e1700ca2dd8501d055bf619d3f372cfab8ceea491bdc1c6acff5adbffe8c41c1e9387af42acfbe93e7d086eb2b7fbb835b2af7dd153489798659864bafb6e830f16e2af6aa1975fe1acf99f5628bc07c7ff3dc106e422f5bf8a900e6c99140a84fa139d2790e6adc7eecb2693d1a421a7f03b37386f7eff9db5b582f73c80080ee4c7914175dde1a9dc11b96234918323315134fac219ebeac0f806a6f57be3d1b8f01ed36fb9658f4ab62fc4b2bfbb459ef3f75a767f9e829b7d071e0ce4595822ccc68d3ceb37d7f0097959e1a7ebef509deb7fe54c40360d91ef13a86f52b2f2f555cbc8a61810f80800a8bec2bf441418816686294817b8ec6cf0e1a35a22e688fb13169a5620a326f6db9b7eec0eed2a74916375151c79880300c228fd522a6f0f35adcebeed22e7ddd18a5e84ae09e631d2e0ee9c49942db353488c2a51d8fb713653d93d08c872b64a863ff390dd29ca0c74b485e1eeda14ab91dbec45d238fc5c650d89e3f9157c5390f50348ec2d8b0073e8bb8c29ea580a9b5ce6382cca01f20431418a270a80d63048bf1ba499233b6d58b44ffdee556ea7b615eb44c755f0839691d756c9560d567d7294dc45389b990105a5dbf9fd873d81e796b3561d8296d5c9664166c929d03ffc7a0944a90e49bec0ebcf6678f91e6ffccbd6389a69243082f2250680c8e5fadc2c9a14191d937c230694aab39231daf00ca4547b01553ee2f56808025951", 0xf166) keyctl$dh_compute(0x17, &(0x7f0000000080)={r1, r0, r0}, &(0x7f00000004c0)=""/155, 0x48, &(0x7f0000000600)={&(0x7f0000000000)={'sha384\x00'}, &(0x7f0000000180)="4371e42d488dd21f67e5803d483d0c8a8d40be0b6200000000", 0x19}) r2 = request_key(&(0x7f0000000240)='big_key\x00', &(0x7f0000000280)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000580)='user\x00', r0) socketpair$inet_udp(0x2, 0x2, 0x0, &(0x7f0000000780)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$netlink(0x10, 0x3, 0x1b) sendfile(r3, r4, &(0x7f00000007c0), 0x1) add_key$user(&(0x7f00000006c0)='user\x00', &(0x7f0000000700)={0x73, 0x79, 0x7a, 0x0}, &(0x7f0000000740)="319b3292835a9a5fb9", 0x9, r2) add_key$user(&(0x7f00000000c0)='user\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x0}, &(0x7f0000000800)="578487a4f8698db1b4cb28d3c0dc39d45a6b281b8fb4d0acd0624769f67a170ddd0cf3a3e376a3cb37b8531ed217f1637c643d90791a5c83eee14df92f853a4f6fad2bc24b0d2a69f7b552866ffedbd7814f23506bc0a1ffac3dce0fe5fe79639047e8297d10e34a5dd1a2588e05f460375713ff52789c09d8feeeb4bf3a77dbb80d2d5766bb77d36a12be02eff0a9af3c6c51f7e5f8b6b8796b796b12938234e51a5b4c90a3e79a248bc69497e96e5a7e2816defa2491c22a4b6c8cfa5e3f8ab32ac8476d6920d91db837e2f3d6e9d26f6ed735a08a9d091767838d505d7173b8c0245cf7dbc734383e7c6b2df6e9d1bbe6222d834f59", 0xf7, r2) llistxattr(&(0x7f00000005c0)='./file0\x00', &(0x7f0000000640)=""/92, 0x5c) 22:56:44 executing program 7: r0 = memfd_create(&(0x7f0000000300)="0000000010573860b48e03ab0b8110408d893dac540318386fc7e2d740bd31e757e1ae2e3d919d036f2e3d2a17abca4287afd240c0f4b24d623af9f16312755a71654bf931e5704191541d13f5762dadc275e112a8030bf0621fa161bc744923b22b21b6ababbc86cdc1e0a0569fbd31345e7978c3c7175089f36fc12006e0575ef969c45e8fb854b36f9a3319fb30c0a76fe0f7a3ccb89b7c7bbede0de110c40d2ed349c687122fa098892b87a16cc3540fdf9cb289a4509aaddcb1e389bf2239dcd6c886587dcefea2204935721c83bacd0f177f5f229407ced0623ac9e98abb967cf5fd5b867eb063f3ba1e0e046aeb0da0312d171f4aa734acc712e6f7273a832227698f5c25fc87f25e961c3fdc9d4e0f2a1ec6a0ef46662046e9ff54f225e07b831d6bc401043f360748cdbb1e750d1d3de8f0b8bddb94362933c22f69bc71c1d69edc4c49f191925f48b6c41c1fd5deebe6981ea2b653f17d8ead11da91fdc4f377722ce6332852d3101c063105191e585ba7cbd3fe352a3e1889c84f626500000000ff2e70", 0x2) write(r0, &(0x7f0000000040)="16", 0x1) sendfile(r0, r0, &(0x7f0000000100), 0x7) fcntl$addseals(r0, 0x409, 0x8) fsetxattr(r0, &(0x7f0000000000)=@known='system.posix_acl_access\x00', &(0x7f0000000080)="02000000b2de30925a1d964243791761ef9e39fb6ca87aac88e2eca883369ed56870d13d9b4ead92a681770568e16fd47240f2", 0x4, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") clone(0x0, &(0x7f0000b6b000), &(0x7f0000744000), &(0x7f0000fef000), &(0x7f0000000000)) 22:56:44 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) read(r1, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)) ioctl$TIOCSCTTY(r0, 0x5416, 0x0) r2 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r2, 0x1000000000016) [ 854.646253] binder: 5012:5014 BC_FREE_BUFFER u0000000000000000 no match [ 854.676662] binder: 5012:5014 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 854.683758] binder: 5012:5014 got reply transaction with no transaction stack [ 854.691170] binder: 5012:5014 transaction failed 29201/-71, size 768-8 line 2759 [ 854.702235] ================================================================== [ 854.709977] BUG: KASAN: slab-out-of-bounds in sha512_finup+0x564/0x620 [ 854.716668] Write of size 8 at addr ffff8801ada99bb0 by task syz-executor6/5025 [ 854.719891] binder: 5012:5027 BC_FREE_BUFFER u0000000000000000 no match [ 854.724165] [ 854.724191] CPU: 0 PID: 5025 Comm: syz-executor6 Not tainted 4.18.0-rc1+ #112 [ 854.724201] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 854.724206] Call Trace: [ 854.724231] dump_stack+0x1c9/0x2b4 [ 854.724254] ? dump_stack_print_info.cold.2+0x52/0x52 [ 854.732100] binder: 5012:5027 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 854.732639] ? printk+0xa7/0xcf [ 854.732659] ? kmsg_dump_rewind_nolock+0xe4/0xe4 [ 854.732680] ? sha512_finup+0x564/0x620 [ 854.740035] binder: 5012:5027 got reply transaction with no transaction stack [ 854.749314] print_address_description+0x6c/0x20b [ 854.749331] ? sha512_finup+0x564/0x620 [ 854.749343] kasan_report.cold.7+0x242/0x2fe [ 854.749367] __asan_report_store8_noabort+0x17/0x20 [ 854.751958] binder: 5012:5027 transaction failed 29201/-71, size 768-8 line 2759 [ 854.755542] sha512_finup+0x564/0x620 [ 854.755554] ? sha512_update+0x9f/0x260 [ 854.755575] sha512_avx2_final+0x28/0x30 [ 854.776583] binder: undelivered TRANSACTION_ERROR: 29201 [ 854.779624] crypto_shash_final+0x104/0x260 [ 854.779640] ? sha512_avx2_finup+0x40/0x40 [ 854.779660] __keyctl_dh_compute+0x1198/0x1be0 [ 854.787046] binder: undelivered TRANSACTION_ERROR: 29201 [ 854.791834] ? copy_overflow+0x30/0x30 [ 854.791853] ? save_stack+0x43/0xd0 [ 854.855953] ? __kasan_slab_free+0x11a/0x170 [ 854.860348] ? kasan_slab_free+0xe/0x10 [ 854.864318] ? kfree+0xd9/0x260 [ 854.867592] ? __x64_sys_add_key+0x2b7/0x4e0 [ 854.871987] ? do_syscall_64+0x1b9/0x820 [ 854.876060] ? lock_release+0xa30/0xa30 [ 854.880047] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 854.885572] ? _copy_from_user+0xdf/0x150 [ 854.889710] keyctl_dh_compute+0xc5/0x11f [ 854.893846] ? __keyctl_dh_compute+0x1be0/0x1be0 [ 854.898593] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 854.904124] __x64_sys_keyctl+0x12a/0x3b0 [ 854.908272] do_syscall_64+0x1b9/0x820 [ 854.912157] ? syscall_return_slowpath+0x5e0/0x5e0 [ 854.917074] ? syscall_return_slowpath+0x31d/0x5e0 [ 854.922000] ? entry_SYSCALL_64_after_hwframe+0x59/0xbe [ 854.927364] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 854.932206] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 854.937383] RIP: 0033:0x455b29 [ 854.940558] Code: 1d ba fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b9 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 854.959894] RSP: 002b:00007fc82221ac68 EFLAGS: 00000246 ORIG_RAX: 00000000000000fa [ 854.967610] RAX: ffffffffffffffda RBX: 00007fc82221b6d4 RCX: 0000000000455b29 [ 854.974869] RDX: 00000000200004c0 RSI: 0000000020000080 RDI: 0000000000000017 [ 854.982132] RBP: 000000000072bea0 R08: 0000000020000600 R09: 0000000000000000 [ 854.989389] R10: 0000000000000048 R11: 0000000000000246 R12: 00000000ffffffff [ 854.996646] R13: 00000000004bfe04 R14: 00000000004cf058 R15: 0000000000000000 [ 855.003915] [ 855.005531] Allocated by task 5025: [ 855.009151] save_stack+0x43/0xd0 [ 855.012602] kasan_kmalloc+0xc4/0xe0 [ 855.016399] __kmalloc+0x14e/0x760 [ 855.019929] __keyctl_dh_compute+0x1000/0x1be0 [ 855.024499] keyctl_dh_compute+0xc5/0x11f [ 855.028636] __x64_sys_keyctl+0x12a/0x3b0 [ 855.032773] do_syscall_64+0x1b9/0x820 [ 855.036650] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 855.041828] [ 855.043438] Freed by task 3222: [ 855.046715] save_stack+0x43/0xd0 [ 855.050156] __kasan_slab_free+0x11a/0x170 [ 855.054389] kasan_slab_free+0xe/0x10 [ 855.058180] kfree+0xd9/0x260 [ 855.061274] load_elf_binary+0x6c5/0x5610 [ 855.065462] search_binary_handler+0x17d/0x570 [ 855.070046] __do_execve_file.isra.35+0x171d/0x2730 [ 855.075076] __x64_sys_execve+0x8f/0xc0 [ 855.079068] do_syscall_64+0x1b9/0x820 [ 855.082957] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 855.088125] [ 855.089748] The buggy address belongs to the object at ffff8801ada99b40 [ 855.089748] which belongs to the cache kmalloc-128 of size 128 [ 855.102410] The buggy address is located 112 bytes inside of [ 855.102410] 128-byte region [ffff8801ada99b40, ffff8801ada99bc0) [ 855.114267] The buggy address belongs to the page: [ 855.119196] page:ffffea0006b6a640 count:1 mapcount:0 mapping:ffff8801da800640 index:0x0 [ 855.127325] flags: 0x2fffc0000000100(slab) [ 855.131549] raw: 02fffc0000000100 ffffea0006bdac08 ffffea0006c85e48 ffff8801da800640 [ 855.139419] raw: 0000000000000000 ffff8801ada99000 0000000100000015 0000000000000000 [ 855.147278] page dumped because: kasan: bad access detected [ 855.152964] [ 855.154570] Memory state around the buggy address: [ 855.159482] ffff8801ada99a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 855.166827] ffff8801ada99b00: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00 [ 855.174168] >ffff8801ada99b80: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 855.181508] ^ [ 855.186430] ffff8801ada99c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 855.193781] ffff8801ada99c80: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb [ 855.201120] ================================================================== [ 855.208457] Disabling lock debugging due to kernel taint [ 855.214132] Kernel panic - not syncing: panic_on_warn set ... [ 855.214132] [ 855.221506] CPU: 0 PID: 5025 Comm: syz-executor6 Tainted: G B 4.18.0-rc1+ #112 [ 855.230172] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 855.239527] Call Trace: [ 855.242138] dump_stack+0x1c9/0x2b4 [ 855.245779] ? dump_stack_print_info.cold.2+0x52/0x52 [ 855.250989] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 855.255760] panic+0x238/0x4e7 [ 855.258965] ? add_taint.cold.5+0x16/0x16 [ 855.263110] ? do_raw_spin_unlock+0xa7/0x2f0 [ 855.267527] ? do_raw_spin_unlock+0xa7/0x2f0 [ 855.271918] ? sha512_finup+0x564/0x620 [ 855.275876] kasan_end_report+0x47/0x4f [ 855.279835] kasan_report.cold.7+0x76/0x2fe [ 855.284152] __asan_report_store8_noabort+0x17/0x20 [ 855.289150] sha512_finup+0x564/0x620 [ 855.292943] ? sha512_update+0x9f/0x260 [ 855.296953] sha512_avx2_final+0x28/0x30 [ 855.300997] crypto_shash_final+0x104/0x260 [ 855.305312] ? sha512_avx2_finup+0x40/0x40 [ 855.309532] __keyctl_dh_compute+0x1198/0x1be0 [ 855.314106] ? copy_overflow+0x30/0x30 [ 855.317976] ? save_stack+0x43/0xd0 [ 855.321590] ? __kasan_slab_free+0x11a/0x170 [ 855.325994] ? kasan_slab_free+0xe/0x10 [ 855.329953] ? kfree+0xd9/0x260 [ 855.333222] ? __x64_sys_add_key+0x2b7/0x4e0 [ 855.337626] ? do_syscall_64+0x1b9/0x820 [ 855.341679] ? lock_release+0xa30/0xa30 [ 855.345650] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 855.351173] ? _copy_from_user+0xdf/0x150 [ 855.355305] keyctl_dh_compute+0xc5/0x11f [ 855.359437] ? __keyctl_dh_compute+0x1be0/0x1be0 [ 855.364177] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 855.369696] __x64_sys_keyctl+0x12a/0x3b0 [ 855.373831] do_syscall_64+0x1b9/0x820 [ 855.377703] ? syscall_return_slowpath+0x5e0/0x5e0 [ 855.382626] ? syscall_return_slowpath+0x31d/0x5e0 [ 855.387541] ? entry_SYSCALL_64_after_hwframe+0x59/0xbe [ 855.392897] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 855.397725] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 855.402907] RIP: 0033:0x455b29 [ 855.406099] Code: 1d ba fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b9 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 855.425259] RSP: 002b:00007fc82221ac68 EFLAGS: 00000246 ORIG_RAX: 00000000000000fa [ 855.432950] RAX: ffffffffffffffda RBX: 00007fc82221b6d4 RCX: 0000000000455b29 [ 855.440212] RDX: 00000000200004c0 RSI: 0000000020000080 RDI: 0000000000000017 [ 855.447464] RBP: 000000000072bea0 R08: 0000000020000600 R09: 0000000000000000 [ 855.454715] R10: 0000000000000048 R11: 0000000000000246 R12: 00000000ffffffff [ 855.461967] R13: 00000000004bfe04 R14: 00000000004cf058 R15: 0000000000000000 [ 855.469677] Dumping ftrace buffer: [ 855.473214] (ftrace buffer empty) [ 855.476904] Kernel Offset: disabled [ 855.480511] Rebooting in 86400 seconds..